SAUTO Network Security Practice Test 4 — 15 Questions

Question 1

When automating security, which methodology is used to treat infrastructure configurations as code?

Accepted Answer

Infrastructure as Code (IaC). Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure through machine-readable definition files.

Answer

Continuous Integration

Answer

DevOps

Answer

Agile Security

Question 2

You are running a script that interacts with the Cisco ISE ERS API. The script is designed to perform a bulk import of users. Which HTTP code should you expect for a successful creation request?

Accepted Answer

201 Created. HTTP 201 Created is the standard response for a successful POST request that creates a new resource.

Answer

200 OK

Answer

202 Accepted

Answer

204 No Content

Question 3

What is the primary function of a 'Bearer Token' in an API request?

Accepted Answer

To authenticate the API request.. A Bearer Token is a credential that allows the holder (the bearer) to access the protected resource.

Answer

To define the API schema.

Answer

To compress the response.

Answer

To encrypt the payload.

Question 4

Which TWO of the following are valid ways to test Cisco APIs before deployment? (Choose two)

Accepted Answer

Using a dedicated lab/sandbox environment. Option A is correct because a dedicated lab or sandbox environment provides an isolated, non-production space where Cisco API calls (for example against Cisco DNA Center or Meraki sandbox endpoints) can be exercised safely without impacting live infrastructure. Option B is correct because Postman and similar API client tools let you construct and send HTTP requests (GET, POST, PUT, DELETE) with headers, authentication tokens, and JSON bodies, then inspect status codes and responses to validate the API before deployment. Option C is wrong because running scripts directly in production risks service disruption and is not a valid pre-deployment test method. Option D is wrong because having a colleague rewrite the script does not test the API. Option E is wrong because guessing the API structure cannot validate endpoints, parameters, or authentication.

Answer

Running scripts directly in the production environment

Answer

Asking a colleague to rewrite the script

Answer

Guessing the API structure

Question 5

Which element in an API request is most often used to filter the amount of data returned?

Accepted Answer

Query Parameters. Query parameters (e.g., ?limit=10 or ?offset=5) are the standard way to filter and paginate API responses.

Answer

HTTP Header

Answer

URL Path

Answer

Request Body

Question 6

Which THREE of the following fields are commonly found in a JSON API response object? (Choose three)

Accepted Answer

Meta/Pagination info. Option A (Meta/Pagination info) is correct because JSON API responses commonly include a meta object carrying pagination details such as total count, page number, page size, and next/previous links, which clients use to navigate large result sets. Option B (Status code/Message) is correct because responses typically embed a status indicator and human-readable message (e.g., "status": "success" or an error message) so the client can interpret the outcome independently of the HTTP status line. Option D (Data field (payload)) is correct because the data field is the core container holding the requested resource or collection, such as "data": [...] or "data": {...}, and is the primary content the API returns. Option C (System BIOS version) does not belong because BIOS version is hardware/firmware metadata unrelated to an API response schema. Option E (Physical location of the server) does not belong because a server's physical location is infrastructure information and is not a standard field in JSON API response objects.

Answer

System BIOS version

Answer

Physical location of the server

Question 7

Which TWO of the following are primary benefits of automating Cisco security policies via APIs? (Choose two)

Accepted Answer

Increased consistency of security posture. Option C is correct because automating security policies through APIs enforces a single, version-controlled definition of policy that is applied identically across all managed devices, so the security posture stays consistent rather than drifting between manual changes. Option E is correct because API-driven automation removes repetitive manual CLI entry, which is the main source of typos, wrong object groups, and misordered ACL/rule entries that cause configuration errors. Options A, B, and D are not benefits of API automation: APIs do not autonomously detect and remove all threats (that requires security controls such as IPS, AMP, or firewall inspection), they do not replace network engineers (they shift their work to designing and maintaining automation), and they do not eliminate physical firewalls (they configure and manage existing devices, whether physical or virtual).

