SAUTO Network Security — Timed 15 Questions

Question 1

Which THREE steps are required to properly authenticate a script against the Cisco Adaptive Security Appliance (ASA) REST API?

Accepted Answer

Send a logout request to /api/logout when the session is complete.. The ASA REST API requires an initial login, the handling of the token in the header, and subsequent teardown of the session.

Answer

Configure the ASA to allow API access via 'api-server enable' in the CLI.

Answer

Use Basic Auth in every request instead of a token.

Question 2

You are writing a Python script to interact with the Cisco ASA REST API. After successfully authenticating and receiving a token, which header must be included in subsequent requests to maintain the session?

Accepted Answer

Authorization: Bearer <token>. The Cisco ASA REST API requires the 'Authorization' header containing the Bearer token for every subsequent API call.

Answer

X-Auth-Token

Answer

User-Agent: API-Client

Answer

Cookie: session_id

Question 3

In the context of Cisco Umbrella, which API is used to manage and deploy security policies programmatically?

Accepted Answer

Umbrella Management API. The Umbrella Investigate API is for threat intelligence, while the Umbrella Management API is for policy and enforcement.

Answer

Umbrella Enforcement API

Answer

Umbrella Reporting API

Answer

Umbrella Investigate API

Question 4

Which Cisco Security tool uses 'Webhooks' to push real-time threat intelligence to external systems?

Accepted Answer

Cisco Umbrella. Cisco Umbrella supports webhooks to push real-time threat intelligence and security events to external systems, enabling automated response and integration with SIEM/SOAR platforms. Umbrella's Investigate and Reporting APIs, combined with webhook subscriptions, allow organizations to receive immediate notifications about blocked domains, security activity, and new threat classifications. This makes Umbrella the correct answer among the options.

Answer

Cisco IOS XE

Answer

Cisco ASA

Answer

Cisco AnyConnect

Question 5

You are implementing automated log retrieval from Cisco ASA using the REST API. What is the limitation of the 'get_logs' endpoint?

Accepted Answer

It is intended for management, not high-volume log streaming.. The Cisco ASA REST API's 'get_logs' endpoint is designed for management and diagnostic purposes, not for high-volume, continuous log streaming. It returns a limited buffer of recent syslog messages and is not a replacement for a dedicated syslog server or NetFlow/telemetry pipeline. This is the documented limitation.

Answer

It requires an active VPN session.

Answer

It only supports XML format.

Answer

It does not support real-time logs.

Question 6

Which THREE of the following are mandatory components of an HTTP REST request? (Choose three)

Accepted Answer

Target URL/URI. A REST request must identify the resource being acted upon, so A (Target URL/URI) is mandatory — the URI (e.g., https://api.example.com/users/42) tells the server which resource to address. B (HTTP Method such as GET, POST, PUT, DELETE) is also required because it defines the operation/verb to perform on that resource, and without it the server cannot interpret the request. D (Request Headers) is mandatory as well, since HTTP/1.1 requires at least the Host header, and headers carry essential metadata like Content-Type, Accept, and Authorization. C (Request Body) is not required — GET and DELETE typically have no body, and it is only used with methods like POST/PUT/PATCH. E (Database Password) is irrelevant to the HTTP protocol; authentication is handled via headers or tokens, and the client never needs direct database credentials.

Answer

Request Body

Answer

Database Password

Question 7

Which THREE of the following represent common HTTP status categories? (Choose three)

Accepted Answer

4xx (Client Error). Standard status categories are 2xx (Success), 4xx (Client Error), and 5xx (Server Error).

Answer

3xx (Redirection)

Answer

7xx (Security Error)

Question 8

You are writing a Python script to interact with the Cisco Adaptive Security Appliance (ASA) via the REST API. You need to verify that your session token remains valid. Which header must be included in subsequent API calls to maintain the authenticated session?

Accepted Answer

X-Auth-Token. The 'X-Auth-Token' header is the standard mechanism for passing the authentication token obtained from the initial login request to the ASA REST API.

Answer

Authorization: Bearer

Answer

Session-Key

Answer

Cookie: session_id

Question 9

You are automating Cisco Firepower policy deployment. After updating the Access Control Policy (ACP) via the API, you must initiate the deployment. Which API endpoint triggers the deployment task?

