SAUTO Advanced Threat And Endpoint Security — Timed 15 Questions

Question 1

You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?

15 minute time limit — choose an answer to begin.

Accepted Answer

HMAC-SHA256 signature verification. Cisco SecureX webhook integrations natively support HMAC-SHA256 signature verification to ensure secure delivery. The sender computes an HMAC using a shared secret and includes it in the request header; the receiver validates it to confirm authenticity and integrity. This method is standard for webhook security and is explicitly supported in SecureX.

Answer

OAuth 2.0 Client Credentials flow

Answer

Mutual TLS (mTLS) certificate exchange

Answer

Basic Authentication with fixed credentials

Question 2

When automating threat hunting using the Cisco Umbrella Reporting API, which THREE of the following request parameters are commonly used to filter DNS query logs?

Accepted Answer

from. The Cisco Umbrella Reporting API's DNS query log endpoints (e.g., /reports/v2/activity/dns) use the from and to parameters to bound the time window of the query, which is essential for threat hunting over a specific period, so options B and E are correct. The domain parameter is also a valid filter that restricts results to queries for a specific domain name, allowing hunters to pivot on suspicious domains, making option C correct. Option A (threat_score) is not a standard request filter on the DNS activity endpoint—Umbrella categorizes results via identity/security category fields rather than a threat_score query parameter. Option D (source_ip) is not the correct parameter name; Umbrella uses internalip (or identity-based filters) to filter by client IP, so source_ip does not belong.

Answer

threat_score

Answer

source_ip

Question 3

You are automating threat hunting in Cisco SecureX. You want to execute a workflow that pivots from an IP address to associated domains. Which SecureX API component allows you to perform these relationship lookups?

Accepted Answer

Threat Intelligence API. The Threat Intelligence API in Cisco SecureX provides programmatic access to threat intelligence data, including relationships between observables like IP addresses and domains. It allows you to query for associated domains given an IP address, enabling threat hunting pivots. This API is specifically designed for threat intelligence lookups and is the correct component for this task.

Answer

Pivot API

Answer

Orchestration Query API

Answer

Relationship Discovery Service

Question 4

You are automating threat hunting using the Cisco Umbrella Investigate API. Which TWO parameters are required to perform a standard DNS lookup for a specific domain? (Choose two)

Accepted Answer

The domain name string. Option C is correct because the Investigate API's domain endpoint (e.g., /investigate/v2/domains/{domain}) requires the domain name string as the resource identifier to perform the DNS lookup and return categorization, WHOIS, and related security data. Option D is correct because every Umbrella Investigate API request must be authenticated by supplying the API key in the Authorization request header (Bearer token), without which the API returns a 401 Unauthorized response. Option A is incorrect because threat category IDs are returned as part of the response data, not supplied as an input parameter for a domain lookup. Option B is incorrect because a global user ID is not an Investigate API parameter; authentication is handled by the API key, not a user identifier. Option E is incorrect because the local DNS recursive resolver IP is not a required input for the Investigate domain lookup endpoint.

Answer

The threat category ID

Answer

The global user ID

Answer

The IP address of the local DNS recursive resolver

Question 5

You are configuring a Python script to query the Cisco Secure Endpoint (AMP) API for a specific SHA-256 hash. Which API endpoint should you use to retrieve the disposition of the file?

Accepted Answer

GET /v1/file/analysis/{sha256}. The /v1/file/analysis endpoint is the correct resource for retrieving file disposition and analysis status from Secure Endpoint.

Answer

GET /v1/computers/{id}/files

Answer

PUT /v1/analysis/report/{sha256}

Answer

POST /v1/file/disposition/{sha256}

Question 6

You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?

15 minute time limit — choose an answer to begin.

Accepted Answer

Authorization: Bearer . The SecureX Threat Response API uses OAuth 2.0 bearer tokens for authentication. When making API requests, the token must be included in the 'Authorization' header with the 'Bearer' prefix, e.g., 'Authorization: Bearer '. This is the standard method for passing bearer tokens in HTTP requests.

