SAUTO Advanced Threat And Endpoint Security — All Questions With Answers

Question 1mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?

Question 2mediummulti select

Read the full DNS explanation →

When automating threat hunting using the Cisco Umbrella Reporting API, which THREE of the following request parameters are commonly used to filter DNS query logs?

Question 3hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating threat hunting in Cisco SecureX. You want to execute a workflow that pivots from an IP address to associated domains. Which SecureX API component allows you to perform these relationship lookups?

Question 4mediummulti select

Read the full DNS explanation →

You are automating threat hunting using the Cisco Umbrella Investigate API. Which TWO parameters are required to perform a standard DNS lookup for a specific domain? (Choose two)

Question 5mediummultiple choice

Study the full Python automation breakdown →

You are configuring a Python script to query the Cisco Secure Endpoint (AMP) API for a specific SHA-256 hash. Which API endpoint should you use to retrieve the disposition of the file?

Question 6mediummultiple choice

Study the full Python automation breakdown →

You are integrating Cisco SecureX with a third-party SIEM. When configuring the API key for the SecureX Threat Response API, which authentication header must be included in your Python requests to ensure the API accepts the bearer token?

Question 7easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which authentication scheme does the Cisco Secure Endpoint API primarily utilize?

Question 8easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When integrating Cisco Umbrella with a SIEM via the Reporting API, which format is recommended for high-volume log ingestion?

Question 9mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You need to trigger a sandbox analysis in Threat Grid via API. Which parameter is mandatory in the POST request?

Question 10hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When integrating with the Umbrella Investigate API, which request should be used to get the domain's historical security data?

Question 11mediummultiple choice

Read the full DNS explanation →

You are using the Cisco Umbrella API to pull blocked DNS requests. Which resource provides this data?

Question 12mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are calling the Secure Endpoint API to get a list of computers. Which query parameter filters the list by operating system?

Question 13hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are performing a bulk file search in Secure Endpoint. What is the maximum number of items returned in a single API page response?

Question 14hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

In a Cisco SecureX workflow, which activity should be used to parse a JSON response from an external API?

Question 15mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You need to trigger a 'Scan Now' action on a host via the Secure Endpoint API. What is the correct HTTP method?

Question 16hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are developing a script for Threat Grid. Which THREE states might a submitted sample pass through before completion?

Question 17hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE factors influence the rate limit for Cisco Security APIs?

Question 18mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are integrating Cisco SecureX with a third-party threat intelligence platform using the Threat Intelligence API. You need to ensure that local observables are automatically pushed to the SecureX global investigation dashboard. Which API endpoint or resource type must be configured in your script to register the local data for cross-platform visibility?

Question 19mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the submission of suspicious files to Cisco Threat Grid via the REST API. Which parameter must be included in the POST request body to ensure that the sandbox environment correctly identifies the file as a sample from your local security orchestration platform?

Question 20hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are writing a script to automate the isolation of an endpoint in Cisco Secure Endpoint when a critical alert is triggered. You have the computer_guid. Which API method should be called to perform the isolation action?

Question 21mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are configuring a Cisco SecureX orchestration workflow to block a malicious domain discovered by an email security appliance. Which component is required to link the Email Security Appliance output to the Umbrella blocklist input?

Question 22easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which authentication mechanism is primarily used to access the Cisco Secure Endpoint API?

Question 23easymulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE fields are commonly required when performing a lookup in the Cisco Umbrella Investigate API?

Question 24hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

An automation engineer is integrating Cisco Threat Grid with a SOAR platform. The engineer needs to submit a sample for analysis and then retrieve the analysis results. The Threat Grid API requires authentication and specific parameters. Which two actions are required to successfully submit a sample and then retrieve its analysis report via the Threat Grid API? (Choose two.)

Question 25easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the retrieval of threat intelligence data from Cisco Threat Grid using its API. Your script needs to submit a new sample for analysis and then periodically check the status of the analysis. Which HTTP method should you use to submit the sample, and which endpoint should you call to check the analysis status?

Question 26hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating Cisco Umbrella enforcement for a set of roaming Windows laptops. The security team wants a script to add a specific domain to the global block list, and the API call must use the OAuth 2.0 client credentials flow. Which HTTP request achieves this?

Question 27hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the retrieval of file analysis reports from Cisco Threat Grid using its API. Your script submits a sample and receives a submission ID. You need to poll for the analysis status until it is complete. Which API endpoint should your script use to check the status of the analysis?

