281 questions total · 4pages · All types, answers revealed
Page 1 of 4
Page 2You are automating the deletion of a sandbox report in Threat Grid. Which HTTP method should you use?
DELETE is for resource removal.
Why this answer
The DELETE method is the standard RESTful way to remove a resource via an API.
Which TWO of the following are components of a URL? (Choose two)
Mandatory for REST calls.
Why this answer
A URL typically includes the protocol (e.g., HTTPS) and the host/domain name.
Which data format is the standard for Cisco's cloud-based security APIs?
JSON is the universal language for Cisco's REST-based APIs.
Why this answer
JSON (JavaScript Object Notation) is the standard data exchange format for almost all modern Cisco security APIs.
You are automating Cisco Adaptive Security Appliance (ASA) configurations using NETCONF. Which protocol data store should you target to ensure your changes take effect immediately in the running configuration?
The running data store is the active configuration currently applied to the device.
Why this answer
In NETCONF, the 'running' data store represents the currently active configuration on the device.
When automating Cisco Stealthwatch (Secure Network Analytics) alerts, which API endpoint is used to query flow data?
This is the correct endpoint for flow-based data queries.
Why this answer
The Stealthwatch API provides specific endpoints under '/sw-reporting/v1/' for flow data retrieval.
You are implementing automated log retrieval from Cisco ASA using the REST API. What is the limitation of the 'get_logs' endpoint?
Using REST API for logs is inefficient compared to syslog/SIEM.
Why this answer
The ASA REST API is limited in how much logging data it can stream; it is not designed for bulk historical log aggregation.
Mandatory to specify the endpoint.
Why this answer
A valid HTTP request must include the method, the destination URL, and appropriate headers.
You need to retrieve the current status of all Cisco Umbrella 'Virtual Appliances' using the API. Which API resource is the most appropriate?
This endpoint is designed to expose the state and configuration of VAs.
Why this answer
The 'Virtual Appliances' endpoint in the Umbrella API specifically provides status and heartbeat information for registered VAs.
Which THREE actions are essential when implementing a Python-based automation script that interacts with a Cisco REST API using the 'requests' library to ensure secure communication?
HTTPS ensures traffic encryption between the client and the API endpoint.
You are automating policy updates for Cisco Umbrella using the Umbrella Management API. You need to identify the correct endpoint to retrieve the list of destination lists for a specific organization. Which HTTP method and path should you use?
This is the correct endpoint path for retrieving destination lists in the Umbrella Management API.
Why this answer
The Cisco Umbrella Management API uses the GET method with the /organizations/{organizationId}/destinationlists path to retrieve the destination lists associated with an organization.
When using the Cisco ISE REST API, what does the 'ERAS' (External RESTful Services) framework provide?
ERAS is the API surface for ISE management.
Why this answer
ERAS enables external applications to perform CRUD operations on ISE resources like endpoints and policies.
Which TWO of the following steps are involved in the Cisco Firepower API authentication workflow? (Choose two)
This token is used for all subsequent calls.
Why this answer
The workflow involves sending credentials to the authentication endpoint and capturing the returned access token.
You are performing a bulk update of Security Group Tags (SGTs) in Cisco ISE. Which mechanism should you prioritize to minimize load on the API when processing thousands of tags?
The Batch API allows processing multiple resource updates in a single request.
Why this answer
Using the bulk API endpoints or ERS (External RESTful Services) with batch processing is the correct way to handle large datasets effectively.
Which TWO of the following are primary benefits of automating Cisco security policies via APIs? (Choose two)
Scripts ensure uniform policy application.
Why this answer
Automation reduces human error and ensures configuration consistency across the environment.
You are automating Firepower Management Center event retrieval. You notice your script is getting an HTTP 429 response. What should your automation script implement?
Exponential backoff is the standard mechanism to gracefully handle rate-limiting.
Why this answer
An HTTP 429 'Too Many Requests' error indicates rate-limiting. A robust script must implement exponential backoff to respect the API rate limits.
Used for removing resources.
Why this answer
GET, POST, and DELETE are standard HTTP methods used in RESTful management.
You are designing a YANG model for a custom security policy. Which statement accurately describes the function of a 'leaf' node in YANG?
A leaf defines a specific piece of data.
Why this answer
A leaf node contains a single value and has no child nodes.
JSON is the standard format for REST API interactions with Cisco security devices.
Which TWO of the following are true regarding the 'requests' library's exception handling?
Crucial for handling hung requests.
Why this answer
Exceptions like Timeout and ConnectionError are critical for writing robust, production-ready automation scripts.
You are writing a script that interacts with Cisco DNA Center. You need to keep the session alive after authentication. Which token is commonly used for subsequent API calls?
