Cisco Automating and Programming Cisco Security Solutions (SAUTO, 300-735, CCNP Security) (SAUTO) (SAUTO) — Questions 1–75

Deleting a sandbox report is a removal of an existing resource identified by its URL. DELETE is the HTTP method defined for resource deletion, so it removes the report; GET, POST and PUT cannot delete it.

The protocol specifies the scheme, such as HTTPS, that governs how a client requests the resource, and it always precedes the host in a URL's syntax. This satisfies the stem's requirement for a URL component, since the scheme is a mandatory structural element rather than optional metadata.

Cisco's cloud-based security APIs, including those for Umbrella and SecureX, exchange data as JSON, which is lightweight and natively parsed. This satisfies the stem's requirement for the standard data format used across these API endpoints.

NETCONF exposes distinct datastores; the running datastore holds the active configuration currently in effect on the device. Targeting it applies changes immediately without a separate commit step, unlike candidate, which requires explicit commit to take effect.

The /sw-reporting/v1/flows endpoint belongs to the Reporting API, which exposes flow records collected by Secure Network Analytics. It satisfies the stem's requirement to query flow data specifically, unlike the configuration or management endpoints. Authentication uses a bearer token issued by Microsoft Entra ID, so automation scripts can retrieve flows programmatically.

The Virtual Appliances endpoint returns the inventory and status of deployed Umbrella virtual appliances, matching the requirement to retrieve current appliance state. Other endpoints cover identities, policies, or destinations, so they cannot report virtual appliance status.

Cisco REST APIs expose their management endpoints over TLS, so specifying the https scheme ensures credentials and payloads travel encrypted rather than in cleartext. This satisfies the stem's secure-communication requirement by preventing plaintext HTTP exposure.

The GET method on /v1/organizations/{organizationId}/destinationlists targets the organisation-scoped collection, returning destination lists for that org. The path parameter binds the request to the specific organizationId, satisfying the requirement to retrieve lists for one organisation rather than all.

ERAS exposes ISE's internal data model through standards-based REST endpoints, letting automation scripts create, read, update and delete objects such as endpoints, identity groups and network devices. This satisfies the stem's requirement for programmatic CRUD access to ISE resources rather than GUI-only administration.

After posting credentials, the FMC returns a token in the response header; the script must extract X-Auth-Access-Token and reuse it in subsequent request headers. This token-based mechanism replaces repeated credential exchange for each API call.

ERS batch endpoints accept multiple objects in a single HTTP request, so thousands of SGT updates are grouped rather than sent individually. This directly minimises API call volume and load on Cisco ISE compared with per-object requests.

API-driven policy automation removes manual CLI configuration drift, so every device receives identical access control lists and firewall rules. This directly satisfies the stem's consistency requirement, since human error during repetitive configuration is the main cause of divergent security postures across a fleet.

Ansible Vault encrypts sensitive data such as passwords and keys. You can store ASA credentials in an encrypted file and reference them in playbooks. This prevents hardcoding credentials in plaintext. Vault uses AES-256 encryption and requires a password to decrypt. This is the recommended method for securing secrets in Ansible.

HTTP 429 signals rate limiting, so the script must retry after a delay. Exponential backoff progressively increases the wait between attempts, reducing request volume until the FMC accepts calls again, avoiding further throttling or failed retrievals.

DELETE is a valid REST HTTP method used to remove an existing network configuration resource identified by its URI. This satisfies the stem's requirement for methods managing configurations, alongside GET, POST, PUT and PATCH, each mapping to a distinct CRUD operation.

A leaf holds exactly one value of a defined type and cannot contain child nodes, unlike containers or lists which organise hierarchy. This matches the stem's description of a single-value node, making it the accurate statement about leaf behaviour in YANG.

JSON is the native payload format for the Cisco ASA REST API, which accepts and returns JSON-encoded objects for access control entry operations. The API rejects XML and form-encoded bodies, so JSON satisfies the stem's requirement for the request body when pushing a new ACE.

The requests library raises a Timeout exception when a connection or read operation exceeds the configured timeout without a response. This distinguishes it from ConnectionError, which covers network-level failures rather than a server simply responding too slowly.