Question 28easymultiple choice

Study the full Python automation breakdown →

You are writing a Python script to authenticate to the Cisco Umbrella Enforcement API to push a new domain to the block list. Which HTTP header must your script include to provide the API key?

Question 29mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are developing a script to retrieve a list of all endpoints from Cisco Secure Endpoint (AMP for Endpoints) that have not checked in for more than 30 days. The API returns a paginated response. Which parameter should you use to navigate to the next page of results?

Question 30hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?

Question 31hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are using the Cisco Secure Endpoint (formerly AMP for Endpoints) API to query file trajectory data for a specific SHA-256 hash. The API returns a 429 Too Many Requests status code. What is the most efficient way to handle this in your automation script?

Question 32mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are developing a script to pull Threat Grid sandbox reports. You receive a 401 Unauthorized error. What is the most likely cause?

Question 33mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating Cisco Umbrella policy changes using the Umbrella API. Which resource is used to update the blocked destination list?

Question 34hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

In Cisco SecureX Orchestration, you are building an atomic workflow to isolate an endpoint. Which input parameter is required to identify the target host in the Secure Endpoint 'Isolate Host' activity?

Question 35hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

Question 36easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

What is the primary function of the Cisco SecureX 'Inspect' feature when using the browser extension?

Question 37mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

In a Cisco Threat Grid API workflow, what does the 'state' field in the analysis report indicate?

Question 38easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which data format is primarily used by all Cisco Security APIs (Secure Endpoint, Umbrella, Threat Grid)?

Question 39easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which Cisco technology provides a unified dashboard to visualize data from AMP, Umbrella, and Threat Grid?

Question 40mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are developing an integration for the Cisco Secure Endpoint API. What is the result of using a pagination parameter?

Question 41hardmultiple choice

Study the full Python automation breakdown →

In a Python script, how do you handle a 202 Accepted response from the Threat Grid API during file submission?

Question 42mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are configuring an Umbrella API callback. What happens if the callback URL is unreachable?

Question 43hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When using the SecureX Orchestration 'HTTP Request' activity, what is the best practice for handling sensitive API keys?

Question 44easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which Cisco Secure Endpoint feature allows automated movement of hosts into different groups based on threat activity?

Question 45easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which component of Cisco SecureX allows users to create automation workflows without writing code?

Question 46hardmultiple choice

Study the full Python automation breakdown →

When writing a Python request to the SecureX API, which Content-Type header is required for POST requests?

Question 47easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

What is the benefit of integrating Cisco Threat Grid with Secure Endpoint?

Question 48hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

In Threat Grid, what is the purpose of the 'Tags' field in an analysis report submission?

Question 49hardmultiple choice

Study the full Python automation breakdown →

Which Python library is most commonly used for handling REST API requests in SecureX automation scripts?

Question 50mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating a threat hunt using SecureX. Which API response field confirms that an observable is malicious?

Question 51easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

How do you retrieve the API credentials for Cisco Secure Endpoint?

Question 52easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

What is the function of the Cisco SecureX 'Threat Response' module?

Question 53mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the deletion of a sandbox report in Threat Grid. Which HTTP method should you use?

Question 54easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which of the following is a core benefit of using APIs for Cisco Security?

Question 55mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When using the Umbrella Investigate API, what does the 'co-occurrences' result represent?

Question 56hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE components are required to configure an API client for Cisco SecureX?

Question 57mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are using the Cisco Umbrella API. Which TWO of the following are valid ways to manage domain blocking?

Question 58mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO actions can be automated via the Cisco Secure Endpoint API to improve incident response?

Question 59hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE headers are commonly used when sending authenticated requests to Cisco Security APIs?

Question 60mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

When managing Cisco Umbrella policies, which TWO types of destination lists can you create via the API?

Question 61mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

When investigating an IP address in Cisco SecureX, which TWO pieces of intelligence data are typically provided by the Threat Intelligence API?

Question 62hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE types of observables can be looked up using the Cisco SecureX Threat Intelligence API?

Question 63hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE features are provided by the Cisco SecureX API documentation?

Question 64mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO parameters are typically required for paginating through large result sets in the Secure Endpoint API?

Question 65mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO items are required to properly authenticate a SecureX API request using an API Client?

