SAUTO Cloud Web And Email Security Automation Practice Test 2 — 15 Questions

Question 1

You are integrating Cisco Umbrella with your SIEM using the Umbrella Reporting API. Which authentication mechanism is required to access the Reporting API endpoints?

Accepted Answer

API Key and Secret to obtain a Bearer Token. Umbrella API access requires a set of API keys (Key and Secret) generated in the Umbrella Dashboard, which are then used to obtain an OAuth 2.0 bearer token.

Answer

Username and password in the HTTP header

Answer

Shared pre-shared key (PSK)

Answer

Client certificate-based authentication only

Question 2

You are managing Cisco Cloudlock settings via the API. You need to ensure that specific SaaS file-sharing events are flagged. Which API object must you target to define a new policy violation trigger?

Accepted Answer

Policies API. The Cloudlock API uses the 'Policies' endpoint to create or modify triggers that flag specific SaaS events.

Answer

Configuration API

Answer

Audit API

Answer

Applications API

Answer

Users API

Question 3

You are automating the quarantine of emails in Cisco Secure Email (formerly IronPort). Which API interaction is required to trigger a move of a specific message ID into the quarantine?

Accepted Answer

POST /msg/action with the 'quarantine' command and MID. The Secure Email Message Tracking API allows you to perform actions on specific messages, including 'quarantine' via a POST request to the message action endpoint.

Answer

DELETE /msg/{mid}

Answer

GET /msg/quarantine?mid={id}

Answer

PUT /policy/quarantine/{mid}

Question 4

Which Cisco security product uses the 'AsyncOS' platform, and for which automation tasks is its API most commonly used?

Accepted Answer

Cisco Secure Email and Web Appliances; configuration and monitoring. Cisco Secure Email and Secure Web appliances run on AsyncOS and use the AsyncOS API for reporting, configuration, and monitoring.

Answer

Cisco Cloudlock; SaaS file inspection

Answer

Cisco Umbrella; DNS filtering policies

Answer

Cisco Firepower; firewall rule orchestration

Question 5

When automating the deployment of Cisco Umbrella virtual appliances (VAs) using APIs, what is the primary prerequisite that must be configured in the dashboard?

Accepted Answer

Register the VAs in the Umbrella Dashboard. Before VAs can be managed or reported on via API, they must be registered in the Cisco Umbrella Dashboard under 'Deployments' > 'Core Identities' > 'Virtual Appliances'.

Answer

Install the Umbrella Connector on a local server

Answer

Enable the 'Legacy' API mode

Answer

Create a dedicated API user account

Question 6

You are automating Cisco Umbrella policy changes. You wish to update an existing policy to use a new 'Content Settings' object. Which HTTP header is required in your request to ensure the update follows optimistic concurrency control?

Accepted Answer

If-Match. The Umbrella API uses the 'If-Match' header containing an ETag to ensure that the object being updated has not changed since it was last read (optimistic locking).

Answer

Authorization

Answer

X-Transaction-ID

Answer

Content-Type

Question 7

You are using the Cloudlock API to fetch 'Application' data. You receive a response with a 'next_page' token. What does this indicate about the API behavior?

Accepted Answer

The response is paginated and you must follow the link to get more records. The Cloudlock API utilizes cursor-based pagination for large data sets, where the 'next_page' token provides the reference to the subsequent result set.

Answer

The requested data format is invalid

Answer

The application data is currently being updated

Answer

The API request failed due to rate limiting

Question 8

Which of the following is a key advantage of using the Cisco Secure Email 'AsyncOS' API over manual CLI configuration for mass blocklist updates?

Accepted Answer

It enables programmatic and repeatable updates across multiple appliances. The AsyncOS API allows for programmatic, idempotent updates, which reduces human error and ensures consistency across multiple appliances.

Answer

It allows direct access to the underlying OS kernel

Answer

It provides faster packet-level filtering

Answer

It bypasses the need for authentication

Question 9

When automating the deletion of Cisco Umbrella 'Destination Lists' via API, what happens to the policies currently associated with that list?

Accepted Answer

Policies referencing the list will lose the associated rule. When a destination list is deleted, any policies referencing that list will lose the associated destination blocking rule, effectively removing that specific block or allow rule from the policy.

Answer

The policies will automatically default to 'Allow All'

Answer

The policies are automatically deleted to maintain integrity

Answer

The API will return an error and prevent deletion

Question 10

You need to retrieve the current status of all Cisco Umbrella 'Virtual Appliances' using the API. Which API resource is the most appropriate?

Accepted Answer

Virtual Appliances endpoint. The 'Virtual Appliances' endpoint in the Umbrella API specifically provides status and heartbeat information for registered VAs.

Answer

Networks endpoint

Answer

Policies endpoint

Answer

Roaming Computers endpoint

Question 11

When automating a Cisco Secure Web Appliance (WSA) task, you need to trigger a 'policy push'. Which API component allows you to initiate this?

Accepted Answer

Configuration Commit API. The WSA configuration API provides a 'commit' or 'push' endpoint to apply staged changes to the active configuration.

Answer

Rule Enforcement API

Answer

Device Sync API

Answer

Policy Push API

Question 12

You are writing a script to update Cisco Secure Email (ESA) configuration. You need to push a new 'Content Filter' rule. Why is it recommended to perform a 'Get' request before the 'Put' request?

Accepted Answer

To preserve existing configuration attributes not being modified. Performing a GET before a PUT allows the script to preserve existing configuration attributes that are not being modified, preventing accidental erasure of other fields.

Answer

To lock the configuration database

Answer

To verify the user has write permissions

Answer

To check if the API is responsive

Question 13

In the context of Cisco Umbrella, what is the primary difference between the 'Management' API and the 'Reporting' API?

Accepted Answer

Management for configuration, Reporting for log data. The Management API is used for configuration (policies, lists), while the Reporting API is used to extract log data and security events.

Answer

Management is for cloud, Reporting is for on-premise

Answer

Management for logs, Reporting for configuration

Answer

There is no difference; they share the same endpoints

Question 14

You are developing a script to pull alerts from Cisco Cloudlock. You want to filter for 'High Severity' incidents only. Which parameter should you include in your API call?

Accepted Answer

severity=high. The Cloudlock API supports filtering incident logs via query parameters like 'severity_level' or 'severity'.

Answer

filter='High'

Answer

limit=high

Answer

status='critical'

Question 15

You are automating the extraction of SaaS security incidents from Cloudlock. You observe that incidents are being missed by your script. What is the most likely cause if your script is calling the API every 60 seconds?

Accepted Answer

The script is not using a 'start_time' parameter to track the last retrieved event. The Cloudlock API may have rate limits or specific event ingestion windows; if the script is not handling pagination or 'since' timestamps correctly, data might be skipped.

Answer

The incidents have been deleted by the user

Answer

The API is offline

Answer

The script uses POST instead of GET