SAUTO Network Programmability Foundation — 40 Questions

Question 1

You are parsing a complex JSON response from a Cisco ASA API call using the json.loads() method in Python. The response contains a nested list of access control entries. Which method is most efficient to extract all 'destination_ip' fields from every entry in the list?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A list comprehension: [item['destination_ip'] for item in response['data']]. A list comprehension is the most efficient and Pythonic way to extract a specific field from every dictionary in a list, as it avoids the overhead of repeated method calls and explicit loop management. It directly iterates over response['data'] and pulls item['destination_ip'] in a single expression, which is both concise and fast.

Answer

Iterating through the dictionary using dict.values().

Answer

A nested for loop with a list.append() call.

Answer

Using the json.find() method.

Question 2

You are developing a NETCONF client to modify the configuration of a Cisco IOS-XE device. You have sent an <edit-config> operation. What must you include in your message to ensure the changes are committed only if the validation succeeds, using the confirmed-commit capability?

Accepted Answer

. To use confirmed-commit, the client must include the tag within the operation or during the process depending on the implementation sequence, but specifically, it is a parameter of the RPC.

Answer

<commit-check/>

Answer

Answer

Question 3

You are testing a Cisco FMC REST API endpoint using Postman. Which TWO of the following configurations are mandatory to successfully authenticate and receive a 200 OK response?

Accepted Answer

Setting the 'X-Auth-Access-Token' header with a valid token.. Option B is correct because the Cisco FMC REST API requires authentication via the X-Auth-Access-Token header, which carries the token obtained from the /api/fmc_platform/v1/auth/generatetoken endpoint; without this header the API returns 401 Unauthorized rather than 200 OK. Option D is correct because FMC REST API requests must declare Content-Type: application/json so the server parses the JSON payload correctly and returns a 200 OK response. Option A is not correct because FMC does not use HTTP Basic Auth for its REST API authentication. Option C is not correct because session cookies are not the supported authentication mechanism for FMC REST API calls. Option E is not correct because disabling SSL certificate verification is a troubleshooting workaround, not a mandatory configuration for a successful 200 OK response.

Answer

Using Basic Auth in the Postman Auth tab.

Answer

Adding a 'Cookie' header with session ID.

Answer

Disabling SSL certificate verification.

Question 4

A network engineer is using the 'requests' library in Python to perform a POST operation to a Cisco FMC API. Which parameter is used to send data in the body of the HTTP request?

Accepted Answer

json. In the Python requests library, the json parameter serializes a Python dictionary to JSON and sends it as the request body with Content-Type application/json. This is the correct way to send structured data in a POST to the Cisco FMC API, which expects JSON payloads.

Answer

headers

Answer

params

Answer

data

Question 5

When interacting with the Cisco Firepower API, which authentication mechanism is typically required to obtain an access token?

Accepted Answer

Basic Auth to the /api/fmc_platform/v1/auth/generatetoken endpoint. Cisco FMC APIs typically require an API key or username/password to generate an access token via an authentication endpoint.

Answer

SNMPv3 User/Password

Answer

OAuth2 Authorization Code Flow

Answer

SSH Key Exchange

Question 6

In Postman, which feature allows you to automate a sequence of API calls and validate the output of each?

Accepted Answer

Tests. Postman's Tests feature lets you write JavaScript assertions (using the pm.test / pm.expect API) that run automatically after each request in a collection. By chaining requests in a Collection and adding Tests scripts, you can validate status codes, response bodies, headers, and extract variables for the next call, effectively automating a multi-step API workflow. This is the mechanism specifically designed for validating each response as part of an automated sequence.

Answer

Environments

Answer

Mock Servers

Answer

Collections

Question 7

In the context of NETCONF, which capability allows a client to explicitly lock the datastore to prevent other users from making changes?

Accepted Answer

urn:ietf:params:netconf:capability:candidate:1.0. The :candidate capability allows the use of the <lock> operation to ensure exclusive configuration access.

Answer

urn:ietf:params:netconf:capability:rollback

Answer

urn:ietf:params:netconf:capability:exclusive-access

Answer

urn:ietf:params:netconf:capability:write-only

Question 8

Which TWO of the following are valid datastores used in the NETCONF protocol?

