SAUTO Cloud Web And Email Security Automation — 20 Questions

Question 1

When integrating Cisco Umbrella with a SIEM using the Cisco Umbrella Investigate API, which TWO pieces of information are required to authenticate and query domain status?

Accepted Answer

API Token. Option A (API Token) is correct because the Cisco Umbrella Investigate API authenticates requests using a bearer token generated from the Umbrella dashboard, which identifies the customer and authorizes API calls such as domain status queries. Option C (Authorization Header) is correct because the token must be transmitted in the HTTP Authorization header (typically as 'Authorization: Bearer <token>') for the Investigate API to accept and process the request. Option B (WSA Admin password) is not used by the Investigate API, as that credential applies to Cisco Web Security Appliance management, not Umbrella API authentication. Option D (Internal DNS server IP) is irrelevant to API authentication and querying domain status, since the Investigate API is a cloud REST service accessed over HTTPS. Option E (Organization ID) is not required for Investigate API authentication or domain status queries, as the API token itself is tied to the organization.

Answer

WSA Admin password

Answer

Internal DNS server IP

Answer

Organization ID

Question 2

You are automating Cisco Umbrella policy updates using the Umbrella Management API. You need to identify the correct endpoint to retrieve the list of existing destination lists for a specific organization. Which URI pattern is correct?

Accepted Answer

/admin/v2/organizations/{organizationId}/destinationlists. The Umbrella Management API uses /organizations/{organizationId}/destinationlists to list destination lists for an organization.

Answer

/v1/organizations/{organizationId}/policies/destination-lists

Answer

/v1/reports/destinationlists/{organizationId}

Answer

/api/v2/orgs/{organizationId}/dest-lists

Question 3

When configuring Cisco Secure Email Gateway (formerly ESA) for automated quarantine release via the API, which HTTP method is required to perform the release action on a specific message GUID?

Accepted Answer

PUT. The Cisco Secure Email Gateway AsyncOS API uses the POST method to perform administrative actions such as releasing a message from quarantine.

Answer

PATCH

Answer

DELETE

Answer

GET

Question 4

You are automating the retrieval of security logs from Cisco Umbrella using the Reporting API. You need to pull logs for a specific time range. Which parameter must be included in the API request to ensure the response is correctly paginated and contains the requested data slice?

Accepted Answer

limit. The Cisco Umbrella Reporting API uses the 'limit' parameter to control the number of records returned per page, which is essential for pagination. When you specify a limit, the API returns a subset of results and includes a 'page_token' in the response if more data exists. This allows you to retrieve the requested data slice iteratively. Without 'limit', the API may return a default number of records, potentially not matching your intended slice size, and pagination may not behave as expected.

Answer

slice_id

Answer

page_token

Answer

session_id

Question 5

When configuring Cisco Cloudlock to monitor SaaS applications, you need to automate the revocation of compromised OAuth tokens. Which mechanism within the Cloudlock API allows you to programmatically trigger a token revocation event?

Accepted Answer

Using the 'App Firewall' API to invoke a Revoke event on the specific token ID. Cloudlock's App Firewall API provides programmatic control over OAuth application governance, including the ability to invoke a Revoke event on a specific token ID. This is the documented mechanism for automating token revocation when a compromised OAuth token is detected. The other options reference unrelated APIs or actions that do not trigger token revocation.

Answer

Sending a block command to the Cisco Umbrella API

Answer

Updating the SaaS app status to 'Disabled' in the Cloudlock console via API

Answer

Deleting the user account from the Cloudlock directory

Question 6

You are automating the quarantine of emails in Cisco Secure Email (formerly IronPort). Which API interaction is required to trigger a move of a specific message ID into the quarantine?

Accepted Answer

POST /msg/action with the 'quarantine' command and MID. Cisco Secure Email's API uses a POST to /msg/action with a command parameter (such as 'quarantine') and the target message ID (MID) to move a specific message into quarantine. This action-based endpoint is how automation triggers state changes on individual messages. GET and DELETE endpoints either retrieve or remove messages but do not perform the quarantine move.

Answer

DELETE /msg/{mid}

Answer

GET /msg/quarantine?mid={id}

Answer

PUT /policy/quarantine/{mid}

Question 7

When automating the deployment of Cisco Umbrella virtual appliances (VAs) using APIs, what is the primary prerequisite that must be configured in the dashboard?

