SAUTO Cloud Web And Email Security Automation Practice Test 5 — 15 Questions

Question 1

Which Cisco security product should you use if your main goal is to automate the blocking of malicious DNS queries?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the industry-standard cloud solution for DNS-layer security and policy automation.

Answer

Cisco Secure Web Appliance

Answer

Cisco Cloudlock

Answer

Cisco Secure Email

Question 2

You are automating Cisco Umbrella reporting using the Reporting API. You need to pull threat activity logs for a specific destination. Which request header is mandatory to include in your HTTP GET call to authorize the request?

Accepted Answer

Authorization: Bearer <TOKEN>. Cisco Umbrella Reporting API uses a Bearer token in the Authorization header for API authentication.

Answer

X-API-KEY

Answer

Cookie: session_id

Answer

X-Auth-Token

Question 3

You are integrating Cisco Cloudlock with an external SIEM using the Cloudlock API. Which mechanism should you implement to receive real-time security events instead of polling the API repeatedly?

Accepted Answer

Webhook integration. Cloudlock supports Webhooks, which allow the system to push events to a configured URL endpoint.

Answer

WebSocket handshake

Answer

Server-Sent Events (SSE)

Answer

SNMP Traps

Question 4

When automating the Cisco Secure Email (ESA) configuration via the API, which file format is required to import a new set of content filters?

Accepted Answer

XML. Cisco Secure Email uses XML for configuration exports and imports via the API.

Answer

CSV

Answer

YAML

Answer

JSON

Question 5

You are using the Cisco Umbrella Investigate API to enrich an incident response playbook. Which endpoint should you query to retrieve the security status and associated domains for an IP address?

Accepted Answer

/dnsdb/ip/{ip}/domain. The Investigate API provides specific endpoints for IP reputation and related domains.

Answer

/whois/ip/{ip}

Answer

/threat/ip/{ip}

Answer

/security/ip/{ip}

Question 6

You are automating Cisco Secure Email (ESA) using the Management API. You need to trigger an immediate update of the Anti-Spam engine. Which action is required to ensure the API call succeeds?

Accepted Answer

POST to /api/v1.0/config/engines/update. The update mechanism in the ESA Management API requires authenticated administrative access and the correct POST trigger to the engine-update resource.

Answer

Update the config.xml file via SCP

Answer

Send a GET request to /config/antispam

Answer

Restart the appliance via API

Question 7

When configuring the Cisco Secure Web Appliance (SWA) via the API, which object attribute is critical to ensure that a newly created policy is immediately active upon deployment?

Accepted Answer

enabled: true. The 'enabled' boolean flag must be set to true in the object JSON payload.

Answer

priority: 0

Answer

deployment: 'force'

Answer

status: 'active'

Question 8

A script interacting with Cisco Cloudlock is receiving a 429 Too Many Requests error. What should the automation script implement to handle this gracefully?

Accepted Answer

Exponential backoff. Rate limiting (429) requires the implementation of an exponential backoff strategy.

Answer

Increase the timeout duration

Answer

Retry immediately

Answer

Switch to a different API key

Question 9

Which tool is best suited for testing Umbrella API queries before deploying them into your automated production script?

Accepted Answer

Postman. Postman is the industry-standard tool for testing REST API requests and viewing JSON responses.

Answer

Cisco CLI

Answer

Wireshark

Answer

Telnet

Question 10

You are automating the retrieval of blocked file hashes from Cisco Secure Email (ESA). Which API object provides the most granular view of file-based security events?

Accepted Answer

Message Tracking API. The Message Tracking API provides the most detailed logs regarding individual file attachments and their disposition.

Answer

System Health API

Answer

Reporting API

Answer

Configuration API

Question 11

When developing an automation script for Cisco Cloudlock, which TWO authentication methods are supported for API access?

Accepted Answer

API Token (Secret Key). Cloudlock primarily uses OAuth2 Client Credentials and API Tokens for programmatic access.

Answer

Username/Password

Answer

RADIUS/TACACS+

Answer

SSH Public Key

Question 12

Which THREE steps are required to automate the update of an Umbrella policy using the Umbrella Management API?

Accepted Answer

Perform a GET request to fetch the current policy configuration. Updating a policy involves retrieving the current configuration, modifying the JSON, and performing a PUT operation.

Answer

Send a DELETE request before the PUT request

Answer

Convert the policy into a binary format

Question 13

Which TWO components are required when configuring the Cisco Secure Web Appliance (SWA) to allow API access?

Accepted Answer

Enable 'REST API' in the 'Feature Key' or 'System' settings. You must enable the API feature and define an API user with appropriate permissions.

Answer

Configure a local DNS server

Answer

SNMP v3 credentials

Answer

Enable IPsec VPN tunneling

Question 14

Which THREE metrics are commonly retrieved from the Cisco Secure Email (ESA) Reporting API to monitor mail flow health?

Accepted Answer

Total incoming messages. The Reporting API provides metrics such as incoming volume, spam rejection rates, and recipient statistics.

Answer

SSH login attempts

Answer

Appliance CPU temperature

Question 15

When automating the integration between Cisco Cloudlock and a third-party platform, which TWO data types are typically fetched via the Cloudlock API?

Accepted Answer

Incident details. Cloudlock APIs are commonly used to pull incident data and policy violation reports.

Answer

User password hashes

Answer

Appliance firmware images

Answer

Network interface statistics