Accepted Answer

running. In NETCONF (RFC 6241), the element identifies configuration stores, and the two mandatory baseline datastores are the running configuration (option B) and the candidate configuration (option D). The running datastore holds the device's currently active configuration, while the candidate datastore is a writable scratchpad that can be edited and then committed to running via , making both valid NETCONF datastores. The other options are not NETCONF datastores: 'buffer' (A) is not a defined NETCONF datastore, 'temporary' (C) is not a standard NETCONF datastore name, and 'active' (E) is not a NETCONF datastore (it is terminology used in other contexts, such as Junos, but not a NETCONF datastore).

Answer

buffer

Answer

temporary

Answer

active

Question 9

Which THREE of the following are considered best practices for securing API-based automation?

Accepted Answer

Rotating API keys and secrets regularly. Option A is correct because regularly rotating API keys and secrets limits the blast radius if a credential is leaked or compromised, ensuring that stolen keys expire and become useless to an attacker. Option C is correct because implementing rate limiting on the client side helps prevent runaway automation loops and reduces the risk of accidental denial-of-service or credential-stuffing abuse originating from the client. Option E is correct because using HTTPS (TLS) for all API communication encrypts credentials and data in transit, protecting against eavesdropping, man-in-the-middle attacks, and token theft. Option B is not a best practice because allowing unrestricted access to the API port exposes the service to unauthorized scanning and exploitation; access should be restricted via firewalls, security groups, or allowlists. Option D is not a best practice because hardcoding API credentials in scripts embeds secrets in source code and version control, making them easy to leak; secrets should be stored in a vault or environment variables instead.

Answer

Allowing unrestricted access to the API port

Answer

Hardcoding API credentials in scripts

Question 10

Which TWO of the following are true regarding the NETCONF <rpc-reply> message?

Accepted Answer

It must contain an element for a successful operation. Option B is correct because, in NETCONF (RFC 6241), when an operation completes successfully and produces no data output, the server responds with an containing an empty element to signal success. Option C is correct because if the requested operation fails, the server includes one or more elements inside the , each carrying details such as error-type, error-tag, error-severity, and error-message. Option A is wrong because the is sent by the server to the client, not the reverse (the client sends ). Option D is wrong because the is mandatory: every message must be answered with exactly one . Option E is wrong because NETCONF is an XML-based protocol that does not use HTTP status codes; success or failure is conveyed via or elements.

Answer

It is sent by the client to the server

Answer

It is optional in the NETCONF protocol

Answer

It always returns a 200 OK status code

Question 11

Which TWO of the following are valid uses of the Python 'json' module?

Accepted Answer

Parsing a JSON string into a Python dictionary. Option A is correct because json.loads() deserializes a JSON-formatted string into native Python objects such as a dict, which is the module's core parsing function. Option C is correct because json.dumps() serializes a Python object like a dict into a JSON-formatted string, the module's core encoding function. The json module is strictly a JSON encoder/decoder and provides no networking or database capabilities, so B (remote SSH sessions) belongs to libraries like paramiko, D (SQL queries) requires a DB-API driver such as sqlite3 or psycopg2, and E (XML schema validation) is handled by xmlschema or lxml, not json.

Answer

Managing remote SSH sessions

Answer

Directly executing SQL queries

Answer

Validating XML schema definitions

Question 12

You are using the Cisco DNA Center API to manage security policies. You need to verify that a task has successfully completed after submitting a POST request. Which field should you monitor in the response body?

Accepted Answer

taskId. When you submit an asynchronous POST request to Cisco DNA Center, the response includes a taskId that identifies the background job created to process the request. You must monitor this taskId by polling the task endpoint (e.g., /dna/intent/api/v1/task/{taskId}) until the task status indicates success or failure. The taskId is the key field for tracking completion of the operation.

Answer

id

Answer

executionTime

Answer

status

Question 13

You are debugging a NETCONF session to a Cisco device. The device sends an containing an . Which element inside the indicates the severity of the problem?

Accepted Answer

. Within a NETCONF element, the child element explicitly conveys whether the error is 'error' or 'warning', telling the client how serious the failure is. It is defined in RFC 6241 section 4.3 as one of the mandatory sub-elements of , alongside , , , and optional . Because the question asks specifically about severity, is the only element that carries that semantic.

Answer

<error-type>

Answer

<error-message>

Answer

<error-tag>

Question 14

A network engineer is automating the configuration of a Cisco ASA using the REST API. The engineer needs to retrieve the current running configuration in JSON format. Which HTTP method and endpoint should be used?