Accepted Answer

Register the VAs in the Umbrella Dashboard. Before any API-driven automation can manage Umbrella virtual appliances (VAs), the VAs must first be registered in the Umbrella Dashboard so that they are recognized as valid, licensed components of the organization's Umbrella deployment. Registration binds each VA to the customer's org ID and generates the identity/secret credentials that the API and the VA itself use for authentication and policy retrieval. Without this registration step, API calls targeting VA management will fail because the appliance is not a known object in the dashboard.

Answer

Install the Umbrella Connector on a local server

Answer

Enable the 'Legacy' API mode

Answer

Create a dedicated API user account

Question 8

When automating a Cisco Secure Web Appliance (WSA) task, you need to trigger a 'policy push'. Which API component allows you to initiate this?

Accepted Answer

Configuration Commit API. On Cisco Secure Web Appliance, configuration changes are staged and then applied to the running policy via the Configuration Commit API. This component initiates the 'policy push' that activates pending configuration changes across the appliance. Other named APIs handle rule enforcement or device synchronization but not the commit/push action.

Answer

Rule Enforcement API

Answer

Device Sync API

Answer

Policy Push API

Question 9

You are developing a script to pull alerts from Cisco Cloudlock. You want to filter for 'High Severity' incidents only. Which parameter should you include in your API call?

Accepted Answer

severity=high. The Cisco Cloudlock API accepts a severity query parameter, and filtering for high-severity incidents is done by passing severity=high in the request. This is the documented parameter name and value format used by the Cloudlock Incidents API, so it correctly narrows the result set to high-severity incidents only.

Answer

filter='High'

Answer

limit=high

Answer

status='critical'

Question 10

You are automating the extraction of SaaS security incidents from Cloudlock. You observe that incidents are being missed by your script. What is the most likely cause if your script is calling the API every 60 seconds?

Accepted Answer

The script is not using a 'start_time' parameter to track the last retrieved event. Cloudlock's incident API returns events based on a time window, and without a 'start_time' parameter the script may repeatedly fetch the same default window or miss events outside it. To reliably retrieve all incidents, the script must track the last retrieved timestamp and pass it as 'start_time' on each poll. Polling every 60 seconds is fine, but without time-based pagination, incidents can be skipped.

Answer

The incidents have been deleted by the user

Answer

The API is offline

Answer

The script uses POST instead of GET

Question 11

You are automating the 'App Firewall' in Cisco Cloudlock. You want to change an OAuth app's status from 'Approved' to 'Revoked'. Which object structure must be sent in the request body?

Accepted Answer

{"status": "revoked"}. The Cloudlock App Firewall API expects a JSON body where the 'status' field is set to the desired state of the OAuth application. To revoke an app that is currently 'Approved', you send {"status": "revoked"}. The API uses the 'status' key (not 'state' or 'action') and the value 'revoked' to transition the app's lifecycle state.

Answer

{"type": "oauth", "state": "blocked"}

Answer

{"action": "delete"}

Answer

{"user_id": "all", "action": "revoke"}

Question 12

Which HTTP method should you use when updating an existing Cisco Cloudlock policy?

Accepted Answer

PUT. PUT is the correct method for updating an existing Cloudlock policy because it replaces the full resource representation at the known policy URI. Cloudlock's REST API uses PUT for policy updates, making it the expected verb for modifying an existing policy's configuration.

Answer

GET

Answer

PATCH

Answer

POST

Question 13

Which TWO of the following are valid HTTP methods supported by the Cisco Umbrella Management API?

Accepted Answer

POST. The Cisco Umbrella Management API supports standard RESTful HTTP methods for creating and removing resources, and POST (option A) is correct because it is used to create new resources such as networks, policies, or identities via the API endpoints. DELETE (option C) is also correct because it is used to remove existing resources by their identifiers through the Management API. The remaining options do not belong: CONNECT (B) is an HTTP method for establishing tunnels through proxies, HEAD (D) retrieves headers only and is not part of the documented Umbrella Management API operations, and TRACE (E) is a diagnostic method for echoing requests that is not supported by the API.

Answer

CONNECT

Answer

HEAD

Answer

TRACE

Question 14

Which TWO of the following steps are required to automate the retrieval of reporting data from the Cisco Secure Email Gateway?

