SAUTO Advanced Threat And Endpoint Security — 40 Questions

Question 1

You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HMAC-SHA256 signature verification. Cisco SecureX webhook integrations natively support HMAC-SHA256 signature verification to ensure secure delivery. The sender computes an HMAC using a shared secret and includes it in the request header; the receiver validates it to confirm authenticity and integrity. This method is standard for webhook security and is explicitly supported in SecureX.

Answer

OAuth 2.0 Client Credentials flow

Answer

Mutual TLS (mTLS) certificate exchange

Answer

Basic Authentication with fixed credentials

Question 2

When automating threat hunting using the Cisco Umbrella Reporting API, which THREE of the following request parameters are commonly used to filter DNS query logs?

Accepted Answer

from. The Cisco Umbrella Reporting API's DNS query log endpoints (e.g., /reports/v2/activity/dns) use the from and to parameters to bound the time window of the query, which is essential for threat hunting over a specific period, so options B and E are correct. The domain parameter is also a valid filter that restricts results to queries for a specific domain name, allowing hunters to pivot on suspicious domains, making option C correct. Option A (threat_score) is not a standard request filter on the DNS activity endpoint—Umbrella categorizes results via identity/security category fields rather than a threat_score query parameter. Option D (source_ip) is not the correct parameter name; Umbrella uses internalip (or identity-based filters) to filter by client IP, so source_ip does not belong.

Answer

threat_score

Answer

source_ip

Question 3

You are automating threat hunting in Cisco SecureX. You want to execute a workflow that pivots from an IP address to associated domains. Which SecureX API component allows you to perform these relationship lookups?

Accepted Answer

Threat Intelligence API. The Threat Intelligence API in Cisco SecureX provides programmatic access to threat intelligence data, including relationships between observables like IP addresses and domains. It allows you to query for associated domains given an IP address, enabling threat hunting pivots. This API is specifically designed for threat intelligence lookups and is the correct component for this task.

Answer

Pivot API

Answer

Orchestration Query API

Answer

Relationship Discovery Service

Question 4

You are automating threat hunting using the Cisco Umbrella Investigate API. Which TWO parameters are required to perform a standard DNS lookup for a specific domain? (Choose two)

Accepted Answer

The domain name string. Option C is correct because the Investigate API's domain endpoint (e.g., /investigate/v2/domains/{domain}) requires the domain name string as the resource identifier to perform the DNS lookup and return categorization, WHOIS, and related security data. Option D is correct because every Umbrella Investigate API request must be authenticated by supplying the API key in the Authorization request header (Bearer token), without which the API returns a 401 Unauthorized response. Option A is incorrect because threat category IDs are returned as part of the response data, not supplied as an input parameter for a domain lookup. Option B is incorrect because a global user ID is not an Investigate API parameter; authentication is handled by the API key, not a user identifier. Option E is incorrect because the local DNS recursive resolver IP is not a required input for the Investigate domain lookup endpoint.

Answer

The threat category ID

Answer

The global user ID

Answer

The IP address of the local DNS recursive resolver

Question 5

You are configuring a Python script to query the Cisco Secure Endpoint (AMP) API for a specific SHA-256 hash. Which API endpoint should you use to retrieve the disposition of the file?

Accepted Answer

GET /v1/file/analysis/{sha256}. The /v1/file/analysis endpoint is the correct resource for retrieving file disposition and analysis status from Secure Endpoint.

Answer

GET /v1/computers/{id}/files

Answer

PUT /v1/analysis/report/{sha256}

Answer

POST /v1/file/disposition/{sha256}

Question 6

You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization: Bearer . The SecureX Threat Response API uses OAuth 2.0 bearer tokens for authentication. When making API requests, the token must be included in the 'Authorization' header with the 'Bearer' prefix, e.g., 'Authorization: Bearer '. This is the standard method for passing bearer tokens in HTTP requests.

Answer

API-Key: <API_KEY>

Answer

X-Auth-Token: <API_KEY>

Answer

Cookie: session=<API_KEY>

Question 7

Which authentication scheme does the Cisco Secure Endpoint API primarily utilize?

Accepted Answer

Basic Authentication. The Cisco Secure Endpoint API (formerly AMP for Endpoints) primarily uses HTTP Basic Authentication, where the API client ID and API key are Base64-encoded and sent in the Authorization header. This is the standard method documented in Cisco's API reference for authenticating REST calls to the Secure Endpoint console. Although OAuth 2.0 and JWT are common in modern APIs, Secure Endpoint's core API relies on Basic Auth for simplicity and direct credential exchange.

Answer

OAuth 2.0 Client Credentials

Answer

SAML 2.0

Answer

JWT Bearer Token

Question 8

When integrating Cisco Umbrella with a SIEM via the Reporting API, which format is recommended for high-volume log ingestion?

Accepted Answer

JSON via S3. The Cisco Umbrella Reporting API supports exporting logs to Amazon S3 in JSON format, which is the recommended method for high-volume ingestion. JSON is natively supported by most SIEMs and allows for efficient parsing and indexing of nested fields. S3 provides scalable, durable storage and can be polled or streamed by the SIEM, making it ideal for large log volumes. This approach avoids the overhead of direct API calls and ensures reliable delivery.

