SAUTO Advanced Threat And Endpoint Security Practice Test 3 — 15 Questions

Question 1

You are using the Cisco Secure Endpoint (formerly AMP for Endpoints) API to query file trajectory data for a specific SHA-256 hash. The API returns a 429 Too Many Requests status code. What is the most efficient way to handle this in your automation script?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement an exponential backoff strategy with a retry logic.. HTTP 429 Too Many Requests means the client has exceeded the API's rate limit, and the correct, standards-aligned response is to back off and retry. Exponential backoff (e.g., wait 1s, 2s, 4s, 8s, with jitter) with retry logic prevents hammering the API, respects the server's Retry-After header when present, and lets the script eventually succeed once the window resets. This is the recommended pattern in Cisco's Secure Endpoint API documentation and in RFC 6585, which defines 429.

Answer

Switch from HTTPS to HTTP to reduce overhead.

Answer

Increase the API rate limit in the Cisco Secure Endpoint dashboard.

Answer

Force an authentication refresh on every request.

Question 2

You are developing a script to pull Threat Grid sandbox reports. You receive a 401 Unauthorized error. What is the most likely cause?

Accepted Answer

The API key is missing or invalid in the Authorization header. A 401 Unauthorized error from the Threat Grid API indicates that the request lacks valid authentication credentials. The most likely cause is that the API key is missing or invalid in the Authorization header. The API requires a valid API key to authenticate requests.

Answer

The file is still being analyzed

Answer

Rate limit exceeded

Answer

The API endpoint is deprecated

Question 3

You are automating Cisco Umbrella policy changes using the Umbrella API. Which resource is used to update the blocked destination list?

Accepted Answer

/policies/destinationlists. The Umbrella API exposes destination lists (the allow/block lists applied to policies) under the /policies/destinationlists resource. Updating a blocked destination list means issuing a PUT or POST to that endpoint with the list ID and the domains to add or remove.

Answer

/settings/domains

Answer

/security/blocked

Answer

/dns/policies

Question 4

In Cisco SecureX Orchestration, you are building an atomic workflow to isolate an endpoint. Which input parameter is required to identify the target host in the Secure Endpoint 'Isolate Host' activity?

Accepted Answer

connector_guid. In Cisco SecureX Orchestration, the Secure Endpoint 'Isolate Host' activity requires the connector_guid input parameter to uniquely identify the target endpoint. The connector_guid is the unique identifier assigned to each Secure Endpoint connector when it registers with the cloud, and it is the authoritative key used by the Secure Endpoint API to address a specific host. Other identifiers like IP address, MAC address, or hostname are not guaranteed to be unique or stable and are not accepted by the isolation activity.

Answer

ipv4_address

Answer

mac_address

Answer

hostname

Question 5

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

Accepted Answer

X-RateLimit-Remaining. SecureX (and most REST APIs following the IETF draft rate-limit header convention) returns the X-RateLimit-Remaining header to indicate how many requests the client can still make in the current window before being throttled. This header is paired with X-RateLimit-Limit (total allowed) and X-RateLimit-Reset (epoch time when the window resets), allowing scripts to pace API calls proactively.

Answer

Retry-After

Answer

X-Request-Limit

Answer

Status-Remaining

Question 6

What is the primary function of the Cisco SecureX 'Inspect' feature when using the browser extension?

Accepted Answer

To extract and lookup observables from web pages. The Cisco SecureX 'Inspect' feature in the browser extension extracts observables — such as IP addresses, domains, URLs, file hashes, and email addresses — from the current web page and performs threat intelligence lookups against integrated sources. This allows analysts to quickly pivot from a suspicious webpage or report to enrichment data without manual copying.

Answer

To scan local hard drives for malware

Answer

To configure sandbox policies

Answer

To debug API responses

Question 7

In a Cisco Threat Grid API workflow, what does the 'state' field in the analysis report indicate?

Accepted Answer

The analysis status. In Cisco Threat Grid, the 'state' field in an analysis report indicates the current status of the analysis process. It reflects whether the sample is still being analyzed, has completed successfully, or encountered an error. This field is crucial for tracking the progress of a submission and determining when results are available.

