SAUTO Network Security — 20 Questions

Question 1

Which THREE steps are required to properly authenticate a script against the Cisco Adaptive Security Appliance (ASA) REST API?

Accepted Answer

Send a logout request to /api/logout when the session is complete.. The ASA REST API requires an initial login, the handling of the token in the header, and subsequent teardown of the session.

Answer

Configure the ASA to allow API access via 'api-server enable' in the CLI.

Answer

Use Basic Auth in every request instead of a token.

Question 2

You are writing a Python script to interact with the Cisco ASA REST API. After successfully authenticating and receiving a token, which header must be included in subsequent requests to maintain the session?

Accepted Answer

Authorization: Bearer <token>. The Cisco ASA REST API requires the 'Authorization' header containing the Bearer token for every subsequent API call.

Answer

X-Auth-Token

Answer

User-Agent: API-Client

Answer

Cookie: session_id

Question 3

In the context of Cisco Umbrella, which API is used to manage and deploy security policies programmatically?

Accepted Answer

Umbrella Management API. The Umbrella Investigate API is for threat intelligence, while the Umbrella Management API is for policy and enforcement.

Answer

Umbrella Enforcement API

Answer

Umbrella Reporting API

Answer

Umbrella Investigate API

Question 4

Which THREE of the following represent common HTTP status categories? (Choose three)

Accepted Answer

4xx (Client Error). Standard status categories are 2xx (Success), 4xx (Client Error), and 5xx (Server Error).

Answer

3xx (Redirection)

Answer

7xx (Security Error)

Question 5

A network engineer is using the Cisco Firepower Management Center (FMC) API to retrieve access control policy information. Which HTTP method should be used to perform a read-only request for a specific policy resource?

Accepted Answer

GET. The GET method is the standard HTTP verb used to retrieve data from a REST API resource without modifying it.

Answer

PATCH

Answer

POST

Answer

PUT

Question 6

You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?

Accepted Answer

PUT /ers/config/guestuser/{id}. The Cisco ISE ERS API uses PUT for updates. For guest users, the correct path is /ers/config/guestuser/{id}.

Answer

POST /ers/config/guestuser/update

Answer

UPDATE /ers/config/guestuser/{id}

Answer

PATCH /ers/config/guestuser/{id}

Question 7

You are using the Cisco Firepower Management Center (FMC) API to retrieve a list of Access Control Policies. Which URL endpoint is correct?

Accepted Answer

/api/fmc_config/v1/domain/{uuid}/policy/accesspolicies. The FMC API structure follows the /api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies path.

Answer

/api/fmc_config/v1/policy/access

Answer

/api/v1/fmc/acp

Answer

/api/fmc_config/v1/domain/policy/accesspolicies

Question 8

You are automating Cisco Firepower Management Center (FMC) object creation using the REST API. You successfully POST a new network object, but the changes do not appear on the managed Firepower Threat Defense (FTD) device. What is the mandatory final step to ensure the changes take effect?

Accepted Answer

Call the /deploy endpoint using the deployment target devices list.. After pushing configuration changes via the FMC REST API, the configuration must be deployed to the FTD devices using the /api/fmc_config/v1/domain/{domainUUID}/deployment/deployabledevices endpoint to trigger the deployment process.

Answer

The FMC automatically pushes objects immediately after the POST request returns 201.

Answer

Send a commit command to the FTD device directly via SSH.

Answer

Restart the snort process via the API.

Question 9

Which TWO steps are required to properly authenticate to the Cisco Firepower Management Center (FMC) API using the REST API Explorer?

Accepted Answer

Send a POST request to /api/fmc_platform/v1/auth/generatetoken. Authentication requires sending a POST request to /api/fmc_platform/v1/auth/generatetoken and storing the returned X-auth-access-token header.

Answer

Use Basic Auth in the header with admin credentials

Answer

Perform a GET request to the root URL

Answer

Send credentials in the URL query string

Question 10

You are automating Cisco Firepower Management Center (FMC) via the REST API. You need to update an existing object. Which HTTP method must you use to ensure a full update of the resource representation?