Accepted Answer

/api/fmc_config/v1/domain/{domainUUID}/deployment/deployabledevices. The /api/fmc_config/v1/domain/{domainUUID}/deployment/deployabledevices endpoint is used to initiate the deployment process after changes are made.

Answer

/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies/deploy

Answer

/api/fmc_config/v1/domain/{domainUUID}/devices/deploys

Answer

/api/fmc_config/v1/domain/{domainUUID}/action/deploy

Question 10

A security automation engineer is writing a Python script to interact with the Cisco Firepower Management Center (FMC) REST API. The script needs to authenticate and obtain an access token. Which authentication method does the FMC REST API use to generate this token?

Accepted Answer

Token-based authentication using a custom header. The FMC REST API requires a token obtained from the /api/fmc_platform/v1/auth/generatetoken endpoint. You provide credentials in the headers, and the response includes an X-auth-access-token. This token is then included in the headers of subsequent API calls. The other methods are not supported by FMC.

Answer

OAuth 2.0 with client credentials grant

Answer

Basic authentication with username and password

Answer

API key passed as a query parameter

Question 11

A security engineer is automating Cisco Umbrella using its Investigate API. The engineer needs to retrieve security information about a list of domains. Which TWO of the following are valid API endpoints or methods for retrieving domain information? (Choose two.)

Accepted Answer

GET /domains/categorization/{domain}. The Umbrella Investigate API provides the /domains/categorization endpoint for retrieving security and category information for domains. It can be used for a single domain via path parameter or multiple domains via a query parameter with a comma-separated list. Other endpoints like /domains/volume provide different data. The correct choices are the single and batch categorization endpoints.

Answer

GET /domains/security/{domain}

Answer

GET /domains/volume/{domain}

Answer

GET /domains/risk-score/{domain}

Question 12

A security automation engineer is using the Cisco Identity Services Engine (ISE) REST API to automate the creation of network devices. The script must authenticate and then create a new network device. Which two headers are required when making API calls to Cisco ISE after authentication? (Choose two.)

Accepted Answer

Accept: application/json. When creating a network device via Cisco ISE REST API, the request must include headers that specify the content type and accepted response format. The Accept header ensures the response is JSON, and the Content-Type header indicates the request body is JSON. These are required for proper communication with the API.

Answer

X-auth-access-token: <token>

Answer

Authorization: Basic <base64-encoded-credentials>

Answer

Cookie: ISE_SESSION=<session-cookie>

Question 13

A network engineer is using the Cisco Firepower Management Center (FMC) API to retrieve access control policy information. Which HTTP method should be used to perform a read-only request for a specific policy resource?

Accepted Answer

GET. The HTTP GET method is defined for safe, read-only retrieval of a resource and is the correct method to fetch access control policy information from the FMC API. GET requests do not modify server state and are idempotent, making them ideal for querying a specific policy resource by its identifier. The FMC REST API follows standard REST conventions, so GET is used for all read operations.

Answer

PATCH

Answer

POST

Answer

PUT

Question 14

You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?

Accepted Answer

PUT /ers/config/guestuser/{id}. Cisco ISE ERS uses PUT to update an existing guest user resource, with the URI pattern /ers/config/guestuser/{id} where {id} is the guest user's unique identifier. This follows REST conventions where PUT replaces or updates the identified resource.

Answer

POST /ers/config/guestuser/update

Answer

UPDATE /ers/config/guestuser/{id}

Answer

PATCH /ers/config/guestuser/{id}

Question 15

You are using the Cisco Firepower Management Center (FMC) API to retrieve a list of Access Control Policies. Which URL endpoint is correct?

Accepted Answer

/api/fmc_config/v1/domain/{uuid}/policy/accesspolicies. The correct FMC REST API endpoint for Access Control Policies is /api/fmc_config/v1/domain/{uuid}/policy/accesspolicies, where {uuid} is the domain UUID obtained from the platform info endpoint. This follows FMC's standard config API URL structure.

Answer

/api/fmc_config/v1/policy/access

Answer

/api/v1/fmc/acp

Answer

/api/fmc_config/v1/domain/policy/accesspolicies