SAUTO Multiple Select — 20 Questions

Question 1

Which TWO components are required when configuring the Cisco Secure Web Appliance (SWA) to allow API access?

Accepted Answer

Enable 'REST API' in the 'Feature Key' or 'System' settings. Option A is correct because the Cisco Secure Web Appliance (SWA) requires the REST API feature to be enabled in the Feature Key or System settings before any API access is possible; without this license/feature activation, the API endpoints are unavailable. Option B is correct because API access must be authenticated with a dedicated API user account that has the appropriate administrative roles (for example, an admin or operator role with API permissions), since the SWA validates credentials and role-based permissions for every API request. Option C is not required because API access does not depend on configuring a local DNS server; DNS is only needed for name resolution of external services, not for enabling the API itself. Option D is not required because SNMP v3 credentials are used for monitoring via SNMP, not for REST API authentication or access. Option E is not required because IPsec VPN tunneling is a network transport feature and is unrelated to enabling or authenticating API access on the SWA.

Answer

Configure a local DNS server

Answer

SNMP v3 credentials

Answer

Enable IPsec VPN tunneling

Question 2

Which TWO statements accurately describe the behavior of the NETCONF 'candidate' data store?

Accepted Answer

The candidate store can be discarded if the proposed changes are incorrect.. Option A is correct because the NETCONF candidate datastore is a scratchpad where configuration changes can be staged and then thrown away with the operation if the proposed edits are wrong, leaving the running configuration untouched. Option E is correct because the candidate datastore is not active until the client issues a operation, which copies the candidate configuration into the running datastore so it takes effect on the device. Option B is wrong because NETCONF candidate edits are serialized under a lock (candidate lock or partial lock); concurrent edits are not automatically merged, and a second user must wait or use separate candidate instances. Option C is wrong because changes in the candidate store are not immediately active — they only become active after a successful commit to the running store. Option D is wrong because XML encoding is the standard NETCONF encoding for all datastores (running, candidate, startup), not a feature unique to the candidate store.

Answer

The candidate store supports multiple users making concurrent edits that are merged.

Answer

Changes applied to the candidate store are immediately active on the device.

Answer

The candidate store is the only store that supports XML encoding.

Question 3

Which TWO of the following are types of Cisco Security API documentation? (Choose two)

Accepted Answer

Swagger/OpenAPI specifications. Option A (Swagger/OpenAPI specifications) is correct because Cisco Security APIs publish machine-readable interface definitions in Swagger 2.0 or OpenAPI 3.0 format, which document endpoints, HTTP methods, parameters, authentication schemes, and response schemas for programmatic consumption. Option B (Developer portal HTML/web docs) is correct because Cisco hosts human-readable API reference documentation on developer portals such as developer.cisco.com, providing guides, endpoint descriptions, and code samples in HTML/web form. Option C is incorrect because physical paper manuals are not a recognized API documentation type for Cisco Security APIs. Option D is incorrect because Cisco does not distribute API source code as a documentation format. Option E is incorrect because voice-recorded tutorials are not a standard API documentation type.

Answer

Physical manuals printed on paper

Answer

Direct source code distribution

Answer

Voice-recorded tutorials

Question 4

Which THREE of the following are true about the Cisco Umbrella API?

Accepted Answer

It requires an API Key and Secret. Option A is correct because the Cisco Umbrella API authenticates requests using an API Key and Secret, which are generated in the Umbrella dashboard and used to obtain an OAuth 2.0 token for API calls. Option B is correct because the Umbrella API follows REST principles, using standard HTTP methods (GET, POST, PUT, DELETE) and JSON-formatted requests and responses over HTTPS. Option E is correct because the Umbrella API provides both management capabilities (such as configuring policies, networks, and identities) and reporting capabilities (such as retrieving security activity and traffic reports). Option C is incorrect because the Umbrella API is available across multiple Umbrella packages and account types, not exclusively Enterprise accounts. Option D is incorrect because the Umbrella API is REST-based, not SOAP-based.

Answer

It is only available for Enterprise accounts

Answer

It is SOAP-based

Question 5

Which THREE components are required to configure an API client for Cisco SecureX?

Accepted Answer

API Scope. To configure an API client for Cisco SecureX, you must supply the OAuth 2.0 credentials that SecureX generates when the client is created: the Client ID (E), which uniquely identifies the API client, the Client Secret (D), which authenticates that client, and the API Scope (C), which defines the specific permissions or resources the client may access. These three values are used together in the token request to obtain an access token for calling SecureX APIs. A Device Serial Number (A) is not part of API client authentication; it is hardware-identifying information used for device licensing and support, not for OAuth client credentials. A User Password (B) is likewise not required, because SecureX API clients authenticate with the generated client credentials rather than a user's account password.