Answer

API-Key: <API_KEY>

Answer

X-Auth-Token: <API_KEY>

Answer

Cookie: session=<API_KEY>

Question 7

Which authentication scheme does the Cisco Secure Endpoint API primarily utilize?

Accepted Answer

Basic Authentication. The Cisco Secure Endpoint API (formerly AMP for Endpoints) primarily uses HTTP Basic Authentication, where the API client ID and API key are Base64-encoded and sent in the Authorization header. This is the standard method documented in Cisco's API reference for authenticating REST calls to the Secure Endpoint console. Although OAuth 2.0 and JWT are common in modern APIs, Secure Endpoint's core API relies on Basic Auth for simplicity and direct credential exchange.

Answer

OAuth 2.0 Client Credentials

Answer

SAML 2.0

Answer

JWT Bearer Token

Question 8

When integrating Cisco Umbrella with a SIEM via the Reporting API, which format is recommended for high-volume log ingestion?

Accepted Answer

JSON via S3. The Cisco Umbrella Reporting API supports exporting logs to Amazon S3 in JSON format, which is the recommended method for high-volume ingestion. JSON is natively supported by most SIEMs and allows for efficient parsing and indexing of nested fields. S3 provides scalable, durable storage and can be polled or streamed by the SIEM, making it ideal for large log volumes. This approach avoids the overhead of direct API calls and ensures reliable delivery.

Answer

CSV

Answer

Direct XML streaming

Answer

SQL database dump

Question 9

You need to trigger a sandbox analysis in Threat Grid via API. Which parameter is mandatory in the POST request?

Accepted Answer

sample_file. The file parameter containing the sample is mandatory for the analysis submission.

Answer

sha256_hash

Answer

callback_url

Answer

analysis_priority

Question 10

When integrating with the Umbrella Investigate API, which request should be used to get the domain's historical security data?

Accepted Answer

GET /domains/{domain}/timeline. The /timeline endpoint provides the historical security context for a domain.

Answer

POST /investigate/query

Answer

GET /security/timeline/{domain}

Answer

GET /domains/{domain}/history

Question 11

You are using the Cisco Umbrella API to pull blocked DNS requests. Which resource provides this data?

Accepted Answer

/reports/dns_query_log. The Cisco Umbrella API endpoint /reports/dns_query_log is the correct resource for retrieving DNS query logs, including blocked requests. This endpoint provides detailed records of DNS queries, their verdicts (allowed/blocked), and associated metadata. It is part of the Umbrella Reporting API, which is designed for accessing historical DNS activity data.

Answer

/logs/blocked

Answer

/dns/activity

Answer

/security/dns

Question 12

You are calling the Secure Endpoint API to get a list of computers. Which query parameter filters the list by operating system?

Accepted Answer

?os=windows. The 'os' parameter is used to filter by operating system type in the API call.

Answer

?filter=os

Answer

?type=computer

Answer

?platform=windows

Question 13

You are performing a bulk file search in Secure Endpoint. What is the maximum number of items returned in a single API page response?

Accepted Answer

500. The Secure Endpoint API default and maximum page size is typically 500 records.

Answer

5000

Answer

50

Answer

1000

Question 14

In a Cisco SecureX workflow, which activity should be used to parse a JSON response from an external API?

Accepted Answer

JSON Parse. The 'JSON Parse' activity is specifically designed to convert raw JSON strings into objects for use in workflows.

Answer

Data Transform

Answer

String Split

Answer

HTTP Request

Question 15

You need to trigger a 'Scan Now' action on a host via the Secure Endpoint API. What is the correct HTTP method?

Accepted Answer

POST. A POST request is used to initiate an action or command, such as scanning, on an endpoint.

Answer

PATCH

Answer

PUT

Answer

GET