Cisco DNA Center returns an X-Auth-Token header after successful authentication, and subsequent API calls must include this token to satisfy the session-persistence requirement. It is passed as a request header rather than a cookie, so scripts must capture and resend it on every call.

The Cisco Secure Endpoint API uses RFC 5988 Link headers for pagination. The response includes a Link header with rel="next" containing the full URL for the next page. The script should parse this header and follow the URL until no next link is present. This is the documented and correct approach for iterating through large result sets in the Secure Endpoint API.

API credentials are generated and managed directly within Cisco Secure Endpoint under Settings → API Credentials, where you create a key pair (API key and secret) scoped to your organisation. This satisfies the stem's requirement to retrieve credentials, since no separate portal or Microsoft Entra ID registration is involved.

Python's json module raises JSONDecodeError when the parser encounters malformed syntax, such as a missing closing brace, because the token stream ends before the object is terminated. This is the specific exception type the stem describes.

Co-occurrences in the Umbrella Investigate API list domains that were queried or accessed within the same time window as the domain under investigation, revealing related infrastructure and potential campaign associations rather than ownership or reputation data.

JSON's compact key-value structure eliminates XML's verbose closing tags, cutting payload size and the parsing overhead modern Cisco security APIs incur. This directly satisfies the stem's bandwidth and latency constraint, since smaller responses transmit faster and require less CPU to deserialise than equivalent XML documents.

Collection Variables persist at collection scope, so a script can capture a value from one response and reference it in later requests via {{variable}} syntax, satisfying the requirement to chain requests dynamically within the same Postman collection.

The Cisco Threat Response case management API uses the /iroh/iroh-case/case endpoint, and creating a new case is a POST operation. The request body must include the case title, and optionally observables to associate. This is the documented way to programmatically open a case for investigation, enabling your SOAR playbook to escalate malicious observables into a tracked incident.

A 403 response means the request was authenticated but the identity is not authorised, so the API user account lacks the roles or privileges required for that operation. Credentials are valid; RBAC permissions on Cisco ISE are the constraint being violated.

The Umbrella Management API expects the key in a standard bearer token header. The script must send this header on every create/delete call, otherwise the endpoint responds with 401 Unauthorized. Because key rotation changes the credential, the script must re-read the new key and use it for subsequent calls; any cached old key will fail once deleted.

JSON encodes structured data as text using objects and arrays, and parsers exist for virtually every language, satisfying the language-independence requirement. Unlike XML it imposes no schema or verbosity, keeping payloads compact for API transport between heterogeneous systems.

Cisco WSA applies policy changes only after an explicit commit; API calls stage the configuration in a pending state. Without committing, the URL-blocking rule remains inactive despite successful authentication and reachability, so the change never reaches the running policy engine.

REST APIs enforce a defined schema and validate input before changes are applied, so malformed or mistyped commands are rejected rather than pushed to devices. This structured validation replaces error-prone manual CLI entry, satisfying the reduced configuration errors benefit.

The requests library provides a simple, high-level interface for issuing HTTP verbs, handling headers, and parsing JSON responses, making it the de facto standard for REST API calls in Python automation. This satisfies the stem's requirement for the most commonly used library.

The pxGrid API enables bidirectional, context-sharing integration with Cisco ISE, publishing session, identity and endpoint data to subscribers and allowing external systems to query or act on that context. This satisfies the stem's requirement for a programmatic interaction method, unlike GUI-only or non-API interfaces.

Pagination parameters split a large API response into smaller pages, so each call returns a defined subset rather than the entire result set. This retrieves results in chunks, preventing timeouts and excessive memory use when querying large datasets.

Threat Response correlates and investigates security events across integrated Cisco products, letting analysts pivot from an alert to related observability data and take response actions. This satisfies the cross-product investigation function rather than standalone detection or policy enforcement.

Firepower Management Center's REST API exposes bulk operations, letting you create, modify or delete many objects in a single request. This satisfies the efficiency constraint by avoiding thousands of individual calls when modifying large object sets.

The 201 status code is returned by the server after a request successfully creates a new resource, typically following POST or PUT. This confirms the resource now exists, satisfying the stem's question about what 201 Created signifies in an HTTP response.

Reading the existing policy first preserves all unmodified fields, then the PUT replaces the resource with a complete, valid configuration. This satisfies the no-downtime constraint by preventing partial updates from dropping settings that Cisco Umbrella requires, which would otherwise break resolution for protected networks.

