SAUTO Cloud Web And Email Security Automation — 40 Questions

Question 1

You are automating Cisco Umbrella policy updates using the Umbrella Management API. You need to identify the correct endpoint to retrieve the list of existing destination lists for a specific organization. Which URI pattern is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/admin/v2/organizations/{organizationId}/destinationlists. The Umbrella Management API uses /organizations/{organizationId}/destinationlists to list destination lists for an organization.

Answer

/v1/organizations/{organizationId}/policies/destination-lists

Answer

/v1/reports/destinationlists/{organizationId}

Answer

/api/v2/orgs/{organizationId}/dest-lists

Question 2

When configuring Cisco Secure Email Gateway (formerly ESA) for automated quarantine release via the API, which HTTP method is required to perform the release action on a specific message GUID?

Accepted Answer

PUT. The Cisco Secure Email Gateway AsyncOS API uses the POST method to perform administrative actions such as releasing a message from quarantine.

Answer

PATCH

Answer

DELETE

Answer

GET

Question 3

You are writing a Python script to update URL filtering policies on Cisco Secure Web Appliance (SWA) using the AsyncOS API. Which HTTP method must you use to perform a partial update on an existing Custom URL Category?

Accepted Answer

POST. In RESTful API design within AsyncOS, PATCH is used for partial updates to resource attributes.

Answer

GET

Answer

PUT

Answer

DELETE

Question 4

When integrating Cisco Umbrella with a SIEM using the Cisco Umbrella Investigate API, which TWO pieces of information are required to authenticate and query domain status?

Accepted Answer

API Token. The Investigate API requires an API token (key) and an Authorization header to validate requests.

Answer

WSA Admin password

Answer

Internal DNS server IP

Answer

Organization ID

Question 5

Which Cisco security product provides an API to automate the management of web proxy policies and access logs?

Accepted Answer

Cisco Secure Web Appliance (WSA). Cisco Secure Web Appliance (WSA) features an extensive management API for configuration and log retrieval.

Answer

Cisco Tetration

Answer

Cisco Duo

Answer

Cisco Secure Endpoint

Question 6

You are configuring a Webex CASB integration. To automate the reporting of anomalous file sharing events from a third-party cloud storage service, which API mechanism should you configure to receive real-time updates?

Accepted Answer

Registering a Webhook endpoint. Webhooks are the standard mechanism for receiving push notifications from CASB providers regarding security events.

Answer

Direct database query access

Answer

SNMP Traps

Answer

Using an SSH tunnel to the cloud provider

Answer

Polling the REST API every 60 seconds

Question 7

You are developing a script to interact with the Cisco Cloudlock API to identify risky OAuth applications. Which THREE actions are valid when using the Cloudlock REST API to manage application risk?

Accepted Answer

Revoke OAuth tokens for identified risky apps. Cloudlock APIs allow for retrieving app risk scores, revoking app access, and listing users granted access to specific applications.

Answer

Update the Cisco Umbrella DNS filtering policies

Answer

Modify the global cloud infrastructure firewall rules

Question 8

When using the Cisco Secure Email (formerly ESA) AsyncOS API to fetch message tracking data, what is the mandatory header required for authentication?

Accepted Answer

Authorization. The AsyncOS API requires the 'Authorization' header using Basic authentication with encoded credentials.

Answer

Cookie: session_id

Answer

Bearer-Token

Answer

X-API-Key

Question 9

You are automating the retrieval of security logs from Cisco Umbrella using the Reporting API. You need to pull logs for a specific time range. Which parameter must be included in the API request to ensure the response is correctly paginated and contains the requested data slice?

Accepted Answer

limit. The Cisco Umbrella Reporting API uses a 'limit' and 'offset' parameter for pagination to ensure large datasets are handled efficiently.

Answer

slice_id

Answer

page_token

Answer

session_id

Question 10

You are automating policy updates for Cisco Umbrella using the Umbrella Management API. You need to identify the correct endpoint to retrieve the list of destination lists for a specific organization. Which HTTP method and path should you use?

Accepted Answer

GET /v1/organizations/{organizationId}/destinationlists. The Cisco Umbrella Management API uses the GET method with the /organizations/{organizationId}/destinationlists path to retrieve the destination lists associated with an organization.

Answer

GET /v1/policies/destinationlists

Answer

POST /v1/organizations/{organizationId}/destinationlists

Answer

PUT /v1/organizations/{organizationId}/destinationlists

Question 11

You are automating the retrieval of threat intelligence logs from Cisco Secure Email Cloud Gateway. Which API interface provides the most efficient way to fetch historical message tracking logs for automated analysis?

Accepted Answer

Reporting API. The Cisco Secure Email Cloud Gateway (CES) uses the Reporting API to allow for the extraction of historical message tracking data in JSON or CSV format.