Question 66mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

When using the Cisco Threat Grid API, which TWO methods can be used to retrieve report data?

Question 67hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are configuring a SecureX workflow to notify a team. Which THREE notification methods are available via standard activities?

Question 68mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

When managing Secure Endpoint through the API, which TWO pieces of information are used to track endpoint health?

Question 69hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

An automation script is querying the Cisco Secure Endpoint (AMP for Endpoints) API to retrieve file trajectory data for a specific SHA-256 hash. The script is returning a 429 status code. What is the most efficient way to handle this in your automation code?

Question 70easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When using the Cisco Umbrella Reporting API, which format is the default output for retrieving threat activity logs to ensure compatibility with most data analysis tools?

Question 71mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are using the Cisco Umbrella Investigate API to check if a specific IP address is associated with a known threat. Which domain of the API should you query?

Question 72easymultiple choice

Study the full Python automation breakdown →

Which Python library is most commonly used in Cisco security automation scripts to interact with REST APIs?

Question 73hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Your script is pulling alerts from the Cisco Secure Endpoint API and needs to filter for only 'Critical' detections. How is this filtering best accomplished?

Question 74mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When automating threat hunting with Cisco SecureX, which object type is used to represent an observable that has been aggregated from multiple sources?

Question 75hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the deletion of an indicator in Cisco Threat Grid. Which HTTP method must be used to ensure the request is idempotent and compliant with the RESTful design of the API?

Question 76mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Your automated script is designed to update a Cisco Umbrella policy. What is the correct procedure to ensure that changes do not cause downtime?

Question 77mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE actions are essential when designing a secure automation script that interacts with the Cisco Secure Endpoint API?

Question 78hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO of the following are valid ways to obtain threat intelligence data within the Cisco SecureX ecosystem?

Question 79mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE components are typically involved in a SecureX orchestration workflow that automates the isolation of a host based on an Umbrella alert?

Question 80hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO methods are used by the Cisco Threat Grid API to notify external systems when a file analysis has completed?

Question 81mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO of the following are benefits of using the Cisco Secure Endpoint API for automated threat hunting?

Question 82mediummultiple choice

Study the full Python automation breakdown →

You are writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of all endpoints in your organization. After authenticating with OAuth 2.0, you need to handle pagination because the API returns a limited number of results per page. Which HTTP response header should your script inspect to obtain the URL for the next page of results?

Question 83mediummultiple choice

Study the full Python automation breakdown →

A security automation engineer is writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of computers. The script must handle pagination because the environment has thousands of endpoints. Which HTTP response header should the script inspect to determine the URL for the next page of results?

Question 84hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the deployment of Cisco Umbrella Roaming Client to a large number of remote Windows endpoints using a configuration management tool. To ensure the client registers correctly and enforces policies, you need to provide the necessary parameters during silent installation. Which two parameters are required for a successful silent installation of the Cisco Umbrella Roaming Client? (Choose two.)

Question 85easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

A network security engineer is automating the deployment of Cisco Umbrella policies using the Umbrella API. The engineer needs to create a new destination list that blocks access to known malicious domains. Which HTTP method and endpoint should be used to create this list?

Question 86mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are developing a script to automate the creation of a new destination list in Cisco Umbrella using the Umbrella Enforcement API. The script must ensure that the list is created only if it does not already exist. Which HTTP status code should your script check for after attempting to create the list to determine if it already exists?

Question 87hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

An automation engineer is using Cisco SecureX Orchestration to build a workflow that automatically creates a ticket in a ticketing system when a high-severity alert is detected by Cisco Secure Endpoint. The engineer needs to pass the alert details, such as the endpoint hostname and the detection name, to the ticketing system. Which SecureX Orchestration feature should be used to extract these specific values from the alert payload?

Question 88mediummultiple choice

Read the full Ansible explanation →

You are building a SOAR playbook that ingests observables from Cisco Threat Response and needs to automatically create a case in Cisco Threat Response for every observable that has a verdict of 'malicious'. After authenticating with the Cisco Threat Response API, which HTTP method and endpoint should your playbook use to create a new case?

Question 89mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the quarantine of endpoints in Cisco Secure Endpoint (formerly AMP for Endpoints) using its API. Your script must first obtain an access token and then perform actions. Which TWO statements are correct about authenticating to the Cisco Secure Endpoint API? (Choose two.)

Question 1mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?