Accepted Answer

PUT. The PUT method is used for full updates of resources in the FMC REST API, replacing the existing object with the provided payload.

Answer

POST

Answer

GET

Answer

PATCH

Question 11

You are configuring an Ansible playbook to manage Cisco Firepower policies. Which module is specifically designed to interact with FMC objects?

Accepted Answer

cisco.fmcansible.fmc_configuration. The 'cisco.fmcansible' collection provides the specific modules required to manage FMC objects via the API.

Answer

cisco.ise.ise_policy

Answer

cisco.asa.asa_config

Answer

cisco.ios.ios_config

Question 12

When using the FMC API, what is the purpose of the 'X-Auth-Access-Token' header?

Accepted Answer

To carry the session token for authentication.. The X-Auth-Access-Token is used to authenticate subsequent API requests after the initial authentication handshake.

Answer

To specify the target device IP address.

Answer

To define the API version.

Answer

To enable debugging mode.

Question 13

You are troubleshooting a Python script using the Cisco pxGrid API. The script fails to receive notifications from ISE. Which component must be verified first?

Accepted Answer

The pxGrid controller status and connection state.. The pxGrid connection state must be established and 'active' to receive notifications. The connection is a two-way handshake process.

Answer

The local machine's DNS settings.

Answer

The ISE ERS API status.

Answer

The TACACS+ shared secret.

Question 14

When interacting with the Cisco ISE ERS API, you receive an HTTP 401 error. What is the most likely cause?

Accepted Answer

Authentication credentials provided are incorrect.. HTTP 401 indicates unauthorized access, which means the provided credentials or the authentication token is invalid or missing.

Answer

The ERS API service is disabled on the ISE node.

Answer

The request body contains invalid JSON.

Answer

The resource does not exist.

Question 15

You are automating Cisco ASA firewall rule updates using the REST API. Which data format is required in the request body when pushing a new access control entry?

Accepted Answer

JSON. Cisco ASA REST API integrations typically require JSON as the payload format for defining network objects and access rules.

Answer

YAML

Answer

XML

Answer

CSV

Question 16

When automating Cisco Stealthwatch (Secure Network Analytics) alerts, which API endpoint is used to query flow data?

Accepted Answer

/sw-reporting/v1/flows. The Stealthwatch API provides specific endpoints under '/sw-reporting/v1/' for flow data retrieval.

Answer

/inventory/v1/devices

Answer

/api/v1/firewall

Answer

/analytics/v1/alerts

Question 17

You are writing a script to parse FMC API response data. The response is a nested JSON object. Which Python library is standard for handling this task?

Accepted Answer

json. The 'json' module is the built-in Python library for encoding and decoding JSON objects.

Answer

requests

Answer

xml.etree

Answer

pandas

Question 18

Which authentication method is most commonly used by Cisco SecureX for API access?

Accepted Answer

OAuth 2.0. SecureX uses OAuth 2.0 with Client Credentials for machine-to-machine authentication.

Answer

API Key (Static)

Answer

Kerberos

Answer

Basic Auth

Question 19

Which Cisco Security tool uses 'Webhooks' to push real-time threat intelligence to external systems?

Accepted Answer

Cisco Umbrella. Cisco Umbrella and SecureX leverage webhooks to send alerts to external platforms in real time.

Answer

Cisco IOS XE

Answer

Cisco ASA

Answer

Cisco AnyConnect

Question 20

When automating Cisco Security solutions, what is the primary benefit of using a 'Service Account' instead of a personal user account for API authentication?

Accepted Answer

Decoupling script execution from individual employee identity.. Service accounts provide non-expiring credentials that are not tied to an individual's lifecycle, ensuring script continuity.

Answer

Improved performance of API calls.

Answer

Automatic elevation of privilege.

Answer

Ability to bypass firewall rules.