Accepted Answer

GET to /api/objects/configuration. The ASA REST API exposes the running configuration via a GET request to /api/objects/configuration. This returns the configuration in JSON, which can be parsed by automation scripts. Other endpoints like /api/cli or /api/objects/networkobjects serve different purposes and do not provide the full configuration.

Answer

GET to /api/configuration

Answer

GET to /api/objects/networkobjects

Answer

GET to /api/cli

Question 15

You are designing a YANG model for a Cisco security appliance that includes both configuration and operational state data. You need to ensure that certain leaf nodes are read-only and reflect the current status of the device. Which TWO statements are true regarding the use of 'config' and 'state' data nodes in YANG? (Choose two.)

Accepted Answer

A container with 'config true' can contain child nodes with 'config false'.. In YANG, 'config false' designates state data that is read-only, so a leaf with 'config false' cannot be written via NETCONF or RESTCONF. A container with 'config true' may contain child nodes with 'config false' to represent status within a configurable context. State data is not stored in the datastore, and is for retrieval, not modification. Descendants of a 'config false' node cannot be 'config true'.

Answer

A leaf with 'config true' can be modified using the <get-config> operation.

Answer

If a parent node is 'config false', all its descendants must also be 'config false'.

Answer

State data nodes are always stored in the <running> datastore.

Question 16

A security automation engineer needs to programmatically create a new network object on a Cisco Firepower Management Center using the REST API. The engineer wants the request to be idempotent so that re-running the script does not create duplicate objects. Which HTTP method should the script use for the create operation?

Accepted Answer

POST. Creating resources in the FMC REST API is done by sending a POST request to the collection URI with a JSON body describing the object. To make the operation idempotent, the script should first perform a GET filtered by the object name or value and only POST when no match is returned. PUT, PATCH, and DELETE all target existing resources and cannot create new ones.

Answer

PUT

Answer

PATCH

Answer

DELETE

Question 17

You are writing a Python script to interact with the Cisco Firepower Management Center (FMC) API. You need to authenticate to obtain an authentication token. Which HTTP method and endpoint must your script utilize to initiate this process?

Accepted Answer

POST /api/fmc_platform/v1/auth/generatetoken. The FMC API authentication flow requires a POST request to /api/fmc_platform/v1/auth/generatetoken with the username and password (typically Basic auth) to obtain an access token and refresh token. The token is then used in the X-auth-access-token header for subsequent API calls. POST is correct because the operation creates a new session token.

Answer

PUT /api/fmc_platform/v1/auth/generatetoken

Answer

GET /api/fmc_platform/v1/auth/generatetoken

Answer

POST /api/fmc_platform/v1/auth/login

Question 18

When working with YANG data models in Cisco security automation, which TWO statements accurately describe the role of the 'leaf' and 'leaf-list' nodes?

Accepted Answer

A 'leaf-list' node allows for multiple instances of a specific value type.. A 'leaf' contains a single value, while a 'leaf-list' contains a sequence of values of a specific type.

Answer

A 'leaf' node can contain child nodes.

Answer

Both 'leaf' and 'leaf-list' support default values.

Answer

A 'leaf-list' node is used for hierarchical grouping.

Question 19

In the context of REST APIs, which status code indicates that a request was successful and a new resource was created on the server?

Accepted Answer

201 Created. HTTP 201 Created is the standard response code for a successful POST request that results in a resource creation.

Answer

200 OK

Answer

202 Accepted

Answer

204 No Content

Question 20

When parsing a JSON response from a Cisco Adaptive Security Appliance (ASA) REST API call using the Python requests library, you notice the data structure contains a list of objects under the key 'items'. Which Python expression correctly accesses the 'name' field of the first object in that list?

Accepted Answer

response.json()['items'][0]['name']. The correct expression is response.json()['items'][0]['name']. The .json() method deserializes the HTTP response body into Python objects — here a dict containing the key 'items', whose value is a list of dicts. Python lists are zero-indexed, so [0] retrieves the first element, and ['name'] then extracts the 'name' key from that dict. This matches the documented structure of Cisco ASA REST API responses, which wrap collections in an 'items' array.

Answer

response.json()['items'][1]['name']

Answer

response.json().items[0].name

Answer

response.json()['items'].get('name')[0]