Answer

Device Serial Number

Answer

User Password

Question 6

Which THREE of the following are core principles of Secure Network Design when using APIs?

Accepted Answer

Principle of Least Privilege. Option A (Principle of Least Privilege) is correct because secure API design requires that each API consumer, service account, or token be granted only the minimum scopes, roles, and permissions needed to perform its function, limiting the blast radius of a compromised credential. Option B (Use of TLS for all API communication) is correct because APIs frequently carry authentication tokens, session data, and sensitive payloads, so transport encryption via TLS (ideally TLS 1.2/1.3 with strong cipher suites) prevents eavesdropping and man-in-the-middle interception. Option C (Audit logging for all API transactions) is correct because recording who called which endpoint, when, from where, and with what result provides the traceability needed for intrusion detection, incident response, and compliance. Option D is not a core secure design principle because exposing all API endpoints directly to the public internet unnecessarily enlarges the attack surface; secure designs use gateways, WAFs, private endpoints, or network segmentation instead. Option E is not a secure principle because default vendor API credentials are widely known and must be changed or rotated immediately; relying on them invites unauthorized access.

Answer

Public internet exposure of all API endpoints

Answer

Use of default vendor API credentials

Question 7

Which THREE of the following are essential components of a REST API request for a Cisco security product?

Accepted Answer

HTTP Method (e.g., GET, POST, PUT, DELETE).. Option B is correct because every REST API request must specify an HTTP method such as GET, POST, PUT, or DELETE, which defines the action to perform on the target resource. Option D is correct because the URI (Uniform Resource Identifier) is required to identify the specific resource being accessed, such as an endpoint on a Cisco Firepower or ISE API. Option E is correct because REST requests typically require headers to carry authentication credentials (e.g., an API token or Basic Auth) and to specify the data format via Content-Type or Accept headers. Option A is incorrect because REST APIs use dynamically constructed JSON or XML payloads sent in the request body, not a predefined XML file saved on the desktop. Option C is incorrect because REST APIs operate over HTTP/HTTPS network connections, not through a physical serial console cable.

Answer

A predefined XML configuration file saved on the desktop.

Answer

A physical serial console cable connection.

Question 8

Which THREE features are provided by the Cisco SecureX API documentation?

Accepted Answer

Request examples. The Cisco SecureX API documentation is designed to let developers integrate with SecureX services, so it includes request examples (A) that show exactly how to format calls to the API, including HTTP methods, URLs, headers, and sample payloads. It also provides schema definitions (B), which describe the data models and structures of request and response bodies so developers know the expected fields and types. Endpoint definitions (D) are likewise included, listing the available API endpoints and their operations so consumers know which URLs to call for each function. Pricing information (C) is a commercial/billing matter and is not part of API reference documentation, and hardware installation guides (E) are physical deployment documents unrelated to the SecureX API documentation.

Answer

Pricing information

Answer

Hardware installation guides

Question 9

Which THREE of the following are common JSON data types?

Accepted Answer

number. JSON (JavaScript Object Notation, defined by RFC 8259) supports a fixed set of value types, and option A (number) is one of them: JSON numbers are written as decimal literals such as 42, -3.14, or 1.5e10, with no distinction between integers and floats. Option B (string) is correct because JSON strings are sequences of Unicode characters enclosed in double quotes, using backslash escapes like 
 and \uXXXX. Option D (boolean) is correct because JSON defines the literal values true and false as a native boolean type. The unmarked options do not belong: option C (class) is an object-oriented construct, not a JSON type — JSON only has objects (unordered key/value collections), not classes — and option E (pointer) is a memory-address concept from languages like C/C++, with no representation in the JSON specification.

Answer

class

Answer

pointer

Question 10

Which THREE of the following are best practices for managing API keys? (Choose three)

Accepted Answer

Rotate keys regularly. Option A (Rotate keys regularly) is correct because periodic rotation limits the window of exposure if a key is leaked or compromised, and it supports compliance requirements such as those in PCI DSS and NIST guidelines. Option B (Use least privilege access for keys) is correct because scoping each key to only the permissions and resources it needs reduces the blast radius of a compromised key, following the principle of least privilege. Option C (Never hardcode keys in scripts) is correct because hardcoded keys end up in source control, logs, and build artifacts, where they are easily exposed; instead, keys should be stored in a secrets manager or injected via environment variables at runtime. Option D is wrong because reusing one key across every project violates least privilege and isolation, so a single leak compromises all projects and makes auditing impossible. Option E is wrong because email is unencrypted in transit and at rest on many servers, so sharing keys that way exposes them to interception and unauthorized access; keys should be distributed through a secure secrets management system.

