Courseiva

Cisco Automating and Programming Cisco Security Solutions (SAUTO, 300-735, CCNP Security) (SAUTO) (SAUTO) — Questions 226–272

272 questions total · 4 pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 4

226
MCQmedium

You are writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of all endpoints in your organization. After authenticating with OAuth 2.0, you need to handle pagination because the API returns a limited number of results per page. Which HTTP response header should your script inspect to obtain the URL for the next page of results?

A.Link
B.Location
C.X-Next-Page
D.X-Total-Count
AnswerA

The Cisco Secure Endpoint API uses the Link header to provide pagination links, including the URL for the next page. Your script should parse the Link header and follow the 'rel="next"' link to retrieve subsequent pages. This is a standard approach for REST APIs that implement RFC 5988. Relying on this header ensures you can iterate through all endpoints without missing any, which is critical when automating endpoint inventory or policy enforcement.

Why this answer

The Cisco Secure Endpoint API implements pagination using the Link header, which contains URLs for the next, previous, first, and last pages. By parsing this header, your script can reliably navigate through large result sets. This approach is consistent with RESTful best practices and ensures that automated workflows, such as endpoint inventory or threat hunting, retrieve complete data without manual intervention.

Exam trap

The trap here is assuming that pagination is handled via a custom header like X-Next-Page or a total count header, rather than the standard Link header used by Cisco Secure Endpoint.

Full explanation →
227
Multi-Selecthard

Which TWO of the following are valid ways to obtain threat intelligence data within the Cisco SecureX ecosystem?

Select 2 answers
A.Querying the SecureX CTIA API
B.Using a local script to scrape the Dark Web
C.Manually downloading CSV files from random websites
D.Directly modifying the underlying Cisco Talos database
E.Configuring integrated threat intelligence modules in the SecureX dashboard
AnswersA, E

The CTIA (Cisco Threat Intelligence API) is SecureX's dedicated programmatic interface for retrieving threat intelligence, exposing observables, sightings and enrichment data via REST endpoints. Querying it directly satisfies the scenario's requirement for a valid method of obtaining threat intelligence data within the SecureX ecosystem.

Why this answer

Option A is correct because the SecureX Cognitive Threat Intelligence API (CTIA) is a documented, supported interface that lets analysts programmatically query threat intelligence (for example, observables such as IPs, domains, and file hashes) and integrate those results into their own tools and workflows. Option E is correct because SecureX provides integrated threat intelligence modules and dashboard tiles that pull data from sources like Cisco Talos and other integrated feeds, allowing analysts to view and act on threat intelligence directly within the SecureX ribbon and dashboard without custom coding. Option B is not a valid SecureX method, since scraping the Dark Web with a local script is not a supported or sanctioned SecureX capability and raises legal and reliability concerns.

Option C is not valid because manually downloading CSV files from random websites is neither a SecureX-integrated nor a trustworthy threat intelligence acquisition method. Option D is not valid because directly modifying the underlying Cisco Talos database is impossible for customers and would be an unauthorized change to a Cisco-managed backend system.

Exam trap

SAUTO often tests the valid methods of obtaining threat intelligence within SecureX; candidates might think any method is acceptable, but only API access and integrated dashboard modules are supported and secure.

Full explanation →
228
Multi-Selecthard

Which THREE headers are commonly used when sending authenticated requests to Cisco Security APIs?

Select 3 answers
A.Content-Type
B.Cookie
C.User-Agent
D.Authorization
E.Accept
AnswersA, D, E

Content-Type declares the media type of the request body, such as application/json, so the Cisco Security API parses the payload correctly. It satisfies the stem's requirement for a commonly used authentication request header, working alongside Authorization and Accept to form the standard trio expected by these APIs.

Why this answer

Content-Type (A) is correct because authenticated Cisco Security API requests must declare the media type of the request body (e.g., application/json) so the API can parse the payload correctly. Authorization (D) is correct because it carries the authentication credential, such as a Bearer token or Basic base64-encoded credentials, which the API validates to authenticate the caller. Accept (E) is correct because it tells the API which response media type the client expects, typically application/json, ensuring the response is returned in a usable format.

Cookie (B) is not a standard header for these API authentications since Cisco Security APIs rely on Authorization tokens rather than session cookies, and User-Agent (C) is merely informational about the client and is not required for authentication.

Exam trap

SAUTO often tests whether candidates can distinguish authentication headers (Authorization) from content negotiation headers (Content-Type, Accept) and from non-essential headers (User-Agent, Cookie).

Full explanation →
229
MCQeasy

Which YANG node type is used specifically to group reusable definitions that can be imported by other modules?

A.typedef
B.leaf
C.grouping
D.container
AnswerC

A grouping statement holds a reusable set of nodes that other modules reference through a uses statement after importing the module. It exists solely to group reusable definitions, unlike container, list or leaf, which define data tree instances.

Why this answer

A grouping in YANG is a reusable collection of nodes (leaves, containers, lists) that can be referenced with the uses statement, either within the same module or imported from another module. It exists specifically to avoid duplicating common configuration structures across multiple parts of a model.