Answer

CSV

Answer

Direct XML streaming

Answer

SQL database dump

Question 9

You need to trigger a sandbox analysis in Threat Grid via API. Which parameter is mandatory in the POST request?

Accepted Answer

sample_file. The file parameter containing the sample is mandatory for the analysis submission.

Answer

sha256_hash

Answer

callback_url

Answer

analysis_priority

Question 10

When integrating with the Umbrella Investigate API, which request should be used to get the domain's historical security data?

Accepted Answer

GET /domains/{domain}/timeline. The /timeline endpoint provides the historical security context for a domain.

Answer

POST /investigate/query

Answer

GET /security/timeline/{domain}

Answer

GET /domains/{domain}/history

Question 11

You are using the Cisco Umbrella API to pull blocked DNS requests. Which resource provides this data?

Accepted Answer

/reports/dns_query_log. The Cisco Umbrella API endpoint /reports/dns_query_log is the correct resource for retrieving DNS query logs, including blocked requests. This endpoint provides detailed records of DNS queries, their verdicts (allowed/blocked), and associated metadata. It is part of the Umbrella Reporting API, which is designed for accessing historical DNS activity data.

Answer

/logs/blocked

Answer

/dns/activity

Answer

/security/dns

Question 12

You are calling the Secure Endpoint API to get a list of computers. Which query parameter filters the list by operating system?

Accepted Answer

?os=windows. The 'os' parameter is used to filter by operating system type in the API call.

Answer

?filter=os

Answer

?type=computer

Answer

?platform=windows

Question 13

You are performing a bulk file search in Secure Endpoint. What is the maximum number of items returned in a single API page response?

Accepted Answer

500. The Secure Endpoint API default and maximum page size is typically 500 records.

Answer

5000

Answer

50

Answer

1000

Question 14

In a Cisco SecureX workflow, which activity should be used to parse a JSON response from an external API?

Accepted Answer

JSON Parse. The 'JSON Parse' activity is specifically designed to convert raw JSON strings into objects for use in workflows.

Answer

Data Transform

Answer

String Split

Answer

HTTP Request

Question 15

You need to trigger a 'Scan Now' action on a host via the Secure Endpoint API. What is the correct HTTP method?

Accepted Answer

POST. A POST request is used to initiate an action or command, such as scanning, on an endpoint.

Answer

PATCH

Answer

PUT

Answer

GET

Question 16

You are developing a script for Threat Grid. Which THREE states might a submitted sample pass through before completion?

Accepted Answer

complete. In Threat Grid, a submitted sample's lifecycle includes the states pending, analyzing, and complete, so options C, D, and E are correct. Pending (E) is the initial state after submission while the sample waits in the queue for an available analysis appliance. Analyzing (D) is the state during which the sample is actually being executed and observed in the sandbox. Complete (C) is the terminal state indicating the analysis has finished and the report is available. The unmarked options do not belong: failed (A) is not a standard Threat Grid sample state, and suspended (B) is not part of the sample analysis lifecycle.

Answer

failed

Answer

suspended

Question 17

Which THREE factors influence the rate limit for Cisco Security APIs?

Accepted Answer

Subscription tier. Option B (Subscription tier) is correct because Cisco Security API rate limits are tied to the customer's licensing/subscription level, with higher tiers granting higher request quotas. Option D (API endpoint) is correct because different endpoints (for example, different Cisco Security services or resource paths) enforce their own distinct rate limits. Option E (Organization ID) is correct because rate limits are applied per organization, so the org ID determines which quota bucket a request counts against. Options A (Hardware version) and C (Browser type) do not belong, since rate limiting is enforced server-side on API calls and is independent of the client's hardware or browser.

Answer

Hardware version

Answer

Browser type

Question 18

You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The /ctia/observable endpoint. To register observables for SecureX cross-platform visibility, you must utilize the /ctia/indicator or /ctia/observable endpoints within the SecureX Threat Intelligence API, which allows external tools to share context with the SecureX integration module.

Answer

The /events/ingest endpoint

Answer

The /v1/devices endpoint

Answer

The /threat/feed/push endpoint

Question 19

You are automating the submission of suspicious files to Cisco Threat Grid via the REST API. Which parameter must be included in the POST request body to ensure that the sandbox environment correctly identifies the file as a sample from your local security orchestration platform?

Accepted Answer

The 'file' parameter. When submitting a file to Threat Grid, the 'sample' object requires a 'file' parameter (the binary) and typically a 'tag' or 'comment' to track the source within the sandbox logs.

Answer

The 'sandbox_id' parameter

Answer

The 'scan_timeout' parameter

Answer

The 'os_version' parameter

Question 20

You are writing a script to automate the isolation of an endpoint in Cisco Secure Endpoint when a critical alert is triggered. You have the computer_guid. Which API method should be called to perform the isolation action?

Accepted Answer

POST to /computers/{computer_guid}/isolation. To isolate an endpoint, you must perform a POST request to the /computers/{computer_guid}/isolation endpoint.

Answer

GET to /computers/{computer_guid}/status/isolate

Answer

PUT to /computers/{computer_guid}/quarantine

Answer

DELETE to /computers/{computer_guid}/network