Answer

Use the same key for every project

Answer

Share keys via email with the team

Question 11

Which TWO of the following are true regarding the use of the Python 'requests' library?

Accepted Answer

It can automatically serialize dictionaries to JSON via the json parameter.. Option B is correct because requests accepts a json= keyword argument on methods such as post(), put(), and patch(), which serializes a Python dictionary to a JSON body and automatically sets the Content-Type header to application/json. Option C is correct because the library's core purpose is to provide a high-level, human-friendly API for HTTP, exposing convenience methods like requests.get(), requests.post(), requests.put(), and requests.delete() that wrap urllib3 under the hood. Option A is not correct because requests is built on urllib3 and supports connection pooling and keep-alive, and while the base API is synchronous, it is not limited to a single execution model in the sense implied. Option D is not correct because requests manages connection pooling automatically via HTTPAdapter and urllib3's PoolManager, so manual pool management is not required. Option E is not correct because requests supports Python 3.x (and historically 2.7), not exclusively Python 2.7.

Answer

It only supports the synchronous execution model.

Answer

It requires manual management of connection pools.

Answer

It is only compatible with Python 2.7.

Question 12

A security automation engineer is designing a Python script that interacts with multiple Cisco security appliances' REST APIs. The script must handle HTTP errors gracefully and implement retry logic for transient failures. Which two practices should be followed to ensure robust error handling? (Choose two.)

Accepted Answer

Use the raise_for_status() method on the response object to automatically raise an exception for HTTP error codes.. Using raise_for_status() and catching RequestException are two best practices for robust error handling with the requests library. raise_for_status() triggers exceptions on HTTP errors, and catching RequestException handles all request-related exceptions. These practices ensure that errors are detected and managed, allowing for retries or graceful degradation.

Answer

Use the Response.status_code attribute to manually check for specific error codes and implement custom retry logic.

Answer

Ignore HTTP 500 errors because they are server-side issues and will resolve on their own.

Answer

Set a very high timeout value to avoid timeouts and ensure requests always complete.

Question 13

You are automating the deployment of Cisco Umbrella Roaming Client to a large number of remote Windows endpoints using a configuration management tool. To ensure the client registers correctly and enforces policies, you need to provide the necessary parameters during silent installation. Which two parameters are required for a successful silent installation of the Cisco Umbrella Roaming Client? (Choose two.)

Accepted Answer

Organization ID. For a successful silent installation of the Cisco Umbrella Roaming Client, you must provide the Organization ID and the registration token. These parameters allow the client to authenticate and register with your Umbrella organization, enabling policy enforcement. Other settings, such as proxy configuration or user email, are optional and can be managed post-installation or via other means.

Answer

Proxy Server Address

Answer

User Email Address

Answer

DNS Server IP

Question 14

When working with YANG data models in Cisco security automation, which TWO statements accurately describe the role of the 'leaf' and 'leaf-list' nodes?

Accepted Answer

A 'leaf-list' node allows for multiple instances of a specific value type.. A 'leaf' contains a single value, while a 'leaf-list' contains a sequence of values of a specific type.

Answer

A 'leaf' node can contain child nodes.

Answer

Both 'leaf' and 'leaf-list' support default values.

Answer

A 'leaf-list' node is used for hierarchical grouping.

Question 15

Which THREE of the following fields are commonly found in a JSON API response object? (Choose three)

Accepted Answer

Meta/Pagination info. Option A (Meta/Pagination info) is correct because JSON API responses commonly include a meta object carrying pagination details such as total count, page number, page size, and next/previous links, which clients use to navigate large result sets. Option B (Status code/Message) is correct because responses typically embed a status indicator and human-readable message (e.g., "status": "success" or an error message) so the client can interpret the outcome independently of the HTTP status line. Option D (Data field (payload)) is correct because the data field is the core container holding the requested resource or collection, such as "data": [...] or "data": {...}, and is the primary content the API returns. Option C (System BIOS version) does not belong because BIOS version is hardware/firmware metadata unrelated to an API response schema. Option E (Physical location of the server) does not belong because a server's physical location is infrastructure information and is not a standard field in JSON API response objects.

Answer

System BIOS version

Answer

Physical location of the server

Question 16

You are configuring a SecureX workflow to notify a team. Which THREE notification methods are available via standard activities?