Accepted Answer

Authenticate using an API key. Option A is correct because automating retrieval of reporting data from the Cisco Secure Email Gateway requires authenticating to the Reporting API using an API key, which is generated on the appliance and passed in the request header (e.g., as a j_username/j_password or Authorization credential) to obtain a valid session. Option E is correct because the actual automation step is to query the Reporting API endpoints (such as /sma/api/v2.0/reporting/...) to pull the desired reporting data programmatically. Option B is wrong because rebooting the appliance is an operational action that does not enable or perform data retrieval. Option C is wrong because configuring a local Syslog server is for event/log forwarding, not for retrieving reporting data via the API. Option D is wrong because enabling SSH access is for command-line administration and is not required for API-based reporting automation.

Answer

Reboot the appliance

Answer

Configure a local Syslog server

Answer

Enable SSH access

Question 15

Which TWO of the following are mandatory fields when creating a new 'Destination List' via the Cisco Umbrella API?

Accepted Answer

name. Option A (name) is correct because every Destination List created through the Cisco Umbrella API must be given a unique name to identify it within the organization's policy configuration. Option C (access) is correct because the API requires the access field to define whether the list is a 'block' or 'allow' list, which determines how the destinations in the list are treated by Umbrella's policy engine. Option B (organizationId) is not a body field in the create request; the organization is derived from the API key/authentication context rather than being supplied as a mandatory payload field. Option D (description) is optional metadata that can be added for documentation but is not required to create the list. Option E (createdAt) is a system-generated timestamp returned by the API, not a field the client supplies when creating a Destination List.

Answer

organizationId

Answer

description

Answer

createdAt

Question 16

You are writing a Python script to update URL filtering policies on Cisco Secure Web Appliance (SWA) using the AsyncOS API. Which HTTP method must you use to perform a partial update on an existing Custom URL Category?

Accepted Answer

POST. In RESTful API design within AsyncOS, PATCH is used for partial updates to resource attributes.

Answer

GET

Answer

PUT

Answer

DELETE

Question 17

You are automating Cisco Umbrella reporting using the Reporting API. You need to pull threat activity logs for a specific destination. Which request header is mandatory to include in your HTTP GET call to authorize the request?

Accepted Answer

Authorization: Bearer . The Cisco Umbrella Reporting API requires OAuth 2.0 authentication, and the standard way to present the access token is via the HTTP Authorization header using the Bearer scheme. The token is obtained from the Umbrella identity provider (e.g., https://api.umbrella.com/auth/v2/token) using your API key and secret. Therefore, the mandatory header is 'Authorization: Bearer '.

Answer

X-API-KEY

Answer

Cookie: session_id

Answer

X-Auth-Token

Question 18

When automating the Cisco Secure Email (ESA) configuration via the API, which file format is required to import a new set of content filters?

Accepted Answer

XML. The Cisco Secure Email (ESA) API requires content filters to be imported in XML format. The API's configuration import/export functionality uses XML to represent the filter rules, actions, and conditions. This is the standard format for ESA configuration files.

Answer

CSV

Answer

YAML

Answer

JSON

Question 19

You are using the Cisco Umbrella Investigate API to enrich an incident response playbook. Which endpoint should you query to retrieve the security status and associated domains for an IP address?

Accepted Answer

/security/ip/{ip}. The Cisco Umbrella Investigate API endpoint /security/ip/{ip} returns the security status for an IP address, including SEC categories, attack/threat type, and associated domains. The /dnsdb/ip/{ip}/domain endpoint is a passive DNS lookup that returns domains associated with an IP but does not provide the IP's security status. Therefore, to retrieve security status and associated domains, use /security/ip/{ip}.

Answer

/whois/ip/{ip}

Answer

/threat/ip/{ip}

Answer

/dnsdb/ip/{ip}/domain

Question 20

You are automating Cisco Secure Email (ESA) using the Management API. You need to trigger an immediate update of the Anti-Spam engine. Which action is required to ensure the API call succeeds?

Accepted Answer

POST to /api/v1.0/config/engines/update. The Cisco ESA Management API exposes a specific endpoint for triggering engine updates, and the correct action is to POST to /api/v1.0/config/engines/update. This endpoint instructs the appliance to immediately check for and apply the latest Anti-Spam engine definitions. Using POST is required because the operation changes state on the appliance, not merely retrieves information.

Answer

Update the config.xml file via SCP

Answer

Send a GET request to /config/antispam

Answer

Restart the appliance via API