Question 2mediummulti select

Read the full DNS explanation →

When automating threat hunting using the Cisco Umbrella Reporting API, which THREE of the following request parameters are commonly used to filter DNS query logs?

Question 3hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating threat hunting in Cisco SecureX. You want to execute a workflow that pivots from an IP address to associated domains. Which SecureX API component allows you to perform these relationship lookups?

Question 4mediummulti select

Read the full DNS explanation →

You are automating threat hunting using the Cisco Umbrella Investigate API. Which TWO parameters are required to perform a standard DNS lookup for a specific domain? (Choose two)

Question 5mediummultiple choice

Study the full Python automation breakdown →

You are configuring a Python script to query the Cisco Secure Endpoint (AMP) API for a specific SHA-256 hash. Which API endpoint should you use to retrieve the disposition of the file?

Question 6mediummultiple choice

Study the full Python automation breakdown →

You are integrating Cisco SecureX with a third-party SIEM. When configuring the API key for the SecureX Threat Response API, which authentication header must be included in your Python requests to ensure the API accepts the bearer token?

Question 7easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which authentication scheme does the Cisco Secure Endpoint API primarily utilize?

Question 8easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When integrating Cisco Umbrella with a SIEM via the Reporting API, which format is recommended for high-volume log ingestion?

Question 9mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You need to trigger a sandbox analysis in Threat Grid via API. Which parameter is mandatory in the POST request?

Question 10hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When integrating with the Umbrella Investigate API, which request should be used to get the domain's historical security data?

Question 11mediummultiple choice

Read the full DNS explanation →

You are using the Cisco Umbrella API to pull blocked DNS requests. Which resource provides this data?

Question 12mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are calling the Secure Endpoint API to get a list of computers. Which query parameter filters the list by operating system?

Question 13hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are performing a bulk file search in Secure Endpoint. What is the maximum number of items returned in a single API page response?

Question 14hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

In a Cisco SecureX workflow, which activity should be used to parse a JSON response from an external API?

Question 15mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You need to trigger a 'Scan Now' action on a host via the Secure Endpoint API. What is the correct HTTP method?

Question 16hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are developing a script for Threat Grid. Which THREE states might a submitted sample pass through before completion?

Question 17hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE factors influence the rate limit for Cisco Security APIs?

Question 18mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are integrating Cisco SecureX with a third-party threat intelligence platform using the Threat Intelligence API. You need to ensure that local observables are automatically pushed to the SecureX global investigation dashboard. Which API endpoint or resource type must be configured in your script to register the local data for cross-platform visibility?

Question 19mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the submission of suspicious files to Cisco Threat Grid via the REST API. Which parameter must be included in the POST request body to ensure that the sandbox environment correctly identifies the file as a sample from your local security orchestration platform?

Question 20hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are writing a script to automate the isolation of an endpoint in Cisco Secure Endpoint when a critical alert is triggered. You have the computer_guid. Which API method should be called to perform the isolation action?

Question 21mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are configuring a Cisco SecureX orchestration workflow to block a malicious domain discovered by an email security appliance. Which component is required to link the Email Security Appliance output to the Umbrella blocklist input?

Question 22easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which authentication mechanism is primarily used to access the Cisco Secure Endpoint API?

Question 23easymulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE fields are commonly required when performing a lookup in the Cisco Umbrella Investigate API?

Question 24hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

An automation engineer is integrating Cisco Threat Grid with a SOAR platform. The engineer needs to submit a sample for analysis and then retrieve the analysis results. The Threat Grid API requires authentication and specific parameters. Which two actions are required to successfully submit a sample and then retrieve its analysis report via the Threat Grid API? (Choose two.)

Question 25easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the retrieval of threat intelligence data from Cisco Threat Grid using its API. Your script needs to submit a new sample for analysis and then periodically check the status of the analysis. Which HTTP method should you use to submit the sample, and which endpoint should you call to check the analysis status?

Question 26hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating Cisco Umbrella enforcement for a set of roaming Windows laptops. The security team wants a script to add a specific domain to the global block list, and the API call must use the OAuth 2.0 client credentials flow. Which HTTP request achieves this?

Question 27hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the retrieval of file analysis reports from Cisco Threat Grid using its API. Your script submits a sample and receives a submission ID. You need to poll for the analysis status until it is complete. Which API endpoint should your script use to check the status of the analysis?