DNA Center standardizes on the X-Auth-Token header.
Why this answer
DNA Center uses an X-Auth-Token retrieved from the authentication service to authorize subsequent API requests.
Which TWO of the following are valid HTTP methods supported by the Cisco Umbrella Management API?
POST is used for creating new resources.
Why this answer
The Umbrella Management API follows REST principles, and POST (create) and DELETE (remove) are standard methods for managing destination lists and policies.
How do you retrieve the API credentials for Cisco Secure Endpoint?
This is the correct path for credential management.
Why this answer
Credentials are found under the 'API Credentials' section in the Secure Endpoint console.
Which JSON-related error occurs if you try to parse a string that is missing a closing brace?
The specific error for malformed JSON syntax.
Why this answer
A 'JSONDecodeError' is raised when the parser encounters a syntax error, such as an incomplete object.
You are automating threat hunting using the Cisco Umbrella Investigate API. Which TWO parameters are required to perform a standard DNS lookup for a specific domain? (Choose two)
The domain is the primary subject of the lookup.
Why this answer
The Investigate API requires the domain name and the specific endpoint path to retrieve DNS data.
When using the Umbrella Investigate API, what does the 'co-occurrences' result represent?
This identifies related domains.
Why this answer
Co-occurrences identify domains that are frequently visited together in short timeframes, often indicating related infrastructure.
When automating a Cisco Secure Web Appliance (WSA) task, you need to trigger a 'policy push'. Which API component allows you to initiate this?
This is the official method to apply staged configurations on WSA.
Why this answer
The WSA configuration API provides a 'commit' or 'push' endpoint to apply staged changes to the active configuration.
You are automating the 'App Firewall' in Cisco Cloudlock. You want to change an OAuth app's status from 'Approved' to 'Revoked'. Which object structure must be sent in the request body?
The API expects a JSON body defining the target state.
What is the primary advantage of using JSON over XML when interacting with modern Cisco security APIs?
The conciseness of JSON is a major factor in its preference for web APIs.
Why this answer
JSON is more lightweight, easier to parse with modern programming languages, and has lower overhead compared to XML.
When designing an automation workflow using Postman, which feature allows you to dynamically pass a value from the response of one request to the input of a subsequent request?
Collection variables are used to store data captured from one request and inject it into others.
Why this answer
Postman variables (specifically collection or environment variables) are updated via the 'Tests' tab using scripting to chain requests.
While testing a REST API call in Postman for Cisco ISE, you receive a 403 Forbidden error. What is the most likely cause of this issue in the context of network programmability?
403 Forbidden is a standard HTTP response for authorization failures.
Why this answer
A 403 error indicates that the server understands the request but refuses to authorize it, typically due to insufficient RBAC permissions for the API user account.
When automating the Cisco Secure Email (ESA) configuration via the API, which file format is required to import a new set of content filters?
AsyncOS configuration exports and imports are formatted in XML.
Why this answer
Cisco Secure Email uses XML for configuration exports and imports via the API.
Which statement best describes JSON?
JSON's strength is its simplicity and broad compatibility.
Why this answer
JSON is a text-based format for data interchange that is independent of any programming language.
You are automating the blocking of a specific URL on a Cisco WSA. You have verified the API reachability, but the rule is not being applied. What is the most common reason?
WSA configuration changes are staged and must be committed to take effect.
Why this answer
The WSA API often requires a 'commit' action after updating rules; without this, the changes remain in a staging area and are not active.
Which THREE of the following are common benefits of using REST APIs for network automation?
Removes manual CLI interaction.
Why this answer
Repeatability, scalability, and programmatically driven configurations are core benefits of APIs.
Which TWO of the following are mandatory fields when creating a new 'Destination List' via the Cisco Umbrella API?
Every list needs a unique name.
Why this answer
To create a destination list, one must provide a name and the specific list access type (block or allow).
Which Python library is most commonly used for handling REST API requests in SecureX automation scripts?
The 'requests' library is the de facto standard.
Why this answer
The 'requests' library is the standard for handling HTTP operations in Python.
Which TWO of the following are valid methods for interacting with Cisco ISE programmatically?
pxGrid is the standard interface for ISE context sharing.
Why this answer
Cisco ISE provides the ERS (RESTful) API for configuration and the pxGrid API for context sharing.
You are developing an integration for the Cisco Secure Endpoint API. What is the result of using a pagination parameter?
Pagination facilitates efficient data retrieval.
Why this answer
Pagination allows the API to return results in smaller, manageable chunks, preventing timeouts.
What is the function of the Cisco SecureX 'Threat Response' module?
