SAUTO Advanced Threat And Endpoint Security Practice Test 4 — 15 Questions

Question 1

When writing a Python request to the SecureX API, which Content-Type header is required for POST requests?

Accepted Answer

application/json. For POST requests to the SecureX API, the required Content-Type header is application/json. The SecureX API expects JSON-formatted request bodies, so the Content-Type must be set accordingly to ensure the server parses the payload correctly.

Answer

application/xml

Answer

application/x-www-form-urlencoded

Answer

text/plain

Question 2

What is the benefit of integrating Cisco Threat Grid with Secure Endpoint?

Accepted Answer

Automated file analysis. Integrating Cisco Threat Grid with Secure Endpoint enables automated file analysis: when Secure Endpoint detects a suspicious file, it can automatically submit it to Threat Grid for dynamic analysis in a sandbox. Threat Grid then returns a threat score and detailed behavioral report, which Secure Endpoint uses to determine if the file is malicious and should be quarantined. This integration provides deeper insight than static signatures alone, improving detection and response.

Answer

Automated firewall blocking

Answer

Automated user provisioning

Answer

Automated email filtering

Question 3

In Threat Grid, what is the purpose of the 'Tags' field in an analysis report submission?

Accepted Answer

To label and categorize reports. The 'Tags' field in a Threat Grid analysis report submission is used to label and categorize reports. Tags allow analysts to organize, search, and filter submissions based on custom keywords or categories, facilitating threat intelligence management and correlation.

Answer

To set the infection vector

Answer

To specify the sandbox OS

Answer

To define the analysis priority

Question 4

Which Python library is most commonly used for handling REST API requests in SecureX automation scripts?

Accepted Answer

requests. The 'requests' library is the de facto standard for making REST API calls in Python because it abstracts away the low-level complexity of HTTP into a simple, human-readable API (e.g., requests.get(url, headers=..., json=...)). SecureX automation scripts routinely use requests to authenticate against the SecureX/Cisco APIs, retrieve tokens, and parse JSON responses, making it the most common choice in orchestration playbooks.

Answer

flask

Answer

urllib

Answer

django

Question 5

You are automating a threat hunt using SecureX. Which API response field confirms that an observable is malicious?

Accepted Answer

disposition. In Cisco SecureX, the Threat Intelligence API returns a 'disposition' field that indicates whether an observable is malicious, suspicious, neutral, or unknown. This field is the definitive confirmation of maliciousness, as it aggregates verdicts from multiple intelligence sources. Other fields like threat_level or malware_score may provide additional context but are not the primary confirmation field.

Answer

malware_score

Answer

threat_level

Answer

status_code

Question 6

How do you retrieve the API credentials for Cisco Secure Endpoint?

Accepted Answer

In the 'Settings' -> 'API Credentials' menu. Cisco Secure Endpoint API credentials (a 3rd-party API client with a Client ID and API Key) are generated from the management console under Settings (gear icon) -> API Credentials. From there an administrator creates a new API credential, assigns a scope/role, and receives the Client ID and API Key used for Basic authentication to the API. This is the only supported location for creating and retrieving these credentials.

Answer

In the 'Devices' -> 'Hosts' menu

Answer

In the 'Policies' -> 'General' menu

Answer

In the 'User Management' -> 'Accounts' menu

Question 7

What is the function of the Cisco SecureX 'Threat Response' module?

Accepted Answer

Investigating threats across integrated products. The Cisco SecureX 'Threat Response' module is the investigation and response orchestration component of the SecureX platform. It aggregates observables (IPs, hashes, domains, URLs) from integrated Cisco security products such as Umbrella, AMP for Endpoints, Firepower, and Email Security, and lets analysts pivot across them in a single console. Its core function is threat investigation and response across the integrated product ecosystem, not device management or file hosting.

Answer

Managing network switch configurations

Answer

Hosting endpoint agent files

Answer

Automating software updates

Question 8

You are automating the deletion of a sandbox report in Threat Grid. Which HTTP method should you use?

Accepted Answer

DELETE. The HTTP DELETE method is used to delete a specified resource. In the context of Threat Grid, deleting a sandbox report is a deletion operation, so the DELETE method is appropriate. The API endpoint for deleting a report would be called with DELETE.

Answer

GET

Answer

POST

Answer

PUT

Question 9

Which of the following is a core benefit of using APIs for Cisco Security?

Accepted Answer

Reduced manual task complexity. APIs let security teams replace repetitive manual console or CLI work with programmatic calls, which reduces manual task complexity and human error. This is the core operational benefit Cisco emphasizes for its Security APIs: automation, consistency, and scale. The other options describe outcomes APIs do not deliver — APIs do not remove the need for firewalls, increase human intervention, or replace security staff.

