SAUTO Cloud Web And Email Security Automation Practice Test 5 — 15 Questions

Question 1

You are automating the addition of an IP blocklist in Umbrella. You have the IP address and the list ID. Which HTTP method and path is correct?

Accepted Answer

POST /v1/destinationlists/{listId}/destinations. The Umbrella API uses POST to add destinations to an existing destination list. The correct endpoint is /v1/destinationlists/{listId}/destinations, where {listId} is the ID of the target list. POST is the standard HTTP method for creating or appending resources, which matches the action of adding IPs to a blocklist.

Answer

GET /v1/destinationlists/{listId}

Answer

PUT /v1/destinationlists/{listId}/destinations

Answer

PATCH /v1/destinationlists/{listId}

Question 2

When automating Secure Email Gateway tasks, what does a '429' status code indicate?

Accepted Answer

Rate limit exceeded. HTTP 429 means 'Too Many Requests' — the client has exceeded the rate limit imposed by the API. Secure Email Gateway enforces rate limits to protect service availability, so automation must back off and retry after the indicated interval.

Answer

Endpoint not found

Answer

Internal server error

Answer

Invalid API key

Question 3

What is the role of an 'OAuth Bearer Token' in Cisco security automation?

Accepted Answer

Provides temporary authorization for API access. An OAuth Bearer Token provides temporary authorization for API access, typically obtained after authenticating with credentials. It is time-limited and scoped, allowing secure, delegated access without sharing passwords. In Cisco security automation, it's used to authenticate API calls to platforms like FMC, ISE, or Umbrella.

Answer

Replaces the API key permanently

Answer

Encrypts the API traffic

Answer

Defines the user's GUI password

Question 4

You want to automate the download of 'Web Access Logs' from the WSA. You have authorized your session. What is the final step before the download begins?

Accepted Answer

Execute a GET request to the specific log file endpoint. After authorizing the session (obtaining a valid auth token), the final step to download Web Access Logs from the WSA is to issue a GET request to the specific log file endpoint. The WSA log retrieval API uses a two-phase pattern: first authenticate/authorize, then GET the named log file resource. The GET returns the log data (or a redirect to the file), which the script then saves.

Answer

Execute a POST request to the file

Answer

Issue a CLI 'reboot' command

Answer

Run a configuration commit

Question 5

In the context of the Cisco Cloudlock API, what is the significance of the 'app_id' field?

Accepted Answer

It is the unique identifier for an OAuth application. In the Cisco Cloudlock API, the 'app_id' field is the unique identifier for an OAuth application. Cloudlock monitors and secures cloud applications, and each OAuth application (e.g., a third-party app accessing Google Workspace or Microsoft 365) is assigned a distinct 'app_id'. This allows the API to reference and manage specific applications for policy enforcement, risk assessment, and reporting.

Answer

It is the serial number of the appliance

Answer

It is the identifier for the Cloudlock tenant

Answer

It represents the user's role

Question 6

You are writing a script to check for new security policy updates on a Cisco WSA. You notice that your script pulls the same configuration repeatedly. What should you use to check if the policy has changed?

Accepted Answer

ETag or Last-Modified header. HTTP conditional requests using the ETag or Last-Modified header allow a client to ask the server whether the resource has changed since the last retrieval. If the policy has not changed, the server returns HTTP 304 Not Modified with no body, saving bandwidth and processing. This is the standard, efficient way to poll for configuration changes without pulling the full payload every time.

Answer

The 'version' field in the config

Answer

The 'sleep' function

Answer

A full diff of the JSON payload

Question 7

When utilizing the Cisco Secure Email Reporting API, which format is best for programmatic data processing?

Accepted Answer

JSON. JSON is the best format for programmatic data processing because it is structured, machine-parseable, and natively supported by virtually every programming language and automation framework. The Cisco Secure Email Reporting API returns JSON responses that can be directly consumed by scripts, SIEM integrations, or orchestration tools without parsing overhead.

Answer

HTML

Answer

PDF

Answer

Raw binary logs

Question 8

Which Cisco security product should you use if your main goal is to automate the blocking of malicious DNS queries?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the industry-standard cloud solution for DNS-layer security and policy automation.

Answer

Cisco Secure Web Appliance

Answer

Cisco Cloudlock

Answer

Cisco Secure Email

Question 9

You are integrating Cisco Cloudlock with an external SIEM using the Cloudlock API. Which mechanism should you implement to receive real-time security events instead of polling the API repeatedly?