Answer

Automatic removal of all security threats

Answer

Bypassing the need for network engineers

Answer

Elimination of physical firewalls

Question 8

Which THREE of the following are common issues encountered when automating Cisco Security APIs? (Choose three)

Accepted Answer

Incorrect URL endpoints or API versioning. Option B is correct because Cisco Security APIs (e.g., Cisco Firepower, Umbrella, ISE, and SecureX) expose versioned REST endpoints, and automation scripts frequently fail when they hard-code an outdated path such as /v1/ instead of the current /v2/ or when they target the wrong base URL for a given tenant or region. Option C is correct because Cisco Security API gateways enforce rate limits (for example, Umbrella enforces per-organization request quotas and Firepower Management Center enforces concurrent API call limits), so automation that polls too aggressively receives HTTP 429 Too Many Requests responses and must implement backoff/retry logic. Option D is correct because Cisco Security APIs rely on OAuth 2.0 bearer tokens or API keys that expire after a set lifetime, so long-running automation fails with HTTP 401 Unauthorized unless it refreshes tokens or rotates credentials. Option A is not a software/API automation concern at all, since power supply compatibility is a hardware issue unrelated to REST calls. Option E is likewise irrelevant, as Ethernet cable color has no bearing on API authentication, endpoint routing, or rate limiting.

Answer

Incompatible physical power supply

Answer

Wrong color of Ethernet cables

Question 9

Which TWO of the following steps are involved in the Cisco Firepower API authentication workflow? (Choose two)

Accepted Answer

Extracting the 'X-Auth-Access-Token' from the response. The Cisco Firepower Management Center (FMC) REST API authentication workflow begins by sending a POST request to the /api/fmc_platform/v1/auth/generatetoken endpoint with valid credentials (typically HTTP Basic Auth), which is exactly what option E describes. The FMC then returns a response containing the authentication token in the X-Auth-Access-Token header (along with a refresh token), so option B correctly identifies extracting that token from the response as the next step; this token is then used in the X-Auth-Access-Token header of subsequent API calls. Option A is incorrect because restarting FMC services is a troubleshooting action, not part of API authentication. Option C is incorrect because there is no DELETE request to clear a cache in the authentication workflow; token revocation uses a different mechanism. Option D is incorrect because SNMP v3 traps are for network monitoring and have no role in FMC API authentication.

Answer

Restarting the FMC services

Answer

Sending a DELETE request to clear the cache

Answer

Configuring an SNMP v3 trap

Question 10

Which TWO of the following are characteristics of the Cisco ISE ERS API? (Choose two)

Accepted Answer

It supports CRUD (Create, Read, Update, Delete) operations. Option B is correct because the Cisco ISE External RESTful Services (ERS) API is designed to let administrators programmatically perform Create, Read, Update, and Delete (CRUD) operations against ISE resources such as endpoints, identity groups, and network devices. Option E is correct because ERS is built on RESTful principles, using standard HTTP methods (GET, POST, PUT, DELETE) over HTTPS with XML or JSON payloads to interact with ISE. Option A is incorrect because ERS uses standard HTTP/HTTPS rather than a proprietary binary protocol. Option C is incorrect because ERS is an API for programmatic access, not a CLI interface. Option D is incorrect because ERS works with ISE deployments including virtual appliances, not only physical appliances.

Answer

It requires a proprietary binary protocol

Answer

It is purely for CLI access

Answer

It only works with physical appliances

Question 11

Which THREE of the following are key considerations when designing an automated security script? (Choose three)

Accepted Answer

Robust error handling and logging. Option A is correct because automated security scripts must include robust error handling and logging so failures are detected, exceptions are caught gracefully, and an audit trail exists for troubleshooting and compliance. Option B is correct because scripts often need privileged credentials, and storing them in a dedicated secrets manager such as HashiCorp Vault (rather than hard-coding them) prevents credential leakage and supports rotation and least-privilege access. Option C is correct because automation must handle growing workloads and remain observable, so scalability and performance monitoring ensure the script does not become a bottleneck or silently degrade. Option D is not appropriate because default vendor passwords are well-known and easily exploited, violating basic security hardening. Option E is not appropriate because requiring manual intervention at every step defeats the purpose of automation, reducing speed, consistency, and reliability.

