SAUTO Advanced Threat And Endpoint Security Practice Test 2 — 15 Questions

Question 1

You are developing a script for Threat Grid. Which THREE states might a submitted sample pass through before completion?

Accepted Answer

complete. In Threat Grid, a submitted sample's lifecycle includes the states pending, analyzing, and complete, so options C, D, and E are correct. Pending (E) is the initial state after submission while the sample waits in the queue for an available analysis appliance. Analyzing (D) is the state during which the sample is actually being executed and observed in the sandbox. Complete (C) is the terminal state indicating the analysis has finished and the report is available. The unmarked options do not belong: failed (A) is not a standard Threat Grid sample state, and suspended (B) is not part of the sample analysis lifecycle.

Answer

failed

Answer

suspended

Question 2

Which THREE factors influence the rate limit for Cisco Security APIs?

Accepted Answer

Subscription tier. Option B (Subscription tier) is correct because Cisco Security API rate limits are tied to the customer's licensing/subscription level, with higher tiers granting higher request quotas. Option D (API endpoint) is correct because different endpoints (for example, different Cisco Security services or resource paths) enforce their own distinct rate limits. Option E (Organization ID) is correct because rate limits are applied per organization, so the org ID determines which quota bucket a request counts against. Options A (Hardware version) and C (Browser type) do not belong, since rate limiting is enforced server-side on API calls and is independent of the client's hardware or browser.

Answer

Hardware version

Answer

Browser type

Question 3

You are integrating Cisco SecureX with a third-party threat intelligence platform using the Threat Intelligence API. You need to ensure that local observables are automatically pushed to the SecureX global investigation dashboard. Which API endpoint or resource type must be configured in your script to register the local data for cross-platform visibility?

Accepted Answer

The /ctia/observable endpoint. To register observables for SecureX cross-platform visibility, you must utilize the /ctia/indicator or /ctia/observable endpoints within the SecureX Threat Intelligence API, which allows external tools to share context with the SecureX integration module.

Answer

The /events/ingest endpoint

Answer

The /v1/devices endpoint

Answer

The /threat/feed/push endpoint

Question 4

You are automating the submission of suspicious files to Cisco Threat Grid via the REST API. Which parameter must be included in the POST request body to ensure that the sandbox environment correctly identifies the file as a sample from your local security orchestration platform?

Accepted Answer

The 'file' parameter. When submitting a file to Threat Grid, the 'sample' object requires a 'file' parameter (the binary) and typically a 'tag' or 'comment' to track the source within the sandbox logs.

Answer

The 'sandbox_id' parameter

Answer

The 'scan_timeout' parameter

Answer

The 'os_version' parameter

Question 5

You are writing a script to automate the isolation of an endpoint in Cisco Secure Endpoint when a critical alert is triggered. You have the computer_guid. Which API method should be called to perform the isolation action?

Accepted Answer

POST to /computers/{computer_guid}/isolation. To isolate an endpoint, you must perform a POST request to the /computers/{computer_guid}/isolation endpoint.

Answer

GET to /computers/{computer_guid}/status/isolate

Answer

PUT to /computers/{computer_guid}/quarantine

Answer

DELETE to /computers/{computer_guid}/network

Question 6

You are configuring a Cisco SecureX orchestration workflow to block a malicious domain discovered by an email security appliance. Which component is required to link the Email Security Appliance output to the Umbrella blocklist input?

Accepted Answer

An Activity block. In SecureX orchestration, the 'Atomic Action' or 'Target' is used to define the endpoint, and the 'Activity' block is used to perform the data transformation and API call sequence between appliances.

Answer

A static IP list

Answer

A manual CLI command

Answer

A local SQL database

Question 7

Which authentication mechanism is primarily used to access the Cisco Secure Endpoint API?

Accepted Answer

API Client ID and API Client Secret. Cisco Secure Endpoint uses API Client IDs and API Client Secret Keys to generate OAuth tokens for authentication.

Answer

SAML assertion

Answer

Username and password

Answer

SSH private key

Question 8

Which THREE fields are commonly required when performing a lookup in the Cisco Umbrella Investigate API?

Accepted Answer

API Base URL. The Cisco Umbrella Investigate API requires an API Base URL (option A) because every REST call must target the correct Investigate endpoint, such as https://investigate.api.umbrella.com, to reach the service. An API Key (option B) is mandatory for authentication, typically supplied as a Bearer token in the Authorization header, so the API can identify and authorize the requesting account. The Observable (option D) — a domain, IP address, or file hash — is the actual resource being queried, since Investigate lookups are performed against a specific indicator to retrieve reputation, categorization, and related data. The user's local network IP (option C) is not part of the request; Investigate queries are made from the client to the cloud API and do not require the caller's LAN address. A threat score threshold (option E) is not a required lookup field either; threat scores are returned as part of the response data rather than being an input parameter for the query.

Answer

User's local network IP

Answer

Threat Score Threshold

Question 9

An automation engineer is integrating Cisco Threat Grid with a SOAR platform. The engineer needs to submit a sample for analysis and then retrieve the analysis results. The Threat Grid API requires authentication and specific parameters. Which two actions are required to successfully submit a sample and then retrieve its analysis report via the Threat Grid API? (Choose two.)