Answer

The file reputation score

Answer

The connection health

Answer

The threat actor's location

Question 8

Which data format is primarily used by all Cisco Security APIs (Secure Endpoint, Umbrella, Threat Grid)?

Accepted Answer

JSON. All Cisco Security APIs (Secure Endpoint, Umbrella, Threat Grid) primarily use JSON (JavaScript Object Notation) as the data format for requests and responses. JSON is lightweight, easy to parse, and widely supported, making it the standard for these RESTful APIs.

Answer

Protobuf

Answer

XML

Answer

YAML

Question 9

Which Cisco technology provides a unified dashboard to visualize data from AMP, Umbrella, and Threat Grid?

Accepted Answer

Cisco SecureX. Cisco SecureX is the cloud-native platform that provides a unified dashboard and integrates data from multiple Cisco security products, including AMP, Umbrella, and Threat Grid. It aggregates alerts, provides threat hunting, and enables automated workflows across the security stack. SecureX is designed as the single pane of glass for Cisco's security portfolio.

Answer

Cisco Firepower Management Center

Answer

Cisco Stealthwatch

Answer

Cisco ISE

Question 10

You are developing an integration for the Cisco Secure Endpoint API. What is the result of using a pagination parameter?

Accepted Answer

Retrieves results in chunks. A pagination parameter in the Cisco Secure Endpoint API controls how results are split into manageable chunks, allowing the client to retrieve large result sets incrementally rather than all at once. This is essential for performance and to avoid timeouts or truncated responses.

Answer

Authenticates the request

Answer

Encrypts the data stream

Answer

Reduces the API call limit

Question 11

In a Python script, how do you handle a 202 Accepted response from the Threat Grid API during file submission?

Accepted Answer

Poll the status endpoint. A 202 Accepted response from the Threat Grid API indicates the file submission was accepted but analysis is asynchronous and not yet complete. The correct pattern is to poll the status endpoint (e.g., /submissions/{id} or the sample status endpoint) until the analysis reaches a terminal state, then retrieve the report. Aborting, checking logs, or blindly re-submitting would either lose the submission or create duplicate analyses.

Answer

Abort the script

Answer

Check the logs for an error

Answer

Re-submit the file immediately

Question 12

You are configuring an Umbrella API callback. What happens if the callback URL is unreachable?

Accepted Answer

The notification is dropped. When an Umbrella API callback URL is unreachable, the notification is simply dropped. Umbrella does not retry indefinitely, revert policies, shut down the API service, or fall back to email. The callback mechanism is fire-and-forget; if the endpoint cannot be reached, the event notification is lost.

Answer

The policy is reverted

Answer

The API service shuts down

Answer

The alert is sent via email

Question 13

When using the SecureX Orchestration 'HTTP Request' activity, what is the best practice for handling sensitive API keys?

Accepted Answer

Use an 'Account Key' credential object. In SecureX Orchestration, sensitive values like API keys should be stored as 'Account Key' credential objects, which are encrypted at rest and referenced by workflows without exposing the plaintext value. This prevents keys from appearing in workflow definitions, logs, or version history. It is the platform's built-in secret management mechanism.

Answer

Hardcode the key in the workflow

Answer

Pass the key as a workflow argument

Answer

Store the key in a global variable

Question 14

Which Cisco Secure Endpoint feature allows automated movement of hosts into different groups based on threat activity?

Accepted Answer

Dynamic Grouping. Dynamic Grouping in Cisco Secure Endpoint (formerly AMP for Endpoints) automatically moves hosts between groups based on criteria such as detected threat activity, hostname patterns, or OS version. This enables automated policy changes — for example, isolating a compromised host into a quarantine group with a stricter policy.

Answer

Static Grouping

Answer

Policy Assignment

Answer

Audit Logging

Question 15

Which component of Cisco SecureX allows users to create automation workflows without writing code?

Accepted Answer

The Workflow Designer. The Workflow Designer in Cisco SecureX is a graphical, drag-and-drop interface that lets users build automation workflows by connecting pre-built actions and triggers visually, with no coding required. It is the primary no-code automation component of the SecureX platform, enabling security teams to orchestrate responses across integrated products.

Answer

The API explorer

Answer

The Threat Intelligence Tool

Answer

The Script Editor