SAUTO Network Security Practice Test 2 — 15 Questions

Question 1

You are automating Cisco Firepower Management Center (FMC) object creation using the REST API. You successfully POST a new network object, but the changes do not appear on the managed Firepower Threat Defense (FTD) device. What is the mandatory final step to ensure the changes take effect?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Call the /deploy endpoint using the deployment target devices list.. After creating or modifying objects via the FMC REST API, the changes exist only in the FMC configuration database and are not pushed to managed FTD devices until a deployment is triggered. The mandatory final step is to call the /deploy endpoint with the deployment target devices list, which pushes the pending configuration to the specified FTD devices. Without this deployment call, the new network object will not take effect on the FTD.

Answer

The FMC automatically pushes objects immediately after the POST request returns 201.

Answer

Send a commit command to the FTD device directly via SSH.

Answer

Restart the snort process via the API.

Question 2

Which TWO steps are required to properly authenticate to the Cisco Firepower Management Center (FMC) API using the REST API Explorer?

Accepted Answer

Send a POST request to /api/fmc_platform/v1/auth/generatetoken. Option B is correct because the FMC REST API requires you to POST to the token-generation endpoint /api/fmc_platform/v1/auth/generatetoken, supplying credentials (typically Basic Auth) to obtain an authentication token. Option E is correct because the token returned in the response's X-auth-access-token header must be captured and reused in subsequent API calls as the authentication credential. The other options are incorrect: A is not one of the two required steps since Basic Auth is only the mechanism used within the generatetoken POST, not a standalone required step; C is unnecessary because a GET to the root URL does not authenticate you; and D is wrong because credentials must not be placed in the URL query string, as the FMC API expects them in the request header/body of the token request.

Answer

Use Basic Auth in the header with admin credentials

Answer

Perform a GET request to the root URL

Answer

Send credentials in the URL query string

Question 3

You are automating Cisco Firepower Management Center (FMC) via the REST API. You need to update an existing object. Which HTTP method must you use to ensure a full update of the resource representation?

Accepted Answer

PUT. PUT is the HTTP method defined by RFC 7231 to replace the entire resource representation at the target URI. When updating an existing FMC object via the REST API, PUT sends the complete object body, so any field omitted from the payload is reset to its default or removed. This full-replacement semantic is exactly what the question requires for a 'full update' of the resource.

Answer

POST

Answer

GET

Answer

PATCH

Question 4

You are configuring an Ansible playbook to manage Cisco Firepower policies. Which module is specifically designed to interact with FMC objects?

Accepted Answer

cisco.fmcansible.fmc_configuration. The cisco.fmcansible.fmc_configuration module is part of the Cisco FMC Ansible collection and is specifically designed to manage Firepower Management Center (FMC) objects, policies, and device configurations via the FMC REST API. It allows playbooks to create, update, and delete FMC objects such as network objects, access control policies, and port objects.

Answer

cisco.ise.ise_policy

Answer

cisco.asa.asa_config

Answer

cisco.ios.ios_config

Question 5

When using the FMC API, what is the purpose of the 'X-Auth-Access-Token' header?

Accepted Answer

To carry the session token for authentication.. The FMC REST API uses a token-based authentication model: after POSTing credentials to /api/fmc_platform/v1/auth/generatetoken, the response includes X-auth-access-token (and a refresh token). Every subsequent API call must include that token in the X-Auth-Access-Token header so FMC can associate the request with the authenticated session. It is purely an authentication artifact, not a routing or versioning parameter.

Answer

To specify the target device IP address.

Answer

To define the API version.

Answer

To enable debugging mode.

Question 6

You are troubleshooting a Python script using the Cisco pxGrid API. The script fails to receive notifications from ISE. Which component must be verified first?

Accepted Answer

The pxGrid controller status and connection state.. The pxGrid connection state must be established and 'active' to receive notifications. The connection is a two-way handshake process.

Answer

The local machine's DNS settings.

Answer

The ISE ERS API status.