Exam trap

The trap is conflating grouping (a reusable template) with container (an instantiated data node) — both 'group' things, but only grouping is importable and reusable via uses.

How to eliminate wrong answers

Option A is wrong because typedef defines a reusable data type, not a group of nodes. Option B is wrong because leaf defines a single data node with a value, not a reusable structure. Option D is wrong because container is a data node that groups related nodes for a specific instance in the data tree, not a reusable template that can be imported and instantiated elsewhere.

Full explanation →
230
MCQmedium

You are automating Cisco Identity Services Engine (ISE) using the External RESTful Services (ERS) API. Your Python script needs to query all network devices and then update a specific device group. After authenticating with HTTPS Basic Authentication, you receive an HTTP 401 response when attempting to retrieve devices. Which action should you take to resolve this?

A.Disable SSL certificate verification in your Python script to allow the connection to proceed.
B.Change the HTTP method from GET to POST and include a JSON body with the device details.
C.Add the 'Accept: application/json' header to the request to ensure the server returns JSON instead of XML.
D.Include the 'ERS-Read-Only' or 'ERS-Admin' role in the API user's admin group and ensure the account is not disabled.
AnswerD

Cisco ISE ERS API requires the API caller to have the appropriate admin role, such as ERS-Admin or ERS-Read-Only, assigned via the admin group. A 401 Unauthorized indicates authentication failure, often due to missing role or disabled account. Verifying and correcting the API user's role and status directly addresses the issue.

Why this answer

A 401 Unauthorized response from the Cisco ISE ERS API indicates that the provided credentials are not accepted or the account lacks necessary permissions. The ERS API requires the API user to be assigned to an admin group with ERS-Admin or ERS-Read-Only roles. Ensuring the account is active and has the correct role resolves the authentication failure.

Exam trap

The trap here is assuming that a 401 error is caused by missing headers or incorrect HTTP methods, when it specifically points to invalid credentials or insufficient permissions.

Full explanation →
231
MCQeasy

What is the benefit of integrating Cisco Threat Grid with Secure Endpoint?

A.Automated firewall blocking
B.Automated user provisioning
C.Automated file analysis
D.Automated email filtering
AnswerC

Threat Grid integration submits files automatically to its sandbox for dynamic analysis, returning verdicts and behavioural indicators without manual upload. This delivers automated file analysis, accelerating detection of malicious files that Secure Endpoint alone cannot fully inspect.

Why this answer

Integrating Cisco Threat Grid with Secure Endpoint enables automated file analysis: when Secure Endpoint detects a suspicious file, it can automatically submit it to Threat Grid for dynamic analysis in a sandbox. Threat Grid then returns a threat score and detailed behavioral report, which Secure Endpoint uses to determine if the file is malicious and should be quarantined. This integration provides deeper insight than static signatures alone, improving detection and response.

Exam trap

SAUTO often tests the specific capabilities of Cisco security integrations, and candidates may confuse Threat Grid's file analysis with other functions like firewall blocking or email filtering, leading them to select an incorrect option.

How to eliminate wrong answers

Option A is wrong because automated firewall blocking is not a function of Threat Grid; firewall blocking is typically handled by Cisco Firepower or other network security appliances, and Threat Grid does not directly configure firewall rules. Option B is wrong because automated user provisioning is an identity management function, often handled by Cisco Identity Services Engine (ISE) or similar, not by Threat Grid. Option D is wrong because automated email filtering is performed by Cisco Email Security Appliance (ESA) or Cloud Email Security, not by Threat Grid; Threat Grid focuses on file analysis, not email gateway filtering.

Full explanation →
232
MCQhard

You are automating the deletion of an indicator in Cisco Threat Grid. Which HTTP method must be used to ensure the request is idempotent and compliant with the RESTful design of the API?

A.POST
B.PUT
C.PATCH
D.DELETE
AnswerD

DELETE targets the indicator's resource URI directly, removing it without altering other records. This satisfies the stem's idempotency constraint: repeating the call yields the same end state, unlike POST, which creates subordinate resources. It also matches Threat Grid's RESTful design, where deletion maps to the DELETE verb on the indicator endpoint.

Why this answer

DELETE is the correct HTTP method because deleting an indicator is a removal operation, and DELETE is defined by REST semantics as idempotent — repeating the same DELETE request yields the same end state (the resource is gone). This aligns with Threat Grid's RESTful API design for indicator management.

Exam trap

SAUTO often tests whether candidates confuse PATCH (partial update) with DELETE (removal) — the trap is choosing PATCH because it sounds like a 'change' operation.

How to eliminate wrong answers

Option A is wrong because POST is non-idempotent and is used to create subordinate resources or trigger actions, not to remove an indicator — repeating a POST could create duplicate side effects. Option B is wrong because PUT is used to create or fully replace a resource representation, not to delete it. Option C is wrong because PATCH performs partial updates to an existing resource; it modifies fields but does not remove the resource, so it cannot satisfy a deletion requirement.

Full explanation →
233
MCQhard

In a Cisco REST API implementation using Python, you receive a '429 Too Many Requests' error. What is the appropriate programmatic response?

