SAUTO Advanced Threat And Endpoint Security Practice Test 5 — 15 Questions

Question 1

When investigating an IP address in Cisco SecureX, which TWO pieces of intelligence data are typically provided by the Threat Intelligence API?

Accepted Answer

Sightings. Option C (Sightings) is correct because the Cisco SecureX Threat Intelligence API returns sighting data for an investigated IP address, showing where and when that indicator has been observed across Cisco telemetry and integrated sources. Option E (Disposition) is correct because the API also returns a disposition verdict (such as malicious, suspicious, or benign) that summarizes the threat assessment for the IP. These two data types are core outputs of the Threat Intelligence API's indicator enrichment. Options A (Network topology), B (User password hash), and D (Hardware specs) are not intelligence data provided by this API, as it focuses on threat indicators rather than infrastructure diagrams, credential material, or device specifications.

Answer

Network topology

Answer

User password hash

Answer

Hardware specs

Question 2

Which THREE types of observables can be looked up using the Cisco SecureX Threat Intelligence API?

Accepted Answer

SHA-256 hash. The Cisco SecureX Threat Intelligence API supports querying several observable types for enrichment, and among the listed options the correct ones are SHA-256 hash (B), domain (D), and IP address (E). SHA-256 hashes are file-based observables commonly submitted to threat intelligence services to check reputation and malware associations, which is a core capability of the Threat Intelligence API. Domains are network observables used to identify malicious infrastructure, and the API accepts them for reputation and related-indicator lookups. IP addresses are likewise standard network observables that the API enriches with reputation, geolocation, and associated threat data. MAC addresses (A) and user email addresses (C) are not supported observable types for this API's threat intelligence lookups, so they are not valid answers.

Answer

MAC address

Answer

User email

Question 3

Which THREE features are provided by the Cisco SecureX API documentation?

Accepted Answer

Request examples. The Cisco SecureX API documentation is designed to let developers integrate with SecureX services, so it includes request examples (A) that show exactly how to format calls to the API, including HTTP methods, URLs, headers, and sample payloads. It also provides schema definitions (B), which describe the data models and structures of request and response bodies so developers know the expected fields and types. Endpoint definitions (D) are likewise included, listing the available API endpoints and their operations so consumers know which URLs to call for each function. Pricing information (C) is a commercial/billing matter and is not part of API reference documentation, and hardware installation guides (E) are physical deployment documents unrelated to the SecureX API documentation.

Answer

Pricing information

Answer

Hardware installation guides

Question 4

Which TWO parameters are typically required for paginating through large result sets in the Secure Endpoint API?

Accepted Answer

offset. The Secure Endpoint API uses offset-based pagination, so option D (offset) is required to specify the starting position within the full result set from which records should be returned. Option E (limit) is also required to cap the number of records returned per page, which together with offset lets a client iterate through large result sets in fixed-size chunks. Options A (query), B (sort), and C (filter) are not pagination parameters: query and filter narrow which records match, and sort controls ordering, but none of them determine which page or how many records are returned, so they are not the two parameters needed for pagination.

Answer

query

Answer

sort

Answer

filter

Question 5

Which TWO items are required to properly authenticate a SecureX API request using an API Client?

Accepted Answer

Client Secret. To authenticate a SecureX API request with an API Client, you must supply the Client ID (E) and Client Secret (D) that were generated when the API Client was created in the SecureX portal; these two values are exchanged for an access token via the OAuth 2.0 client-credentials flow, which is how SecureX authorizes machine-to-machine API calls. The Client ID identifies the specific API Client, while the Client Secret acts as its confidential credential, and both are required together for the token request to succeed. By contrast, a Username (B) and Password (A) are user-account credentials used for interactive/human login, not for API Client authentication, and a Device GUID (C) is an identifier for a registered device rather than an API credential, so none of those unmarked options belong in this scenario.

Answer

Password

Answer

Username

Answer

Device GUID

Question 6

When using the Cisco Threat Grid API, which TWO methods can be used to retrieve report data?

Accepted Answer

GET by ID. Option A (GET by ID) is correct because the Threat Grid API exposes a REST endpoint such as GET /api/v2/samples/{id} or /api/v2/submissions/{id} that returns the full report for a specific sample or submission identified by its unique ID. Option E (GET by search query) is correct because the API also supports GET requests against search endpoints (e.g., /api/v2/search/submissions or /api/v2/search/samples) with query parameters, allowing report data to be retrieved by matching criteria rather than a single ID. The remaining options do not belong: DELETE by report (B) removes or deletes a resource rather than retrieving report data, POST by ID (C) is used to create or submit resources, and PUT by search (D) is used to update or replace a resource, not to fetch reports.

Answer

DELETE by report

Answer

POST by ID

Answer

PUT by search

Question 7

You are configuring a SecureX workflow to notify a team. Which THREE notification methods are available via standard activities?

