SAUTO Advanced Threat And Endpoint Security — 20 Questions

Question 1

You are configuring a Python script to query the Cisco Secure Endpoint (AMP) API for a specific SHA-256 hash. Which API endpoint should you use to retrieve the disposition of the file?

Accepted Answer

GET /v1/file/analysis/{sha256}. The /v1/file/analysis endpoint is the correct resource for retrieving file disposition and analysis status from Secure Endpoint.

Answer

GET /v1/computers/{id}/files

Answer

PUT /v1/analysis/report/{sha256}

Answer

POST /v1/file/disposition/{sha256}

Question 2

You need to trigger a sandbox analysis in Threat Grid via API. Which parameter is mandatory in the POST request?

Accepted Answer

sample_file. The file parameter containing the sample is mandatory for the analysis submission.

Answer

sha256_hash

Answer

callback_url

Answer

analysis_priority

Question 3

When integrating with the Umbrella Investigate API, which request should be used to get the domain's historical security data?

Accepted Answer

GET /domains/{domain}/timeline. The /timeline endpoint provides the historical security context for a domain.

Answer

POST /investigate/query

Answer

GET /security/timeline/{domain}

Answer

GET /domains/{domain}/history

Question 4

You are calling the Secure Endpoint API to get a list of computers. Which query parameter filters the list by operating system?

Accepted Answer

?os=windows. The 'os' parameter is used to filter by operating system type in the API call.

Answer

?filter=os

Answer

?type=computer

Answer

?platform=windows

Question 5

You are performing a bulk file search in Secure Endpoint. What is the maximum number of items returned in a single API page response?

Accepted Answer

500. The Secure Endpoint API default and maximum page size is typically 500 records.

Answer

5000

Answer

50

Answer

1000

Question 6

In a Cisco SecureX workflow, which activity should be used to parse a JSON response from an external API?

Accepted Answer

JSON Parse. The 'JSON Parse' activity is specifically designed to convert raw JSON strings into objects for use in workflows.

Answer

Data Transform

Answer

String Split

Answer

HTTP Request

Question 7

You need to trigger a 'Scan Now' action on a host via the Secure Endpoint API. What is the correct HTTP method?

Accepted Answer

POST. A POST request is used to initiate an action or command, such as scanning, on an endpoint.

Answer

PATCH

Answer

PUT

Answer

GET

Question 8

You are integrating Cisco SecureX with a third-party threat intelligence platform using the Threat Intelligence API. You need to ensure that local observables are automatically pushed to the SecureX global investigation dashboard. Which API endpoint or resource type must be configured in your script to register the local data for cross-platform visibility?

Accepted Answer

The /ctia/observable endpoint. To register observables for SecureX cross-platform visibility, you must utilize the /ctia/indicator or /ctia/observable endpoints within the SecureX Threat Intelligence API, which allows external tools to share context with the SecureX integration module.

Answer

The /events/ingest endpoint

Answer

The /v1/devices endpoint

Answer

The /threat/feed/push endpoint

Question 9

You are automating the submission of suspicious files to Cisco Threat Grid via the REST API. Which parameter must be included in the POST request body to ensure that the sandbox environment correctly identifies the file as a sample from your local security orchestration platform?

Accepted Answer

The 'file' parameter. When submitting a file to Threat Grid, the 'sample' object requires a 'file' parameter (the binary) and typically a 'tag' or 'comment' to track the source within the sandbox logs.

Answer

The 'sandbox_id' parameter

Answer

The 'scan_timeout' parameter

Answer

The 'os_version' parameter

Question 10

You are writing a script to automate the isolation of an endpoint in Cisco Secure Endpoint when a critical alert is triggered. You have the computer_guid. Which API method should be called to perform the isolation action?

Accepted Answer

POST to /computers/{computer_guid}/isolation. To isolate an endpoint, you must perform a POST request to the /computers/{computer_guid}/isolation endpoint.