The FMC REST API provides a token generation endpoint at /api/fmc_platform/v1/auth/generatetoken. A POST with valid credentials returns headers including X-auth-access-token and X-auth-refresh-token. The access token must be included in subsequent requests to authenticate. This is the standard method for session-based authentication with FMC.

The state field reports the analysis status of a submitted sample, such as whether processing is pending, running or complete. It indicates progress, not verdict or threat score, so auditors can confirm the analysis finished.

The Cisco Secure Endpoint API uses OAuth 2.0 with the client credentials grant. Your script sends a POST to the token endpoint with the client ID and client secret, and receives an access token. This token is then used in the Authorization header as a Bearer token for subsequent API calls. This is the standard and required authentication method for the API.

POST /destinationlists/{id}/destinations adds domains to an existing destination list, satisfying the requirement to manage domain blocking through the Umbrella API. Destination lists are Umbrella's blocking mechanism, and this endpoint appends entries to a specified list, letting you block domains programmatically rather than through the dashboard.

FMC stores object changes in its configuration database; the FTD devices only receive them when a deployment job is triggered. POSTing to /deploy with the target device list pushes the pending configuration, satisfying the requirement that changes actually take effect on managed devices.

Cisco Umbrella's API authenticates every request using an API key and secret pair generated in the Umbrella dashboard, satisfying the stem's requirement for successful API use. Without these credentials, calls to reporting, enforcement, or management endpoints fail authorisation, so generating them is the essential prerequisite.

Bearer tokens carry the access credential itself, so the API validates the token's signature, issuer and expiry to authenticate the caller. This satisfies the stem's requirement for authenticating the request without requiring a separate session or cookie exchange.

The SecureX Inspect capability parses the page currently displayed in the browser and extracts observables such as IP addresses, domains, URLs and file hashes, then submits them for threat lookup, giving analysts immediate enrichment without manually copying indicators.

The Cloudlock API exposes OAuth application governance, letting administrators enumerate and revoke third-party OAuth tokens granted by users. Revoking tokens is a posture automation task because it remediates risky or over-privileged SaaS app access without manual intervention.

SSLError arises during TLS verification when the server's certificate cannot be validated against trusted certificate authorities, typically because it is self-signed, expired, or hostname-mismatched. The requests library rejects the handshake rather than transmitting data insecurely.

SHA-256 hashes are supported observable types in the Cisco SecureX Threat Intelligence API, letting analysts query file reputation by cryptographic digest. This satisfies the stem's requirement for lookup-capable observables, since the API accepts file hashes alongside IP addresses and domains as queryable indicators.

cisco.fmcansible.fmc_configuration is the Ansible module built to create, update and delete FMC objects, abstracting the underlying REST calls. It directly satisfies the playbook's need to manage Firepower policies through FMC rather than generic HTTP modules.

HTTP 401 Unauthorised signals failed authentication, so the supplied credentials are incorrect or malformed. The ERS API rejects the request before authorisation checks, making invalid credentials the most likely cause rather than permissions or payload issues.

Exponential backoff retries failed requests with progressively longer delays, absorbing HTTP 429 responses without overwhelming Cisco Umbrella's API. This satisfies the stem's rate-limit constraint by preventing throttling escalation and eventual request blocking, whereas immediate retries would exhaust the quota and cause SOAR playbook failures.

The Workflow Designer provides a visual, drag-and-drop canvas for building automation workflows, satisfying the no-code requirement. It chains triggers, actions and conditions graphically, so analysts construct orchestration logic without writing scripts, unlike API or CLI-based approaches.

Automation scripts frequently fail because hard-coded URLs point at retired or incorrect endpoints, or because the API version in the path no longer matches the deployed platform. This mismatch between script and live API surface is a genuine, commonly encountered automation issue, satisfying the scenario's requirement.

Automated security scripts run unattended, so robust error handling and logging let failures be caught, diagnosed and retried without manual intervention. This satisfies the design requirement that scripts remain reliable and auditable when executing security tasks at scale.

Deleting an API key invalidates it instantly, so any script still authenticating with that key receives authorisation failures on its very next request. Confirming no active automation depends on the key prevents immediate, hard outages in running jobs.

