SAUTO Practice Test 7 — 10 Questions

Question 1

A network automation engineer is writing a Python script to interact with a Cisco Firepower Management Center (FMC) REST API. The script must authenticate and obtain a token for subsequent requests. Which HTTP header is used to pass the authentication token in subsequent API calls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

X-auth-access-token. The Cisco FMC REST API requires the authentication token to be included in the X-auth-access-token header for all subsequent requests after initial authentication. This is a custom header specific to FMC, not the standard Authorization header or other token headers used by different APIs. Using the correct header ensures successful API calls.

Answer

Cookie: token=...

Answer

Authorization: Bearer

Answer

X-Auth-Token

Question 2

When using the FMC API, what is the purpose of the 'X-Auth-Access-Token' header?

Accepted Answer

To carry the session token for authentication.. The FMC REST API uses a token-based authentication model: after POSTing credentials to /api/fmc_platform/v1/auth/generatetoken, the response includes X-auth-access-token (and a refresh token). Every subsequent API call must include that token in the X-Auth-Access-Token header so FMC can associate the request with the authenticated session. It is purely an authentication artifact, not a routing or versioning parameter.

Answer

To specify the target device IP address.

Answer

To define the API version.

Answer

To enable debugging mode.

Question 3

When automating Cisco Security solutions, what is the primary benefit of using a 'Service Account' instead of a personal user account for API authentication?

Accepted Answer

Decoupling script execution from individual employee identity.. Service accounts provide non-expiring credentials that are not tied to an individual's lifecycle, ensuring script continuity.

Answer

Improved performance of API calls.

Answer

Automatic elevation of privilege.

Answer

Ability to bypass firewall rules.

Question 4

A network security engineer is automating the deployment of Cisco Umbrella policies using the Umbrella API. The engineer needs to create a new destination list that blocks access to known malicious domains. Which HTTP method and endpoint should be used to create this list?

Accepted Answer

POST to /v1/destinationlists. To create a new destination list in Cisco Umbrella via the API, a POST request to /v1/destinationlists is required. The request body includes the list name and destinations. This is the standard RESTful approach for creating a resource in a collection.

Answer

GET to /v1/destinationlists

Answer

PUT to /v1/destinationlists/{id}

Answer

PATCH to /v1/destinationlists/{id}

Question 5

You are writing a script to monitor 'Cloudlock' alerts. Which API endpoint provides the most relevant data for SOC integration?

Accepted Answer

Incidents endpoint. The Incidents endpoint is the correct choice because Cloudlock incidents represent actual policy violations and security events, which is exactly the data a SOC needs for triage and response. Alerts generated by Cloudlock policies surface as incidents, making this endpoint the primary integration point for SIEM/SOAR platforms.

Answer

Policies endpoint

Answer

Users endpoint

Answer

App Firewall endpoint

Question 6

In the context of the Cisco Cloudlock API, what is the significance of the 'app_id' field?

Accepted Answer

It is the unique identifier for an OAuth application. In the Cisco Cloudlock API, the 'app_id' field is the unique identifier for an OAuth application. Cloudlock monitors and secures cloud applications, and each OAuth application (e.g., a third-party app accessing Google Workspace or Microsoft 365) is assigned a distinct 'app_id'. This allows the API to reference and manage specific applications for policy enforcement, risk assessment, and reporting.

Answer

It is the serial number of the appliance

Answer

It is the identifier for the Cloudlock tenant

Answer

It represents the user's role

Question 7

You are managing Cisco Cloudlock settings via the API. You need to ensure that specific SaaS file-sharing events are flagged. Which API object must you target to define a new policy violation trigger?

Accepted Answer

Policies API. The Cisco Cloudlock Policies API is the object used to create, retrieve, update, and delete policy definitions and their violation triggers. Policy violations in Cloudlock are defined as policy objects with matching criteria (e.g., file-sharing events, DLP patterns, user activity), so a new violation trigger must be created through the Policies API endpoint. The other APIs manage configuration, audit retrieval, application inventory, or user data — none of them define violation logic.

Answer

Configuration API

Answer

Audit API

Answer

Applications API

Answer

Users API

Question 8

You are configuring an Umbrella API callback. What happens if the callback URL is unreachable?

Accepted Answer

The notification is dropped. When an Umbrella API callback URL is unreachable, the notification is simply dropped. Umbrella does not retry indefinitely, revert policies, shut down the API service, or fall back to email. The callback mechanism is fire-and-forget; if the endpoint cannot be reached, the event notification is lost.

Answer

The policy is reverted

Answer

The API service shuts down

Answer

The alert is sent via email

Question 9

When using the 'ncclient' library in Python, what is the primary purpose of the 'manager.connect()' method?

Accepted Answer

To open an SSH-based NETCONF session.. In ncclient, manager.connect() establishes a NETCONF session over SSH (or another transport) to the target device, returning a manager object used for subsequent RPCs like get_config or edit_config. It handles the SSH transport, capability exchange, and session setup. It does not parse YANG, convert XML to JSON, or validate syntax.

Answer

To parse the YANG model.

Answer

To convert XML to JSON.

Answer

To validate the configuration syntax.

Question 10

You are parsing a complex JSON response from a Cisco ISE API. You need to extract the value of the 'macAddress' field nested inside an object named 'endpoint'. Which Python library is best suited for handling this data structure?

Accepted Answer

json. The json library is purpose-built for parsing and manipulating JSON data in Python, making it the correct choice for extracting a nested field like 'macAddress' inside an 'endpoint' object from a Cisco ISE API response. It converts JSON into native Python dictionaries and lists, allowing straightforward key access.

Answer

configparser

Answer

xml.etree.ElementTree

Answer

pickle