Accepted Answer

Webex. The three standard notification activities in SecureX workflows are Webex (C), PagerDuty (D), and Email (E). Webex (C) is correct because SecureX provides a native Webex Teams activity that posts messages to a room or space, allowing teams to receive workflow alerts directly in their collaboration workspace. PagerDuty (D) is correct because SecureX includes a PagerDuty activity that triggers incidents through the PagerDuty API, enabling on-call escalation and alerting for operations teams. Email (E) is correct because SecureX offers a built-in Send Email activity that delivers notifications via SMTP to specified recipients. Voice call (A) and SMS (B) are not standard SecureX workflow activities; while third-party integrations or custom HTTP requests could theoretically reach telephony or SMS gateways, they are not available as out-of-the-box notification activities.

Answer

Voice call

Answer

SMS

Question 8

When managing Secure Endpoint through the API, which TWO pieces of information are used to track endpoint health?

Accepted Answer

Event logs. Event logs (A) are correct because the Secure Endpoint API exposes event streams (e.g., /v1/event or /v1/events endpoints) that report detections, quarantines, and other activity used to gauge an endpoint's security health. Connector status (D) is correct because the API's computer/endpoint resource reports the connector's state (e.g., connected, disconnected, or the connector version and last-seen time), which directly indicates whether the endpoint is protected and communicating. Network speed (B) is a performance metric unrelated to endpoint security health, BIOS version (C) is a hardware/firmware attribute not used for health tracking, and installed printer drivers (E) are peripheral software details with no bearing on Secure Endpoint health.

Answer

Network speed

Answer

BIOS version

Answer

Installed printer drivers

Question 9

An automation script is querying the Cisco Secure Endpoint (AMP for Endpoints) API to retrieve file trajectory data for a specific SHA-256 hash. The script is returning a 429 status code. What is the most efficient way to handle this in your automation code?

Accepted Answer

Implement an exponential backoff algorithm in the retry loop. HTTP 429 means 'Too Many Requests' — the API rate limit has been exceeded. The correct and most efficient client-side handling is exponential backoff: wait, retry, and progressively increase the delay between retries, ideally with jitter, until the request succeeds. This respects the server's rate limit while eventually completing the request without manual intervention.

Answer

Increase the API token expiration time in the Secure Endpoint console

Answer

Request a higher API privilege level from the administrator

Answer

Force the API to use a different base URL

Question 10

When using the Cisco Umbrella Reporting API, which format is the default output for retrieving threat activity logs to ensure compatibility with most data analysis tools?

Accepted Answer

JSON. The Cisco Umbrella Reporting API returns JSON by default, which is the native format for most modern data analysis tools, SIEMs, and scripting languages. JSON's structure maps cleanly to Python dictionaries and JavaScript objects, making it the standard interchange format for API-driven log retrieval. XML, CSV, and binary are not the default output for Umbrella Reporting API responses.

Answer

XML

Answer

Binary

Answer

CSV

Question 11

You are using the Cisco Umbrella Investigate API to check if a specific IP address is associated with a known threat. Which domain of the API should you query?

Accepted Answer

/ips/. The Umbrella Investigate API organizes its data by object type, and IP address intelligence is exposed under the /ips/ domain. Querying /ips/{ip} returns reputation, ASN, geolocation, and associated threat indicators for that IP. To check whether a specific IP is tied to a known threat, /ips/ is the correct endpoint.

Answer

/files/

Answer

/domains/

Answer

/security/

Question 12

Which Python library is most commonly used in Cisco security automation scripts to interact with REST APIs?

Accepted Answer

requests. The Python 'requests' library is the de facto standard for making HTTP/HTTPS requests in Python, including GET, POST, PUT, and DELETE calls to REST APIs. Cisco security automation scripts overwhelmingly use requests to authenticate and interact with APIs such as Secure Endpoint, Umbrella, and Firepower.

Answer

beautifulsoup

Answer

scapy

Answer

pandas

Question 13

Your script is pulling alerts from the Cisco Secure Endpoint API and needs to filter for only 'Critical' detections. How is this filtering best accomplished?

Accepted Answer

Use query parameters in the API request. The Cisco Secure Endpoint API supports query parameters (such as severity, detection type, and date ranges) on alert and event endpoints, allowing the server to filter results before returning them. Using query parameters reduces payload size, improves performance, and avoids pulling large datasets just to discard most of them client-side.

Answer

Update the alert severity in the Secure Endpoint console

Answer

Use a different endpoint that only returns critical alerts

Answer

Retrieve all alerts and filter locally in the application code

Question 14

When automating threat hunting with Cisco SecureX, which object type is used to represent an observable that has been aggregated from multiple sources?

Accepted Answer

Observable. In Cisco SecureX threat hunting, an Observable is the object type that represents an atomic piece of threat intelligence (IP, domain, hash, URL) that has been aggregated and enriched from multiple intelligence sources. SecureX correlates sightings across integrated products into a single Observable record, giving analysts one unified view rather than duplicate raw indicators.

Answer

Threat-Actor

Answer

Log-Entry

Answer

Device-Group

Question 15

You are automating the deletion of an indicator in Cisco Threat Grid. Which HTTP method must be used to ensure the request is idempotent and compliant with the RESTful design of the API?

Accepted Answer

DELETE. DELETE is the correct HTTP method because deleting an indicator is a removal operation, and DELETE is defined by REST semantics as idempotent — repeating the same DELETE request yields the same end state (the resource is gone). This aligns with Threat Grid's RESTful API design for indicator management.

Answer

POST

Answer

PUT

Answer

PATCH