Answer

AsyncOS API

Answer

External Threat Feeds API

Answer

Web Security Appliance API

Question 12

You are writing a Python script to interact with the Cisco Secure Web Appliance (WSA) REST API to pull 'Access Logs'. When parsing the response, you notice the data is chunked. What is the most appropriate way to handle large log datasets when using the REST API?

Accepted Answer

Use the 'limit' and 'offset' query parameters to paginate through the log data. The WSA REST API handles large datasets through pagination (offset and limit parameters) to prevent memory exhaustion on the client and server.

Answer

Increase the timeout on the HTTP request

Answer

Request the data in XML format instead of JSON

Answer

Switch to the SSH-based CLI API to download the logs

Question 13

When configuring Cisco Cloudlock to monitor SaaS applications, you need to automate the revocation of compromised OAuth tokens. Which mechanism within the Cloudlock API allows you to programmatically trigger a token revocation event?

Accepted Answer

Using the 'App Firewall' API to invoke a Revoke event on the specific token ID. Cloudlock provides the 'Revoke' action via the 'Events' or 'App Firewall' API endpoints to handle OAuth token lifecycle management programmatically.

Answer

Sending a block command to the Cisco Umbrella API

Answer

Updating the SaaS app status to 'Disabled' in the Cloudlock console via API

Answer

Deleting the user account from the Cloudlock directory

Question 14

Which TWO actions must you perform to successfully integrate an automation script with the Cisco Secure Email API?

Accepted Answer

Use HTTP Basic Authentication in your request headers. You must enable the API service in the appliance settings and provide correct credentials via HTTP Basic Auth.

Answer

Install a local Python agent on the appliance

Answer

Configure an SNMPv3 user for API access

Answer

Register the appliance with Cisco Defense Orchestrator

Question 15

You are automating the addition of malicious URLs to a Cisco Umbrella destination list. After sending a POST request with the new domains, you receive a '409 Conflict' error. What is the likely cause?

Accepted Answer

The domain already exists in the destination list. A 409 Conflict error in the Umbrella Destination List API indicates that the domain already exists in the list.

Answer

The destination list limit has been reached

Answer

The API Key has expired

Answer

The domain format is invalid

Question 16

You are integrating Cisco Umbrella with your SIEM using the Umbrella Reporting API. Which authentication mechanism is required to access the Reporting API endpoints?

Accepted Answer

API Key and Secret to obtain a Bearer Token. Umbrella API access requires a set of API keys (Key and Secret) generated in the Umbrella Dashboard, which are then used to obtain an OAuth 2.0 bearer token.

Answer

Username and password in the HTTP header

Answer

Shared pre-shared key (PSK)

Answer

Client certificate-based authentication only

Question 17

You are managing Cisco Cloudlock settings via the API. You need to ensure that specific SaaS file-sharing events are flagged. Which API object must you target to define a new policy violation trigger?

Accepted Answer

Policies API. The Cloudlock API uses the 'Policies' endpoint to create or modify triggers that flag specific SaaS events.

Answer

Configuration API

Answer

Audit API

Answer

Applications API

Answer

Users API

Question 18

You are automating the quarantine of emails in Cisco Secure Email (formerly IronPort). Which API interaction is required to trigger a move of a specific message ID into the quarantine?

Accepted Answer

POST /msg/action with the 'quarantine' command and MID. The Secure Email Message Tracking API allows you to perform actions on specific messages, including 'quarantine' via a POST request to the message action endpoint.

Answer

DELETE /msg/{mid}

Answer

GET /msg/quarantine?mid={id}

Answer

PUT /policy/quarantine/{mid}

Question 19

Which Cisco security product uses the 'AsyncOS' platform, and for which automation tasks is its API most commonly used?

Accepted Answer

Cisco Secure Email and Web Appliances; configuration and monitoring. Cisco Secure Email and Secure Web appliances run on AsyncOS and use the AsyncOS API for reporting, configuration, and monitoring.

Answer

Cisco Cloudlock; SaaS file inspection

Answer

Cisco Umbrella; DNS filtering policies

Answer

Cisco Firepower; firewall rule orchestration

Question 20

When automating the deployment of Cisco Umbrella virtual appliances (VAs) using APIs, what is the primary prerequisite that must be configured in the dashboard?

Accepted Answer

Register the VAs in the Umbrella Dashboard. Before VAs can be managed or reported on via API, they must be registered in the Cisco Umbrella Dashboard under 'Deployments' > 'Core Identities' > 'Virtual Appliances'.

Answer

Install the Umbrella Connector on a local server

Answer

Enable the 'Legacy' API mode

Answer

Create a dedicated API user account