Answer

The TACACS+ shared secret.

Question 7

When interacting with the Cisco ISE ERS API, you receive an HTTP 401 error. What is the most likely cause?

Accepted Answer

Authentication credentials provided are incorrect.. An HTTP 401 Unauthorized response indicates that the request lacks valid authentication credentials for the target resource. When interacting with the Cisco ISE ERS (External RESTful Services) API, the most likely cause is that the username, password, or authentication token provided is incorrect or missing. The ERS API requires valid credentials with appropriate RBAC permissions to authenticate each request.

Answer

The ERS API service is disabled on the ISE node.

Answer

The request body contains invalid JSON.

Answer

The resource does not exist.

Question 8

You are automating Cisco ASA firewall rule updates using the REST API. Which data format is required in the request body when pushing a new access control entry?

Accepted Answer

JSON. The Cisco ASA REST API requires request bodies to be formatted in JSON (JavaScript Object Notation). When pushing a new access control entry (ACE), you must send a JSON payload that defines the ACE parameters, such as source, destination, and action. This is specified in Cisco's ASA REST API documentation, which mandates JSON for all API interactions.

Answer

YAML

Answer

XML

Answer

CSV

Question 9

When automating Cisco Stealthwatch (Secure Network Analytics) alerts, which API endpoint is used to query flow data?

Accepted Answer

/sw-reporting/v1/flows. The Stealthwatch API provides specific endpoints under '/sw-reporting/v1/' for flow data retrieval.

Answer

/inventory/v1/devices

Answer

/api/v1/firewall

Answer

/analytics/v1/alerts

Question 10

You are writing a script to parse FMC API response data. The response is a nested JSON object. Which Python library is standard for handling this task?

Accepted Answer

json. The 'json' module is the built-in Python library for encoding and decoding JSON objects.

Answer

requests

Answer

xml.etree

Answer

pandas

Question 11

Which authentication method is most commonly used by Cisco SecureX for API access?

Accepted Answer

OAuth 2.0. SecureX uses OAuth 2.0 with Client Credentials for machine-to-machine authentication.

Answer

API Key (Static)

Answer

Kerberos

Answer

Basic Auth

Question 12

When automating Cisco Security solutions, what is the primary benefit of using a 'Service Account' instead of a personal user account for API authentication?

Accepted Answer

Decoupling script execution from individual employee identity.. Service accounts provide non-expiring credentials that are not tied to an individual's lifecycle, ensuring script continuity.

Answer

Improved performance of API calls.

Answer

Automatic elevation of privilege.

Answer

Ability to bypass firewall rules.

Question 13

In a Cisco security automation environment, what does the 'API Rate Limit' represent?

Accepted Answer

The number of requests allowed per time unit.. Rate limits restrict the number of requests a client can make in a specified time window to protect API availability.

Answer

The speed of the network connection.

Answer

The timeout value for an API request.

Answer

The maximum size of an API payload.

Question 14

A script needs to update a Cisco Firepower object. Which API workflow is correct?

Accepted Answer

GET to retrieve current state, then PUT the updated state.. The correct workflow for updating a Cisco Firepower object via the REST API is to first perform a GET request to retrieve the current representation of the object, modify the desired fields, and then send a PUT request with the complete updated object. This ensures that all existing properties are preserved and only the intended changes are applied. The Firepower Management Center (FMC) API requires the full object body for PUT operations, so retrieving the current state is mandatory to avoid overwriting unspecified fields with nulls or defaults.

Answer

POST directly to the object ID.

Answer

PATCH the entire configuration file.

Answer

DELETE the object, then POST a new version.

Question 15

Which protocol is primarily used for the transport of API calls in the Cisco security portfolio?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS) is the standard transport for REST API calls across the Cisco security portfolio, including Secure Endpoint, Umbrella, SecureX, and Firepower. It provides encryption, authentication, and integrity for API requests and responses, and all Cisco APIs expose HTTPS endpoints.

Answer

SNMP

Answer

SSH

Answer

TFTP