Question 28easymultiple choice

Study the full Python automation breakdown →

You are writing a Python script to authenticate to the Cisco Umbrella Enforcement API to push a new domain to the block list. Which HTTP header must your script include to provide the API key?

Question 29mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are developing a script to retrieve a list of all endpoints from Cisco Secure Endpoint (AMP for Endpoints) that have not checked in for more than 30 days. The API returns a paginated response. Which parameter should you use to navigate to the next page of results?

Question 30hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?

Question 31hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are using the Cisco Secure Endpoint (formerly AMP for Endpoints) API to query file trajectory data for a specific SHA-256 hash. The API returns a 429 Too Many Requests status code. What is the most efficient way to handle this in your automation script?

Question 32mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are developing a script to pull Threat Grid sandbox reports. You receive a 401 Unauthorized error. What is the most likely cause?

Question 33mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating Cisco Umbrella policy changes using the Umbrella API. Which resource is used to update the blocked destination list?

Question 34hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

In Cisco SecureX Orchestration, you are building an atomic workflow to isolate an endpoint. Which input parameter is required to identify the target host in the Secure Endpoint 'Isolate Host' activity?

Question 35hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

Question 36easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

What is the primary function of the Cisco SecureX 'Inspect' feature when using the browser extension?

Question 37mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

In a Cisco Threat Grid API workflow, what does the 'state' field in the analysis report indicate?

Question 38easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which data format is primarily used by all Cisco Security APIs (Secure Endpoint, Umbrella, Threat Grid)?

Question 39easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which Cisco technology provides a unified dashboard to visualize data from AMP, Umbrella, and Threat Grid?

Question 40mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are developing an integration for the Cisco Secure Endpoint API. What is the result of using a pagination parameter?

Question 41hardmultiple choice

Study the full Python automation breakdown →

In a Python script, how do you handle a 202 Accepted response from the Threat Grid API during file submission?

Question 42mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are configuring an Umbrella API callback. What happens if the callback URL is unreachable?

Question 43hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When using the SecureX Orchestration 'HTTP Request' activity, what is the best practice for handling sensitive API keys?

Question 44easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which Cisco Secure Endpoint feature allows automated movement of hosts into different groups based on threat activity?

Question 45easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which component of Cisco SecureX allows users to create automation workflows without writing code?

Question 46hardmultiple choice

Study the full Python automation breakdown →

When writing a Python request to the SecureX API, which Content-Type header is required for POST requests?

Question 47easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

What is the benefit of integrating Cisco Threat Grid with Secure Endpoint?

Question 48hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

In Threat Grid, what is the purpose of the 'Tags' field in an analysis report submission?

Question 49hardmultiple choice

Study the full Python automation breakdown →

Which Python library is most commonly used for handling REST API requests in SecureX automation scripts?

Question 50mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating a threat hunt using SecureX. Which API response field confirms that an observable is malicious?

Question 51easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

How do you retrieve the API credentials for Cisco Secure Endpoint?

Question 52easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

What is the function of the Cisco SecureX 'Threat Response' module?

Question 53mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the deletion of a sandbox report in Threat Grid. Which HTTP method should you use?

Question 54easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Which of the following is a core benefit of using APIs for Cisco Security?

Question 55mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When using the Umbrella Investigate API, what does the 'co-occurrences' result represent?

Question 56hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE components are required to configure an API client for Cisco SecureX?

Question 57mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are using the Cisco Umbrella API. Which TWO of the following are valid ways to manage domain blocking?

Question 58mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO actions can be automated via the Cisco Secure Endpoint API to improve incident response?

Question 59hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE headers are commonly used when sending authenticated requests to Cisco Security APIs?

Question 60mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

When managing Cisco Umbrella policies, which TWO types of destination lists can you create via the API?

Question 61mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

When investigating an IP address in Cisco SecureX, which TWO pieces of intelligence data are typically provided by the Threat Intelligence API?

Question 62hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE types of observables can be looked up using the Cisco SecureX Threat Intelligence API?

Question 63hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE features are provided by the Cisco SecureX API documentation?

Question 64mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO parameters are typically required for paginating through large result sets in the Secure Endpoint API?

Question 65mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO items are required to properly authenticate a SecureX API request using an API Client?

Question 66mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

When using the Cisco Threat Grid API, which TWO methods can be used to retrieve report data?

Question 67hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are configuring a SecureX workflow to notify a team. Which THREE notification methods are available via standard activities?