Answer

Using default vendor passwords

Answer

Manual intervention for every step

Question 12

Which TWO of the following are true about Cisco Firepower API? (Choose two)

Accepted Answer

It provides access to policy management. Option B is correct because the Cisco Firepower Management Center (FMC) REST API exposes policy management endpoints, allowing administrators to programmatically create, read, update, and deploy access control, intrusion, and other policies via HTTPS requests to /api/fmc_config/v1/domain/{domainUUID}/policy/... . Option E is correct because the same REST API provides object management endpoints (e.g., /object/hosts, /object/networks, /object/ports) that let scripts and automation tools create, modify, and delete reusable network and port objects without manual GUI work. Option A is incorrect because the Firepower API is a RESTful/HTTP-based interface, not a C++ library or application. Option C is incorrect because the API requires authentication, typically via token-based access using /api/fmc_platform/v1/auth/generatetoken with valid credentials, and subsequent requests must include the auth token header. Option D is incorrect because the API is accessed over HTTPS/REST rather than being limited to the CLI, and it is in fact designed for programmatic and GUI-independent access.

Answer

It is written in C++

Answer

It has no authentication requirements

Answer

It is only available via the CLI

Question 13

Which TWO of the following are types of Cisco Security API documentation? (Choose two)

Accepted Answer

Swagger/OpenAPI specifications. Option A (Swagger/OpenAPI specifications) is correct because Cisco Security APIs publish machine-readable interface definitions in Swagger 2.0 or OpenAPI 3.0 format, which document endpoints, HTTP methods, parameters, authentication schemes, and response schemas for programmatic consumption. Option B (Developer portal HTML/web docs) is correct because Cisco hosts human-readable API reference documentation on developer portals such as developer.cisco.com, providing guides, endpoint descriptions, and code samples in HTML/web form. Option C is incorrect because physical paper manuals are not a recognized API documentation type for Cisco Security APIs. Option D is incorrect because Cisco does not distribute API source code as a documentation format. Option E is incorrect because voice-recorded tutorials are not a standard API documentation type.

Answer

Physical manuals printed on paper

Answer

Direct source code distribution

Answer

Voice-recorded tutorials

Question 14

Which THREE of the following are best practices for managing API keys? (Choose three)

Accepted Answer

Rotate keys regularly. Option A (Rotate keys regularly) is correct because periodic rotation limits the window of exposure if a key is leaked or compromised, and it supports compliance requirements such as those in PCI DSS and NIST guidelines. Option B (Use least privilege access for keys) is correct because scoping each key to only the permissions and resources it needs reduces the blast radius of a compromised key, following the principle of least privilege. Option C (Never hardcode keys in scripts) is correct because hardcoded keys end up in source control, logs, and build artifacts, where they are easily exposed; instead, keys should be stored in a secrets manager or injected via environment variables at runtime. Option D is wrong because reusing one key across every project violates least privilege and isolation, so a single leak compromises all projects and makes auditing impossible. Option E is wrong because email is unencrypted in transit and at rest on many servers, so sharing keys that way exposes them to interception and unauthorized access; keys should be distributed through a secure secrets management system.

Answer

Use the same key for every project

Answer

Share keys via email with the team

Question 15

Which TWO of the following are components of a URL? (Choose two)

Accepted Answer

Protocol (e.g., https). A URL's structure begins with the scheme, so option A (Protocol, e.g., https) is correct because it specifies how the resource is accessed, such as http, https, or ftp, and appears before the '://' delimiter. Option D (Host/Domain name) is also correct because it identifies the server hosting the resource, e.g., www.example.com, and is a required authority component of a URL. Option B is incorrect because a URL contains a hostname or domain name, not the local machine's IP address, which is the client's own address. Option C is incorrect because a URL never includes the server's physical CPU type, as that is hardware information unrelated to addressing. Option E is incorrect because credentials such as a password are not part of a standard URL structure and would be a serious security risk if embedded there.

Answer

The local machine's IP address

Answer

The server's physical CPU type

Answer

The user's password