This is the core function of the module.
Why this answer
Threat Response allows for the rapid identification and investigation of threats using integrated product data.
Which Cisco security product API supports 'Bulk' operations to improve efficiency when modifying large numbers of objects?
FMC supports bulk operations for objects.
Why this answer
The FMC API includes 'bulk' endpoints to allow creating or updating multiple objects in a single API call.
In an HTTP request, what does the '201 Created' status code signify?
Standard status for successful POST resource creation.
Why this answer
201 Created is the standard HTTP status code indicating that a resource has been successfully created.
Your automated script is designed to update a Cisco Umbrella policy. What is the correct procedure to ensure that changes do not cause downtime?
This read-modify-write pattern ensures the existing configuration is respected.
Why this answer
The correct procedure is to perform a GET request to retrieve the current policy configuration, modify the JSON structure locally, and then perform a PUT request to update the policy with the new configuration.
In a Cisco Threat Grid API workflow, what does the 'state' field in the analysis report indicate?
State defines the progress of the sandbox execution.
Why this answer
The state field indicates whether the analysis is 'pending', 'analyzing', or 'complete'.
You are using the Cisco Umbrella API. Which TWO of the following are valid ways to manage domain blocking?
This adds domains to a list.
Why this answer
The Umbrella API supports managing destination lists and their associated domains via POST and DELETE methods.
You are automating Cisco Secure Email (ESA) using the Management API. You need to trigger an immediate update of the Anti-Spam engine. Which action is required to ensure the API call succeeds?
The API requires a POST request to the engine update endpoint to initiate the fetch.
Why this answer
The update mechanism in the ESA Management API requires authenticated administrative access and the correct POST trigger to the engine-update resource.
You are automating Cisco Firepower Management Center (FMC) object creation using the REST API. You successfully POST a new network object, but the changes do not appear on the managed Firepower Threat Defense (FTD) device. What is the mandatory final step to ensure the changes take effect?
Deployment is a separate asynchronous operation from the configuration update in the FMC API.
Why this answer
After pushing configuration changes via the FMC REST API, the configuration must be deployed to the FTD devices using the /api/fmc_config/v1/domain/{domainUUID}/deployment/deployabledevices endpoint to trigger the deployment process.
When developing an automation script for Cisco Cloudlock, which TWO authentication methods are supported for API access?
API tokens are used for authentication in Cloudlock integrations.
Why this answer
Cloudlock primarily uses OAuth2 Client Credentials and API Tokens for programmatic access.
Which of the following is a key requirement for using the Cisco Umbrella API successfully?
These are the mandatory credentials for authentication.
Why this answer
Generating and properly storing API keys from the Umbrella dashboard is the fundamental requirement for all API interactions.
What is the primary function of a 'Bearer Token' in an API request?
It acts as the credential.
Why this answer
A Bearer Token is a credential that allows the holder (the bearer) to access the protected resource.
What is the primary function of the Cisco SecureX 'Inspect' feature when using the browser extension?
Inspect extracts observables from the browser for API lookup.
Why this answer
Inspect allows users to highlight an observable on any webpage and look it up in SecureX.
Which TWO of the following steps are required to automate the retrieval of reporting data from the Cisco Secure Email Gateway?
Authentication is the first step in any API interaction.
Why this answer
To extract data, one must authenticate via the API and then query the Reporting API endpoint for the specific data set.
Which THREE of the following are examples of SaaS security posture automation tasks you can perform with the Cloudlock API?
Token revocation is a key automation task.
Why this answer
Cloudlock provides API-based control over user access, application auditing, and threat detection policies.
You are troubleshooting a Python script that uses the 'requests' library. The script fails with a 'SSLError'. What is the most likely cause?
Requests validates certificates by default.
Why this answer
An SSLError occurs when the client cannot verify the SSL certificate presented by the server.
Which THREE types of observables can be looked up using the Cisco SecureX Threat Intelligence API?
Supported observable.
Why this answer
SecureX supports lookups for IPs, domains, and file hashes (SHA-256).
You are configuring an Ansible playbook to manage Cisco Firepower policies. Which module is specifically designed to interact with FMC objects?
This is the official collection for managing FMC through Ansible.
Why this answer
The 'cisco.fmcansible' collection provides the specific modules required to manage FMC objects via the API.
When interacting with the Cisco ISE ERS API, you receive an HTTP 401 error. What is the most likely cause?
401 Unauthorized is returned when credentials fail verification.
Why this answer
HTTP 401 indicates unauthorized access, which means the provided credentials or the authentication token is invalid or missing.
When integrating Cisco Umbrella with a SOAR platform, what is the best practice for handling API rate limits?