Answer

Elimination of firewalls

Answer

Increased human intervention

Answer

Replacement of all security admins

Question 10

When using the Umbrella Investigate API, what does the 'co-occurrences' result represent?

Accepted Answer

Domains accessed in the same timeframe. In the Umbrella Investigate API, 'co-occurrences' returns a list of domains that were queried by the same client(s) within a similar time window as the domain being investigated. This helps analysts pivot from a suspicious domain to related infrastructure, revealing clusters of domains that may belong to the same campaign or threat actor.

Answer

The block rate of a policy

Answer

Malware infection rate

Answer

The number of users on a network

Question 11

Which THREE components are required to configure an API client for Cisco SecureX?

Accepted Answer

API Scope. To configure an API client for Cisco SecureX, you must supply the OAuth 2.0 credentials that SecureX generates when the client is created: the Client ID (E), which uniquely identifies the API client, the Client Secret (D), which authenticates that client, and the API Scope (C), which defines the specific permissions or resources the client may access. These three values are used together in the token request to obtain an access token for calling SecureX APIs. A Device Serial Number (A) is not part of API client authentication; it is hardware-identifying information used for device licensing and support, not for OAuth client credentials. A User Password (B) is likewise not required, because SecureX API clients authenticate with the generated client credentials rather than a user's account password.

Answer

Device Serial Number

Answer

User Password

Question 12

You are using the Cisco Umbrella API. Which TWO of the following are valid ways to manage domain blocking?

Accepted Answer

POST /destinationlists/{id}/destinations. Option A is correct because the Cisco Umbrella Investigate/Enforcement API exposes destination lists, and POST /destinationlists/{id}/destinations is the documented endpoint for adding one or more domains (destinations) to an existing destination list, which is how you build or extend a block list. Option E is correct because DELETE /destinationlists/{id}/destinations is the corresponding endpoint for removing domains from a destination list, allowing you to stop blocking specific domains. Both operate on the destinationlists resource, which is the API construct Umbrella uses to manage allowed/blocked domains. The unmarked options do not belong: PATCH /destinations/all is not a valid Umbrella API route, PUT /dns/settings is not an endpoint for domain blocking, and GET /policies/block is not a documented Umbrella API path for managing blocked domains.

Answer

PATCH /destinations/all

Answer

PUT /dns/settings

Answer

GET /policies/block

Question 13

Which TWO actions can be automated via the Cisco Secure Endpoint API to improve incident response?

Accepted Answer

Scan host. Option A (Scan host) is correct because the Cisco Secure Endpoint API exposes endpoints such as /computers/{id}/scan that let an incident responder programmatically trigger an on-demand malware scan of a specific computer, which is a core containment/triage action. Option C (Isolate host) is correct because the API provides a network isolation endpoint (e.g., /computers/{id}/isolation) that can be automated to quarantine an infected endpoint from the network during incident response. Option B (Reboot device) is not a supported Secure Endpoint API incident-response action for this purpose, as the API focuses on scanning, isolation, and policy/event management rather than remote reboots. Option D (Provision user) belongs to identity/access management systems, not the Secure Endpoint API. Option E (Update firewall rule) is a network-security function handled by firewall management tools, not the endpoint API.

Answer

Reboot device

Answer

Provision user

Answer

Update firewall rule

Question 14

Which THREE headers are commonly used when sending authenticated requests to Cisco Security APIs?

Accepted Answer

Content-Type. Content-Type (A) is correct because authenticated Cisco Security API requests must declare the media type of the request body (e.g., application/json) so the API can parse the payload correctly. Authorization (D) is correct because it carries the authentication credential, such as a Bearer token or Basic base64-encoded credentials, which the API validates to authenticate the caller. Accept (E) is correct because it tells the API which response media type the client expects, typically application/json, ensuring the response is returned in a usable format. Cookie (B) is not a standard header for these API authentications since Cisco Security APIs rely on Authorization tokens rather than session cookies, and User-Agent (C) is merely informational about the client and is not required for authentication.

Answer

Cookie

Answer

User-Agent

Question 15

When managing Cisco Umbrella policies, which TWO types of destination lists can you create via the API?

Accepted Answer

Block list. The Cisco Umbrella API supports creating destination lists of type 'block list' (option B) and 'allow list' (option C), which correspond to the two policy actions Umbrella enforces on destinations: blocking or allowing traffic. The block list is used to deny access to specified domains/URLs, while the allow list is used to explicitly permit destinations that might otherwise be blocked, and both are exposed via the Umbrella destination lists API endpoints (e.g., POST /policies/v2/destinationlists with a type of 'block' or 'allow'). The other options—guest list (A), warning list (D), and quarantine list (E)—are not destination list types available through the Umbrella API; Umbrella's destination list model is limited to block and allow types, so these do not apply.

Answer

Guest list

Answer

Warning list

Answer

Quarantine list