SAUTO Practice Test 9 — 10 Questions

Question 1

Which data format is the standard for Cisco's cloud-based security APIs?

Accepted Answer

JSON. Cisco's cloud-based security APIs, including Cloudlock and Umbrella, use JSON (JavaScript Object Notation) as the standard data format for requests and responses. JSON is lightweight, human-readable, and natively supported by most programming languages, making it the de facto standard for RESTful APIs.

Answer

YAML

Answer

CSV

Answer

XML

Question 2

In the context of Cisco Umbrella, what is the primary difference between the 'Management' API and the 'Reporting' API?

Accepted Answer

Management for configuration, Reporting for log data. The Cisco Umbrella Management API is used for configuration and administrative tasks, such as creating policies, managing identities, and configuring network tunnels. The Reporting API is used to retrieve log data, security events, and usage reports. This separation allows administrators to automate configuration changes separately from data retrieval, and each API has distinct endpoints and authentication scopes.

Answer

Management is for cloud, Reporting is for on-premise

Answer

Management for logs, Reporting for configuration

Answer

There is no difference; they share the same endpoints

Question 3

Your script is pulling alerts from the Cisco Secure Endpoint API and needs to filter for only 'Critical' detections. How is this filtering best accomplished?

Accepted Answer

Use query parameters in the API request. The Cisco Secure Endpoint API supports query parameters (such as severity, detection type, and date ranges) on alert and event endpoints, allowing the server to filter results before returning them. Using query parameters reduces payload size, improves performance, and avoids pulling large datasets just to discard most of them client-side.

Answer

Update the alert severity in the Secure Endpoint console

Answer

Use a different endpoint that only returns critical alerts

Answer

Retrieve all alerts and filter locally in the application code

Question 4

When using the SecureX Orchestration 'HTTP Request' activity, what is the best practice for handling sensitive API keys?

Accepted Answer

Use an 'Account Key' credential object. In SecureX Orchestration, sensitive values like API keys should be stored as 'Account Key' credential objects, which are encrypted at rest and referenced by workflows without exposing the plaintext value. This prevents keys from appearing in workflow definitions, logs, or version history. It is the platform's built-in secret management mechanism.

Answer

Hardcode the key in the workflow

Answer

Pass the key as a workflow argument

Answer

Store the key in a global variable

Question 5

Which of the following is a key advantage of using the Cisco Secure Email 'AsyncOS' API over manual CLI configuration for mass blocklist updates?

Accepted Answer

It enables programmatic and repeatable updates across multiple appliances. The AsyncOS API for Cisco Secure Email exposes programmatic endpoints that let you push blocklist changes consistently across many appliances, which is the key advantage over manual CLI configuration. This enables repeatable, auditable automation instead of error-prone one-off commands. It does not grant kernel access, change packet filtering speed, or remove authentication requirements.

Answer

It allows direct access to the underlying OS kernel

Answer

It provides faster packet-level filtering

Answer

It bypasses the need for authentication

Question 6

Which THREE of the following fields are commonly found in a JSON API response object? (Choose three)

Accepted Answer

Meta/Pagination info. Option A (Meta/Pagination info) is correct because JSON API responses commonly include a meta object carrying pagination details such as total count, page number, page size, and next/previous links, which clients use to navigate large result sets. Option B (Status code/Message) is correct because responses typically embed a status indicator and human-readable message (e.g., "status": "success" or an error message) so the client can interpret the outcome independently of the HTTP status line. Option D (Data field (payload)) is correct because the data field is the core container holding the requested resource or collection, such as "data": [...] or "data": {...}, and is the primary content the API returns. Option C (System BIOS version) does not belong because BIOS version is hardware/firmware metadata unrelated to an API response schema. Option E (Physical location of the server) does not belong because a server's physical location is infrastructure information and is not a standard field in JSON API response objects.

Answer

System BIOS version

Answer

Physical location of the server

Question 7

What is the benefit of integrating Cisco Threat Grid with Secure Endpoint?

Accepted Answer

Automated file analysis. Integrating Cisco Threat Grid with Secure Endpoint enables automated file analysis: when Secure Endpoint detects a suspicious file, it can automatically submit it to Threat Grid for dynamic analysis in a sandbox. Threat Grid then returns a threat score and detailed behavioral report, which Secure Endpoint uses to determine if the file is malicious and should be quarantined. This integration provides deeper insight than static signatures alone, improving detection and response.

Answer

Automated firewall blocking

Answer

Automated user provisioning

Answer

Automated email filtering

Question 8

You are configuring a SecureX workflow to notify a team. Which THREE notification methods are available via standard activities?

Accepted Answer

Webex. The three standard notification activities in SecureX workflows are Webex (C), PagerDuty (D), and Email (E). Webex (C) is correct because SecureX provides a native Webex Teams activity that posts messages to a room or space, allowing teams to receive workflow alerts directly in their collaboration workspace. PagerDuty (D) is correct because SecureX includes a PagerDuty activity that triggers incidents through the PagerDuty API, enabling on-call escalation and alerting for operations teams. Email (E) is correct because SecureX offers a built-in Send Email activity that delivers notifications via SMTP to specified recipients. Voice call (A) and SMS (B) are not standard SecureX workflow activities; while third-party integrations or custom HTTP requests could theoretically reach telephony or SMS gateways, they are not available as out-of-the-box notification activities.

Answer

Voice call

Answer

SMS

Question 9

When automating threat hunting with Cisco SecureX, which object type is used to represent an observable that has been aggregated from multiple sources?

Accepted Answer

Observable. In Cisco SecureX threat hunting, an Observable is the object type that represents an atomic piece of threat intelligence (IP, domain, hash, URL) that has been aggregated and enriched from multiple intelligence sources. SecureX correlates sightings across integrated products into a single Observable record, giving analysts one unified view rather than duplicate raw indicators.

Answer

Threat-Actor

Answer

Log-Entry

Answer

Device-Group

Question 10

You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?

Accepted Answer

PUT /ers/config/guestuser/{id}. Cisco ISE ERS uses PUT to update an existing guest user resource, with the URI pattern /ers/config/guestuser/{id} where {id} is the guest user's unique identifier. This follows REST conventions where PUT replaces or updates the identified resource.

Answer

POST /ers/config/guestuser/update

Answer

UPDATE /ers/config/guestuser/{id}

Answer

PATCH /ers/config/guestuser/{id}