GET is the HTTP method defined for safe, idempotent retrieval of a resource representation without modifying server state. Requesting interface status from the ASA REST API is a read operation, so GET satisfies the requirement to fetch current state without altering configuration.

GET retrieves a representation of the specified policy resource without altering server state, satisfying the read-only constraint. The other HTTP methods (POST, PUT, DELETE) modify or create resources, so they cannot fulfil a read-only request.

NETCONF encodes configuration and state data in XML, giving a hierarchical, schema-defined structure that YANG models validate. This satisfies the stem's requirement for a common benefit by enabling programmatic parsing, filtering and atomic edits, unlike unstructured CLI screen-scraping, so automation tools can reliably read and modify specific configuration nodes.

A successful bulk user creation via the ERS API returns 201 Created, confirming each resource was instantiated. This satisfies the stem's requirement for the expected success code on a creation request, distinguishing it from 200 OK, which signals retrieval rather than resource creation.

Conditional requests using ETag or Last-Modified let the script send a validator; a 304 Not Modified response confirms the policy is unchanged, avoiding repeated full downloads. This directly satisfies the stem's need to detect whether the WSA configuration has actually changed.

An event trigger initiates the workflow the moment Umbrella raises a security alert, satisfying the requirement for automated, alert-driven isolation rather than manual intervention. It subscribes to the Umbrella webhook or API feed, passing host details downstream so subsequent actions can quarantine the endpoint without human delay.

The uptime field reports the elapsed duration since the appliance last restarted, expressed as a time period. It reflects service continuity of the Cisco WSA rather than current load or session counts, answering the System Status query directly.

A 401 Unauthorized response indicates the request lacked valid credentials, so the missing or expired authentication token is the cause. The ASA REST API requires a valid token in the request header, satisfying the stem's scenario of an unauthenticated Postman call.

Query parameters appended to the URI narrow results server-side, for example limiting returned records by field value, count or time range. They satisfy the stem's requirement to filter data volume, unlike headers or the body, which carry authentication and payload content rather than selection criteria.

JSON is the native serialisation format for every Cisco Security API, including Secure Endpoint, Umbrella and Threat Grid, satisfying the stem's "all" constraint. Requests and responses use JSON bodies over HTTPS, so parsing requires no XML transformation. This uniformity lets one client library query all three platforms without format-specific handling.

The ASA REST API exposes monitoring endpoints that return interface statistics such as packet and byte counters, enabling automated health checks. Reading these counters requires no configuration change, satisfying the monitoring action the question asks about.

HTTPS wraps HTTP in TLS, providing the encrypted transport that Cisco security APIs require for authentication tokens and configuration data in transit. Plain HTTP would expose credentials, so HTTPS is the portfolio's primary API transport protocol.

The Incidents API returns paged results, so a script that reads only the first page will miss incidents beyond the page size. The fix is to loop, using the pagination metadata the API provides, until the response indicates no more pages. This guarantees every incident in the time window is collected and the daily report reflects the true count.

The AsyncOS API requires an HTTP `Authorization` header carrying a Base64-encoded `username:password` credential pair, satisfying the stem's mandatory authentication constraint. Without it, tracking requests are rejected outright. Other headers, such as `Content-Type` or `Accept`, govern payload negotiation only and cannot authenticate the caller.

The Postman Console records the raw HTTP request and response, including headers and bodies, for every call made during a session. This satisfies the audit requirement to verify that all requests are logged with full wire-level detail.

Block lists are one of the two destination list types the Umbrella policy API exposes, alongside allow lists. Creating a block list via the API lets you deny traffic to specified destinations, satisfying the stem's requirement for a creatable destination list type.

POST creates a new subordinate resource on the server, submitting a representation in the request body. It is one of the standard REST methods, alongside GET, PUT, PATCH and DELETE, and is commonly used when provisioning objects through Cisco security APIs.

Without an Accept header, the Cisco ISE ERS API cannot negotiate content type, so it falls back to a default representation rather than the format you intended. Specifying it guarantees the expected JSON or XML response.

The ETag identifies a specific resource version; clients resend it via If-Match so the server rejects updates based on stale data. This optimistic concurrency control satisfies the stem's question about the header's role in Firepower API responses.