Accepted Answer

Webhook integration. Cisco Cloudlock supports webhook integration as its primary mechanism for real-time event delivery. When a security event occurs (e.g., policy violation, anomalous user behavior), Cloudlock sends an HTTP POST request to a pre-configured endpoint with a JSON payload describing the event. This push model eliminates the need for constant polling, reduces API call overhead, and ensures near-instantaneous notification to external systems like a SIEM. Webhooks are the standard, documented approach for Cloudlock API event streaming.

Answer

WebSocket handshake

Answer

Server-Sent Events (SSE)

Answer

SNMP Traps

Question 10

A script interacting with Cisco Cloudlock is receiving a 429 Too Many Requests error. What should the automation script implement to handle this gracefully?

Accepted Answer

Exponential backoff. Rate limiting (429) requires the implementation of an exponential backoff strategy.

Answer

Increase the timeout duration

Answer

Retry immediately

Answer

Switch to a different API key

Question 11

Which tool is best suited for testing Umbrella API queries before deploying them into your automated production script?

Accepted Answer

Postman. Postman is the best tool for testing Umbrella API queries before embedding them in production scripts because it provides a GUI to construct requests, manage authentication headers, inspect JSON responses, and save/organize collections. It allows rapid iteration on endpoints like /ips/ or /domains/ without writing code, making it ideal for validating API behavior before automation.

Answer

Cisco CLI

Answer

Wireshark

Answer

Telnet

Question 12

You are automating the retrieval of blocked file hashes from Cisco Secure Email (ESA). Which API object provides the most granular view of file-based security events?

Accepted Answer

Message Tracking API. The Message Tracking API in Cisco Secure Email (ESA) provides the most granular, per-message view of mail flow and security events, including details about attachments and file hashes associated with blocked messages. When you need to retrieve blocked file hashes, Message Tracking exposes the message-level metadata (sender, recipient, verdict, attachment SHA-256) that Reporting and System Health APIs do not. This makes it the correct object for file-based security event granularity.

Answer

System Health API

Answer

Reporting API

Answer

Configuration API

Question 13

Which THREE steps are required to automate the update of an Umbrella policy using the Umbrella Management API?

Accepted Answer

Perform a GET request to fetch the current policy configuration. To automate an Umbrella policy update via the Umbrella Management API, you must first perform a GET request to retrieve the current policy configuration (option B), because the API requires the existing policy object and its identifiers to build a valid update payload. Next, you modify the JSON structure to reflect the desired policy changes (option E), adjusting the relevant fields in the retrieved JSON so it represents the new intended state. Finally, you send a PUT request with the updated JSON payload (option C), which replaces the existing policy resource with the modified configuration. A DELETE request before the PUT (option A) is not required and would remove the policy rather than update it, converting the policy to binary (option D) is unnecessary since the API uses JSON, and no other steps beyond GET, modify, and PUT are needed for this automation.

Answer

Send a DELETE request before the PUT request

Answer

Convert the policy into a binary format

Question 14

Which TWO components are required when configuring the Cisco Secure Web Appliance (SWA) to allow API access?

Accepted Answer

Enable 'REST API' in the 'Feature Key' or 'System' settings. Option A is correct because the Cisco Secure Web Appliance (SWA) requires the REST API feature to be enabled in the Feature Key or System settings before any API access is possible; without this license/feature activation, the API endpoints are unavailable. Option B is correct because API access must be authenticated with a dedicated API user account that has the appropriate administrative roles (for example, an admin or operator role with API permissions), since the SWA validates credentials and role-based permissions for every API request. Option C is not required because API access does not depend on configuring a local DNS server; DNS is only needed for name resolution of external services, not for enabling the API itself. Option D is not required because SNMP v3 credentials are used for monitoring via SNMP, not for REST API authentication or access. Option E is not required because IPsec VPN tunneling is a network transport feature and is unrelated to enabling or authenticating API access on the SWA.

Answer

Configure a local DNS server

Answer

SNMP v3 credentials

Answer

Enable IPsec VPN tunneling

Question 15

Which THREE metrics are commonly retrieved from the Cisco Secure Email (ESA) Reporting API to monitor mail flow health?

Accepted Answer

Total incoming messages. The Reporting API provides metrics such as incoming volume, spam rejection rates, and recipient statistics.

Answer

SSH login attempts

Answer

Appliance CPU temperature