Question 68mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

When managing Secure Endpoint through the API, which TWO pieces of information are used to track endpoint health?

Question 69hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

An automation script is querying the Cisco Secure Endpoint (AMP for Endpoints) API to retrieve file trajectory data for a specific SHA-256 hash. The script is returning a 429 status code. What is the most efficient way to handle this in your automation code?

Question 70easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When using the Cisco Umbrella Reporting API, which format is the default output for retrieving threat activity logs to ensure compatibility with most data analysis tools?

Question 71mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are using the Cisco Umbrella Investigate API to check if a specific IP address is associated with a known threat. Which domain of the API should you query?

Question 72easymultiple choice

Study the full Python automation breakdown →

Which Python library is most commonly used in Cisco security automation scripts to interact with REST APIs?

Question 73hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Your script is pulling alerts from the Cisco Secure Endpoint API and needs to filter for only 'Critical' detections. How is this filtering best accomplished?

Question 74mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

When automating threat hunting with Cisco SecureX, which object type is used to represent an observable that has been aggregated from multiple sources?

Question 75hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the deletion of an indicator in Cisco Threat Grid. Which HTTP method must be used to ensure the request is idempotent and compliant with the RESTful design of the API?

Question 76mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

Your automated script is designed to update a Cisco Umbrella policy. What is the correct procedure to ensure that changes do not cause downtime?

Question 77mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE actions are essential when designing a secure automation script that interacts with the Cisco Secure Endpoint API?

Question 78hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO of the following are valid ways to obtain threat intelligence data within the Cisco SecureX ecosystem?

Question 79mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which THREE components are typically involved in a SecureX orchestration workflow that automates the isolation of a host based on an Umbrella alert?

Question 80hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO methods are used by the Cisco Threat Grid API to notify external systems when a file analysis has completed?

Question 81mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

Which TWO of the following are benefits of using the Cisco Secure Endpoint API for automated threat hunting?

Question 82mediummultiple choice

Study the full Python automation breakdown →

You are writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of all endpoints in your organization. After authenticating with OAuth 2.0, you need to handle pagination because the API returns a limited number of results per page. Which HTTP response header should your script inspect to obtain the URL for the next page of results?

Question 83mediummultiple choice

Study the full Python automation breakdown →

A security automation engineer is writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of computers. The script must handle pagination because the environment has thousands of endpoints. Which HTTP response header should the script inspect to determine the URL for the next page of results?

Question 84hardmulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the deployment of Cisco Umbrella Roaming Client to a large number of remote Windows endpoints using a configuration management tool. To ensure the client registers correctly and enforces policies, you need to provide the necessary parameters during silent installation. Which two parameters are required for a successful silent installation of the Cisco Umbrella Roaming Client? (Choose two.)

Question 85easymultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

A network security engineer is automating the deployment of Cisco Umbrella policies using the Umbrella API. The engineer needs to create a new destination list that blocks access to known malicious domains. Which HTTP method and endpoint should be used to create this list?

Question 86mediummultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

You are developing a script to automate the creation of a new destination list in Cisco Umbrella using the Umbrella Enforcement API. The script must ensure that the list is created only if it does not already exist. Which HTTP status code should your script check for after attempting to create the list to determine if it already exists?

Question 87hardmultiple choice

Read the full Advanced Threat And Endpoint Security explanation →

An automation engineer is using Cisco SecureX Orchestration to build a workflow that automatically creates a ticket in a ticketing system when a high-severity alert is detected by Cisco Secure Endpoint. The engineer needs to pass the alert details, such as the endpoint hostname and the detection name, to the ticketing system. Which SecureX Orchestration feature should be used to extract these specific values from the alert payload?

Question 88mediummultiple choice

Read the full Ansible explanation →

You are building a SOAR playbook that ingests observables from Cisco Threat Response and needs to automatically create a case in Cisco Threat Response for every observable that has a verdict of 'malicious'. After authenticating with the Cisco Threat Response API, which HTTP method and endpoint should your playbook use to create a new case?

Question 89mediummulti select

Read the full Advanced Threat And Endpoint Security explanation →

You are automating the quarantine of endpoints in Cisco Secure Endpoint (formerly AMP for Endpoints) using its API. Your script must first obtain an access token and then perform actions. Which TWO statements are correct about authenticating to the Cisco Secure Endpoint API? (Choose two.)