Answer

GET to /computers/{computer_guid}/status/isolate

Answer

PUT to /computers/{computer_guid}/quarantine

Answer

DELETE to /computers/{computer_guid}/network

Question 11

You are configuring a Cisco SecureX orchestration workflow to block a malicious domain discovered by an email security appliance. Which component is required to link the Email Security Appliance output to the Umbrella blocklist input?

Accepted Answer

An Activity block. In SecureX orchestration, the 'Atomic Action' or 'Target' is used to define the endpoint, and the 'Activity' block is used to perform the data transformation and API call sequence between appliances.

Answer

A static IP list

Answer

A manual CLI command

Answer

A local SQL database

Question 12

Which authentication mechanism is primarily used to access the Cisco Secure Endpoint API?

Accepted Answer

API Client ID and API Client Secret. Cisco Secure Endpoint uses API Client IDs and API Client Secret Keys to generate OAuth tokens for authentication.

Answer

SAML assertion

Answer

Username and password

Answer

SSH private key

Question 13

You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?

Accepted Answer

HMAC-SHA256 signature verification. SecureX webhooks support HMAC-SHA256 signature verification to ensure the integrity and authenticity of the payload.

Answer

OAuth 2.0 Client Credentials flow

Answer

Mutual TLS (mTLS) certificate exchange

Answer

Basic Authentication with fixed credentials

Question 14

When automating threat hunting using the Cisco Umbrella Reporting API, which THREE of the following request parameters are commonly used to filter DNS query logs?

Accepted Answer

from. The Umbrella Reporting API supports filtering by domain, time range, and query type to narrow down search results.

Answer

threat_score

Answer

source_ip

Question 15

You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?

Accepted Answer

Implement an exponential backoff algorithm before retrying. A 429 status code indicates rate limiting, necessitating an exponential backoff strategy.

Answer

Immediately retry the request with the same parameters

Answer

Update the API key to a higher privilege level

Answer

Switch to the secondary API endpoint URL

Question 16

You are automating threat hunting in Cisco SecureX. You want to execute a workflow that pivots from an IP address to associated domains. Which SecureX API component allows you to perform these relationship lookups?

Accepted Answer

Threat Intelligence API. The SecureX Threat Intelligence API provides relationship lookups between observables.

Answer

Pivot API

Answer

Orchestration Query API

Answer

Relationship Discovery Service

Question 17

You are using the Cisco Secure Endpoint (formerly AMP for Endpoints) API to query file trajectory data for a specific SHA-256 hash. The API returns a 429 Too Many Requests status code. What is the most efficient way to handle this in your automation script?

Accepted Answer

Implement an exponential backoff strategy with a retry logic.. The 429 status code indicates rate limiting. Implementing exponential backoff allows the client to wait progressively longer before retrying, reducing load on the API.

Answer

Switch from HTTPS to HTTP to reduce overhead.

Answer

Increase the API rate limit in the Cisco Secure Endpoint dashboard.

Answer

Force an authentication refresh on every request.

Question 18

You are automating threat hunting using the Cisco Umbrella Investigate API. Which TWO parameters are required to perform a standard DNS lookup for a specific domain? (Choose two)

Accepted Answer

The domain name string. The Investigate API requires the domain name and the specific endpoint path to retrieve DNS data.

Answer

The threat category ID

Answer

The global user ID

Answer

The IP address of the local DNS recursive resolver

Question 19

You are integrating Cisco SecureX with a third-party SIEM. When configuring the API key for the SecureX Threat Response API, which authentication header must be included in your Python requests to ensure the API accepts the bearer token?

Accepted Answer

Authorization: Bearer . The Cisco SecureX Threat Response API requires an Authorization header with the format 'Bearer '.

Answer

API-Key: <API_KEY>

Answer

X-Auth-Token: <API_KEY>

Answer

Cookie: session=<API_KEY>

Question 20

Which authentication scheme does the Cisco Secure Endpoint API primarily utilize?

Accepted Answer

Basic Authentication. Secure Endpoint uses Basic Authentication via API keys.

Answer

OAuth 2.0 Client Credentials

Answer

SAML 2.0

Answer

JWT Bearer Token