Accepted Answer

Webex. The three standard notification activities in SecureX workflows are Webex (C), PagerDuty (D), and Email (E). Webex (C) is correct because SecureX provides a native Webex Teams activity that posts messages to a room or space, allowing teams to receive workflow alerts directly in their collaboration workspace. PagerDuty (D) is correct because SecureX includes a PagerDuty activity that triggers incidents through the PagerDuty API, enabling on-call escalation and alerting for operations teams. Email (E) is correct because SecureX offers a built-in Send Email activity that delivers notifications via SMTP to specified recipients. Voice call (A) and SMS (B) are not standard SecureX workflow activities; while third-party integrations or custom HTTP requests could theoretically reach telephony or SMS gateways, they are not available as out-of-the-box notification activities.

Answer

Voice call

Answer

SMS

Question 17

Which TWO of the following are characteristics of the Cisco ISE ERS API? (Choose two)

Accepted Answer

It supports CRUD (Create, Read, Update, Delete) operations. Option B is correct because the Cisco ISE External RESTful Services (ERS) API is designed to let administrators programmatically perform Create, Read, Update, and Delete (CRUD) operations against ISE resources such as endpoints, identity groups, and network devices. Option E is correct because ERS is built on RESTful principles, using standard HTTP methods (GET, POST, PUT, DELETE) over HTTPS with XML or JSON payloads to interact with ISE. Option A is incorrect because ERS uses standard HTTP/HTTPS rather than a proprietary binary protocol. Option C is incorrect because ERS is an API for programmatic access, not a CLI interface. Option D is incorrect because ERS works with ISE deployments including virtual appliances, not only physical appliances.

Answer

It requires a proprietary binary protocol

Answer

It is purely for CLI access

Answer

It only works with physical appliances

Question 18

Which THREE of the following are true about Cisco API rate limiting?

Accepted Answer

Headers may include quota information. Option A is correct because Cisco API responses commonly return rate-limit headers such as X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset, which expose quota information to the client. Option D is correct because rate limiting protects backend API infrastructure from being overwhelmed, thereby ensuring service stability and fair resource allocation across consumers. Option E is correct because exceeding the allowed request rate typically triggers an HTTP 429 'Too Many Requests' response, often accompanied by a Retry-After header. Option B is incorrect because rate limiting applies to all HTTP methods, including POST, PUT, PATCH, and DELETE, not just GET. Option C is incorrect because rate limiting normally throttles or temporarily blocks requests rather than permanently banning the account.

Answer

It is only applicable to GET requests

Answer

It always results in the account being banned

Question 19

Which THREE of the following are common benefits of using NETCONF for device management?

Accepted Answer

Structured data format (XML). NETCONF is a standardized network management protocol that uses XML-encoded messages, so option A is correct because its structured XML data format enables machine-readable, schema-validated configuration and state data that is easy to parse and automate. Option C is correct because NETCONF supports transaction-based configuration commits, allowing changes to be applied atomically with commit, confirm-commit, and rollback capabilities so a failed change does not leave the device in a partial state. Option D is correct because NETCONF logically separates datastores such as running, candidate, startup, and intended, which lets operators stage, validate, and roll back configurations independently of the active running configuration. Option B is not a NETCONF benefit because NETCONF is a programmatic protocol and does not provide native GUI rendering, and option E is unrelated since NETCONF is designed for configuration and state management, not real-time video streaming.

Answer

Native GUI rendering

Answer

Real-time video streaming support

Question 20

Which THREE of the following are common issues encountered when automating Cisco Security APIs? (Choose three)

Accepted Answer

Incorrect URL endpoints or API versioning. Option B is correct because Cisco Security APIs (e.g., Cisco Firepower, Umbrella, ISE, and SecureX) expose versioned REST endpoints, and automation scripts frequently fail when they hard-code an outdated path such as /v1/ instead of the current /v2/ or when they target the wrong base URL for a given tenant or region. Option C is correct because Cisco Security API gateways enforce rate limits (for example, Umbrella enforces per-organization request quotas and Firepower Management Center enforces concurrent API call limits), so automation that polls too aggressively receives HTTP 429 Too Many Requests responses and must implement backoff/retry logic. Option D is correct because Cisco Security APIs rely on OAuth 2.0 bearer tokens or API keys that expire after a set lifetime, so long-running automation fails with HTTP 401 Unauthorized unless it refreshes tokens or rotates credentials. Option A is not a software/API automation concern at all, since power supply compatibility is a hardware issue unrelated to REST calls. Option E is likewise irrelevant, as Ethernet cable color has no bearing on API authentication, endpoint routing, or rate limiting.

Answer

Incompatible physical power supply

Answer

Wrong color of Ethernet cables