Accepted Answer

Submit the sample using a POST request to the /api/v3/samples endpoint with the file included as multipart/form-data.. To submit a sample to Threat Grid, a POST request to /api/v3/samples with multipart/form-data is required. After analysis completes, the report is retrieved via GET /api/v3/samples/{id}/analysis. These two actions form the core of a Threat Grid integration for automated sample analysis and result retrieval.

Answer

After submission, poll the /api/v3/samples/{id} endpoint to check the analysis status until it is complete.

Answer

Use the /api/v3/samples/{id}/report endpoint to download the analysis report in PDF format.

Answer

Include the API key in the request header as 'Authorization: Bearer <api_key>'.

Question 10

You are automating the retrieval of threat intelligence data from Cisco Threat Grid using its API. Your script needs to submit a new sample for analysis and then periodically check the status of the analysis. Which HTTP method should you use to submit the sample, and which endpoint should you call to check the analysis status?

Accepted Answer

POST to /api/v2/samples and GET to /api/v2/samples/{id}. The correct approach is to use POST to /api/v2/samples to submit a sample, which returns an ID, and then use GET to /api/v2/samples/{id} to poll for the analysis status. This aligns with RESTful design and the Threat Grid API documentation, ensuring your automation can successfully submit and monitor samples.

Answer

PUT to /api/v2/samples and GET to /api/v2/analyses/{id}

Answer

GET to /api/v2/samples and POST to /api/v2/analyses/{id}

Answer

POST to /api/v2/submit and GET to /api/v2/status/{id}

Question 11

You are automating Cisco Umbrella enforcement for a set of roaming Windows laptops. The security team wants a script to add a specific domain to the global block list, and the API call must use the OAuth 2.0 client credentials flow. Which HTTP request achieves this?

Accepted Answer

POST https://api.umbrella.com/auth/v2/token with Content-Type: application/x-www-form-urlencoded and body grant_type=client_credentials&client_id=&client_secret=. The OAuth 2.0 client credentials flow for Cisco Umbrella requires a POST to the token endpoint with a form-encoded body containing grant_type=client_credentials and the client ID and secret. The returned bearer token is then used in the Authorization header for the policy API call. Using JSON, GET, or a static API key will not yield a valid token and will cause authentication failures.

Answer

POST https://api.umbrella.com/policies/v2/destinationlists with Authorization: Bearer <api_key> and body {"name":"block","destinations":["example.com"]}

Answer

GET https://api.umbrella.com/auth/v2/token with Authorization: Basic <base64(id:secret)>

Answer

POST https://management.api.umbrella.com/auth/v2/token with JSON body {"grant_type":"client_credentials","client_id":"","client_secret":""}

Question 12

You are automating the retrieval of file analysis reports from Cisco Threat Grid using its API. Your script submits a sample and receives a submission ID. You need to poll for the analysis status until it is complete. Which API endpoint should your script use to check the status of the analysis?

Accepted Answer

GET /api/v2/analysis/{submission_id}. To check the status of a Threat Grid analysis, your script must poll the /api/v2/analysis/{submission_id} endpoint. The response includes a state field that indicates whether the analysis is waiting, running, completed, or failed. Once the state is 'completed', you can retrieve the report from the reports endpoint. The submissions endpoint provides metadata, and the reports endpoint provides the final output, but neither gives the live status.

Answer

GET /api/v2/reports/{submission_id}

Answer

GET /api/v2/samples/{submission_id}/status

Answer

GET /api/v2/submissions/{submission_id}

Question 13

You are writing a Python script to authenticate to the Cisco Umbrella Enforcement API to push a new domain to the block list. Which HTTP header must your script include to provide the API key?

Accepted Answer

Authorization: <API_KEY>. The Cisco Umbrella Enforcement API authenticates requests by requiring the API key in the Authorization header, without any scheme prefix. This is a simple key-based authentication. The other headers listed are either used by different Cisco APIs or are not recognized by Umbrella. Understanding the correct authentication header is fundamental for any script interacting with the Enforcement API.

Answer

Authorization: Bearer <API_KEY>

Answer

X-Api-Key: <API_KEY>

Answer

X-Umbrella-API-Key: <API_KEY>

Question 14

You are developing a script to retrieve a list of all endpoints from Cisco Secure Endpoint (AMP for Endpoints) that have not checked in for more than 30 days. The API returns a paginated response. Which parameter should you use to navigate to the next page of results?

Accepted Answer

Use the 'next' URL provided in the response metadata.. Cisco Secure Endpoint API pagination is handled by following the 'next' URL provided in the response metadata. The API does not use offset, page, or next parameters. Your script must parse the 'links.next' URL and request it to get subsequent pages. This cursor-based approach ensures consistent results even as data changes.

Answer

Answer

offset

Answer

page

Question 15

You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?

Accepted Answer

Implement an exponential backoff algorithm before retrying. HTTP 429 means 'Too Many Requests' — the client has exceeded the API rate limit. The correct programmatic response is to back off and retry, ideally using exponential backoff (with jitter) to avoid hammering the endpoint and to respect the server's Retry-After header when present. This is the standard, RFC-aligned way to handle rate limiting gracefully.

Answer

Immediately retry the request with the same parameters

Answer

Update the API key to a higher privilege level

Answer

Switch to the secondary API endpoint URL