This ensures the script waits appropriately before retrying after a rate limit hit.
Why this answer
Implementing exponential backoff logic is the standard practice for handling 429 'Too Many Requests' responses from APIs.
When integrating Cisco Umbrella with a SIEM via the Reporting API, which format is recommended for high-volume log ingestion?
S3 bucket logging is the architectural standard for Umbrella SIEM integration.
Why this answer
S3 buckets are the standard method for high-volume logs in Umbrella API integration.
Which component of Cisco SecureX allows users to create automation workflows without writing code?
The designer provides a visual interface for automation.
Why this answer
The Workflow Designer is the drag-and-drop environment for low-code automation.
Which THREE of the following are common issues encountered when automating Cisco Security APIs? (Choose three)
Common cause of 'not found' errors.
Why this answer
Common issues include authentication failure, rate limiting, and incorrect API versions or endpoints.
Which THREE of the following are key considerations when designing an automated security script? (Choose three)
Essential for debugging.
Why this answer
Scripts must handle errors, log activities, and be secure.
You are automating the deletion of an old Umbrella API key. Why is it important to ensure that no active scripts are using this key before deletion?
Deletion of credentials is irreversible and immediate.
Why this answer
Once an API key is deleted, any application using that key will immediately lose access, causing potential service disruption.
When configuring the Cisco Secure Web Appliance (SWA) via the API, which object attribute is critical to ensure that a newly created policy is immediately active upon deployment?
The enabled boolean attribute is required to activate the policy.
Why this answer
The 'enabled' boolean flag must be set to true in the object JSON payload.
GET is the read-only method for resource retrieval.
Why this answer
The GET method is standard for retrieving resource state information from the REST API without modifying the configuration.
A network engineer is using the Cisco Firepower Management Center (FMC) API to retrieve access control policy information. Which HTTP method should be used to perform a read-only request for a specific policy resource?
GET is used to retrieve data.
Which THREE of the following are common benefits of using NETCONF for device management?
Easier to parse than CLI screen scraping.
Why this answer
NETCONF provides transaction-based operations, structured data (XML), and distinct datastores, improving reliability over CLI.
You are running a script that interacts with the Cisco ISE ERS API. The script is designed to perform a bulk import of users. Which HTTP code should you expect for a successful creation request?
201 is the correct code for resource creation.
Why this answer
HTTP 201 Created is the standard response for a successful POST request that creates a new resource.
You are developing a script to pull alerts from Cisco Cloudlock. You want to filter for 'High Severity' incidents only. Which parameter should you include in your API call?
The Cloudlock API uses this query parameter to filter incidents by severity level.
Why this answer
The Cloudlock API supports filtering incident logs via query parameters like 'severity_level' or 'severity'.
You are writing a script to check for new security policy updates on a Cisco WSA. You notice that your script pulls the same configuration repeatedly. What should you use to check if the policy has changed?
These headers allow for conditional GETs, preventing redundant data transfer.
Why this answer
The 'Last-Modified' header or an ETag check is the standard way to verify if a resource has changed since the last request, saving bandwidth and processing.
Which THREE components are typically involved in a SecureX orchestration workflow that automates the isolation of a host based on an Umbrella alert?
An event must trigger the workflow.
Why this answer
Orchestration workflows require an 'Event' to trigger the flow, an 'Activity' to process the logic, and a 'Target' to define the appliance (e.g., Secure Endpoint) receiving the action.
When interacting with the Cisco WSA API, you want to retrieve the 'System Status'. What does the 'uptime' field in the JSON response represent?
Uptime is the standard metric for time since the last system boot.
Why this answer
The uptime field in the WSA API provides the time elapsed since the last appliance restart or service initialization.
A network engineer is testing a Cisco ASA REST API call using Postman. The request returns a 401 Unauthorized status code. What is the most likely cause of this error?
401 Unauthorized specifically refers to authentication failure.
Why this answer
A 401 status indicates that the request lacks valid authentication credentials.
Which element in an API request is most often used to filter the amount of data returned?
Query parameters filter the response.
Why this answer
Query parameters (e.g., ?limit=10 or ?offset=5) are the standard way to filter and paginate API responses.
Which data format is primarily used by all Cisco Security APIs (Secure Endpoint, Umbrella, Threat Grid)?
JSON is the industry-standard format for Cisco REST interfaces.
Which THREE of the following actions can be automated via the Cisco ASA REST API?
Retrieving state information is a standard operation.
Why this answer
The ASA REST API supports CRUD operations on objects, interface status checks, and the configuration of access control rules.
Page 1 of 4
Page 2Practice SAUTO by domain
Target a specific domain to shore up weak areas.