SAUTO Cloud Web And Email Security Automation Practice Test 2 — 15 Questions

Question 1

You are writing a Python script to update URL filtering policies on Cisco Secure Web Appliance (SWA) using the AsyncOS API. Which HTTP method must you use to perform a partial update on an existing Custom URL Category?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

POST. In RESTful API design within AsyncOS, PATCH is used for partial updates to resource attributes.

Answer

GET

Answer

PUT

Answer

DELETE

Question 2

You are automating Cisco Umbrella reporting using the Reporting API. You need to pull threat activity logs for a specific destination. Which request header is mandatory to include in your HTTP GET call to authorize the request?

Accepted Answer

Authorization: Bearer . The Cisco Umbrella Reporting API requires OAuth 2.0 authentication, and the standard way to present the access token is via the HTTP Authorization header using the Bearer scheme. The token is obtained from the Umbrella identity provider (e.g., https://api.umbrella.com/auth/v2/token) using your API key and secret. Therefore, the mandatory header is 'Authorization: Bearer '.

Answer

X-API-KEY

Answer

Cookie: session_id

Answer

X-Auth-Token

Question 3

When automating the Cisco Secure Email (ESA) configuration via the API, which file format is required to import a new set of content filters?

Accepted Answer

XML. The Cisco Secure Email (ESA) API requires content filters to be imported in XML format. The API's configuration import/export functionality uses XML to represent the filter rules, actions, and conditions. This is the standard format for ESA configuration files.

Answer

CSV

Answer

YAML

Answer

JSON

Question 4

You are using the Cisco Umbrella Investigate API to enrich an incident response playbook. Which endpoint should you query to retrieve the security status and associated domains for an IP address?

Accepted Answer

/security/ip/{ip}. The Cisco Umbrella Investigate API endpoint /security/ip/{ip} returns the security status for an IP address, including SEC categories, attack/threat type, and associated domains. The /dnsdb/ip/{ip}/domain endpoint is a passive DNS lookup that returns domains associated with an IP but does not provide the IP's security status. Therefore, to retrieve security status and associated domains, use /security/ip/{ip}.

Answer

/whois/ip/{ip}

Answer

/threat/ip/{ip}

Answer

/dnsdb/ip/{ip}/domain

Question 5

You are automating Cisco Secure Email (ESA) using the Management API. You need to trigger an immediate update of the Anti-Spam engine. Which action is required to ensure the API call succeeds?

Accepted Answer

POST to /api/v1.0/config/engines/update. The Cisco ESA Management API exposes a specific endpoint for triggering engine updates, and the correct action is to POST to /api/v1.0/config/engines/update. This endpoint instructs the appliance to immediately check for and apply the latest Anti-Spam engine definitions. Using POST is required because the operation changes state on the appliance, not merely retrieves information.

Answer

Update the config.xml file via SCP

Answer

Send a GET request to /config/antispam

Answer

Restart the appliance via API

Question 6

When configuring the Cisco Secure Web Appliance (SWA) via the API, which object attribute is critical to ensure that a newly created policy is immediately active upon deployment?

Accepted Answer

enabled: true. The 'enabled' attribute is a boolean field that determines whether a policy is active. When set to true, the policy is immediately applied upon deployment. Other attributes like priority, deployment, or status do not control the activation state; they may affect ordering, deployment method, or reporting, but not the fundamental active/inactive state. Therefore, 'enabled: true' is critical for immediate activation.

Answer

priority: 0

Answer

deployment: 'force'

Answer

status: 'active'

Question 7

When developing an automation script for Cisco Cloudlock, which TWO authentication methods are supported for API access?

Accepted Answer

API Token (Secret Key). Cisco Cloudlock's REST API supports token-based authentication, where an administrator generates an API token (secret key) in the Cloudlock portal and passes it in the Authorization header of API requests. Option C (OAuth2 Client Credentials) is also correct because Cloudlock supports the OAuth 2.0 client credentials grant, allowing automation scripts to exchange a client ID and client secret for an access token used to call the API. Option B (Username/Password) is not supported for Cloudlock API access, as the platform does not authenticate API calls with raw user credentials. Option D (RADIUS/TACACS+) is an AAA protocol for network device access, not an API authentication method. Option E (SSH Public Key) is used for secure shell login to network devices/servers, not for Cloudlock REST API authentication.

Answer

Username/Password

Answer

RADIUS/TACACS+

Answer

SSH Public Key

Question 8

You are automating Cisco Cloudlock incident retrieval for a compliance dashboard. The script must return only incidents with a severity of High and a status of Open, and it must paginate through all results. Which combination of query parameters should the script use?

Accepted Answer

severity=High and status=Open, with limit and offset for pagination. Cloudlock incident retrieval filters by discrete query parameters such as severity and status, and paginates with limit and offset. Passing severity=High and status=Open retrieves the required subset, while iterating offset values ensures every matching incident is collected for the compliance dashboard.

Answer

severity=High and status=Open, using only a limit parameter to cap results at 100

Answer

filter=severity:High AND status:Open, with cursor-based pagination via next_token

Answer

severity=High and state=open, using page and page_size for pagination

Question 9

Which Cisco security product provides an API to automate the management of web proxy policies and access logs?

Accepted Answer

Cisco Secure Web Appliance (WSA). Cisco Secure Web Appliance (WSA) is the secure web gateway that enforces web proxy policies and generates access logs, and it exposes a REST API that allows administrators to automate policy management and retrieve access log data. This makes it the correct product for automating web proxy policy and log operations.

Answer

Cisco Tetration

Answer

Cisco Duo

Answer

Cisco Secure Endpoint

Question 10

You are configuring a Webex CASB integration. To automate the reporting of anomalous file sharing events from a third-party cloud storage service, which API mechanism should you configure to receive real-time updates?

Accepted Answer

Registering a Webhook endpoint. Webhooks are the standard push-based mechanism for receiving real-time event notifications from cloud services. By registering a Webhook endpoint with the third-party cloud storage provider, the service will HTTP POST event payloads (such as anomalous file sharing events) to your listener as they occur, enabling near-instantaneous CASB reporting without polling overhead.

Answer

Direct database query access

Answer

SNMP Traps

Answer

Using an SSH tunnel to the cloud provider

Answer

Polling the REST API every 60 seconds

Question 11

You are developing a script to interact with the Cisco Cloudlock API to identify risky OAuth applications. Which THREE actions are valid when using the Cloudlock REST API to manage application risk?

Accepted Answer

Revoke OAuth tokens for identified risky apps. The Cloudlock REST API is designed for CASB-style visibility and remediation of sanctioned and unsanctioned cloud apps, so option B (revoke OAuth tokens for identified risky apps) is valid because Cloudlock exposes remediation endpoints that let an administrator revoke a user's or app's OAuth grant to cut off risky third-party access. Option C (retrieve risk score for an application) is correct because Cloudlock assigns each discovered application a risk score based on its community/CISO rating and exposes it through API queries so scripts can triage apps programmatically. Option E (list users who have authorized a specific app) is also correct because the API can enumerate the users and OAuth authorizations tied to a given application, which is essential for investigating exposure and scoping remediation. Option A is wrong because DNS filtering policies are managed in Cisco Umbrella's policy API, not the Cloudlock application-risk API, and option D is wrong because global cloud infrastructure firewall rules are not a Cloudlock API function—Cloudlock governs SaaS/app authorization risk, not underlying network firewall configuration.

Answer

Update the Cisco Umbrella DNS filtering policies

Answer

Modify the global cloud infrastructure firewall rules

Question 12

When using the Cisco Secure Email (formerly ESA) AsyncOS API to fetch message tracking data, what is the mandatory header required for authentication?

Accepted Answer

Authorization. The Cisco Secure Email AsyncOS API requires the Authorization header for authentication when fetching message tracking data. This header must contain a valid API token or credentials, typically in the format 'Authorization: Basic ' or 'Authorization: Bearer '. The API uses this header to authenticate and authorize the request, ensuring that only authorized users can access sensitive message tracking information.

Answer

Cookie: session_id

Answer

Bearer-Token

Answer

X-API-Key

Question 13

You are automating policy updates for Cisco Umbrella using the Umbrella Management API. You need to identify the correct endpoint to retrieve the list of destination lists for a specific organization. Which HTTP method and path should you use?

Accepted Answer

GET /v1/organizations/{organizationId}/destinationlists. The Umbrella Management API exposes destination lists as a sub-resource of an organization, so the correct call is GET /v1/organizations/{organizationId}/destinationlists. GET is the HTTP verb used for read/retrieve operations, and the organizationId path parameter scopes the request to the correct tenant. This matches the documented Umbrella API pattern where all org-scoped resources are nested under /v1/organizations/{organizationId}/.

Answer

GET /v1/policies/destinationlists

Answer

POST /v1/organizations/{organizationId}/destinationlists

Answer

PUT /v1/organizations/{organizationId}/destinationlists

Question 14

You are automating the retrieval of threat intelligence logs from Cisco Secure Email Cloud Gateway. Which API interface provides the most efficient way to fetch historical message tracking logs for automated analysis?

Accepted Answer

Reporting API. The Reporting API on Cisco Secure Email Cloud Gateway is purpose-built for retrieving historical message tracking data, including delivered, bounced, and quarantined messages over a time range. It exposes endpoints that query the message tracking database efficiently, making it the correct choice for automated historical log analysis. Other APIs serve different functions such as threat feeds or web security.

Answer

AsyncOS API

Answer

External Threat Feeds API

Answer

Web Security Appliance API

Question 15

You are writing a Python script to interact with the Cisco Secure Web Appliance (WSA) REST API to pull 'Access Logs'. When parsing the response, you notice the data is chunked. What is the most appropriate way to handle large log datasets when using the REST API?

Accepted Answer

Use the 'limit' and 'offset' query parameters to paginate through the log data. When dealing with large log datasets from the WSA REST API, the most appropriate approach is to use the 'limit' and 'offset' query parameters to paginate through the data. This allows you to retrieve manageable chunks, reducing memory usage and avoiding timeouts. The API supports pagination to efficiently handle large volumes of logs.

Answer

Increase the timeout on the HTTP request

Answer

Request the data in XML format instead of JSON

Answer

Switch to the SSH-based CLI API to download the logs