A.Switch the request method from GET to POST.
B.Disable SSL verification for subsequent calls.
C.Increase the timeout duration of the request.
D.Implement an exponential backoff strategy.
AnswerD

A 429 signals the client exceeded its allotted request quota. Exponential backoff retries after progressively longer, randomised delays, letting the quota window reset and preventing repeated throttling. Immediate retries or ignoring the error would worsen throttling, so backoff satisfies the stem's requirement for an appropriate programmatic response.

Why this answer

A 429 Too Many Requests status code indicates that the client has exceeded the rate limit imposed by the API server. The correct programmatic response is to implement an exponential backoff strategy, where the client waits progressively longer intervals between retries (e.g., 1s, 2s, 4s, 8s) to reduce the request rate and avoid overwhelming the server. This approach is a standard best practice for handling rate limiting in REST APIs, including Cisco's, and is often recommended in Cisco DevNet and automation certifications.

Exam trap

SAUTO often tests the misconception that HTTP errors like 429 can be resolved by changing request parameters (method, timeout, SSL) rather than implementing proper retry logic with backoff, which is the only correct programmatic response.

How to eliminate wrong answers

Option A is wrong because changing the HTTP method from GET to POST does not address rate limiting; the server enforces limits based on client identity or IP, not the method, and POST may even have stricter limits. Option B is wrong because disabling SSL verification is a security risk and has no effect on rate limiting; it would only bypass certificate validation, which is unrelated to 429 errors. Option C is wrong because increasing the timeout duration only affects how long the client waits for a response, not the rate at which requests are sent; it does not prevent or resolve rate limiting.

Full explanation →
234
MCQmedium

You are automating the addition of an IP blocklist in Umbrella. You have the IP address and the list ID. Which HTTP method and path is correct?

A.GET /v1/destinationlists/{listId}
B.POST /v1/destinationlists/{listId}/destinations
C.PUT /v1/destinationlists/{listId}/destinations
D.PATCH /v1/destinationlists/{listId}
AnswerB

Adding entries to an existing destination list requires POST to /v1/destinationlists/{listId}/destinations, since the list already exists and destinations are created as sub-resources. The listId path parameter targets the correct blocklist, satisfying the stem's constraint of having both the IP address and list ID.

Why this answer

The Umbrella API uses POST to add destinations to an existing destination list. The correct endpoint is /v1/destinationlists/{listId}/destinations, where {listId} is the ID of the target list. POST is the standard HTTP method for creating or appending resources, which matches the action of adding IPs to a blocklist.

Exam trap

SAUTO often tests the distinction between HTTP methods for CRUD operations, and candidates frequently confuse POST with PUT or PATCH when adding items to a collection.

How to eliminate wrong answers

Option A is wrong because GET is used to retrieve the list details, not to add destinations. Option C is wrong because PUT is typically used to replace an entire resource, not to append individual destinations. Option D is wrong because PATCH is for partial updates to a resource, and the path lacks the /destinations sub-resource needed to specify the destination entries.

Full explanation →
235
MCQhard

You are writing a script to automate firewall rules. When using the 'pyang' tool, what is the primary purpose of the '--format' option?

A.To translate the YANG model into a specific output format.
B.To set the recursion depth of the model tree.
C.To define the input file encoding.
D.To specify the YANG module version.
AnswerA

The --format flag controls how pyang renders the parsed YANG module, selecting an output plugin such as tree, yang, or jstree. It satisfies the scripting need to produce machine-readable or human-readable model output rather than validating or fetching schemas.

Why this answer

The --format option in pyang is used to specify the output format, such as tree, json, or xsd, for a given YANG model.

Full explanation →
236
Multi-Selecteasy

Which THREE of the following are common JSON data types?

Select 3 answers
A.number
B.string
C.class
D.boolean
E.pointer
AnswersA, B, D

JSON defines number as a primitive value type, covering integers and floating-point values with optional exponents and signs. This satisfies the stem's requirement for a common JSON data type, alongside string, boolean, null, object and array. Numbers require no quoting, unlike string values.

Why this answer

JSON (JavaScript Object Notation, defined by RFC 8259) supports a fixed set of value types, and option A (number) is one of them: JSON numbers are written as decimal literals such as 42, -3.14, or 1.5e10, with no distinction between integers and floats. Option B (string) is correct because JSON strings are sequences of Unicode characters enclosed in double quotes, using backslash escapes like \n and \uXXXX. Option D (boolean) is correct because JSON defines the literal values true and false as a native boolean type.

The unmarked options do not belong: option C (class) is an object-oriented construct, not a JSON type — JSON only has objects (unordered key/value collections), not classes — and option E (pointer) is a memory-address concept from languages like C/C++, with no representation in the JSON specification.

Exam trap

SAUTO often tests whether candidates confuse programming-language types (class, pointer, int vs float) with JSON's actual six value types — the trap is assuming JSON supports types from languages like Python or C++.

Full explanation →
237
MCQeasy

When using the FMC API, what is the purpose of the 'X-Auth-Access-Token' header?

A.To carry the session token for authentication.
B.To specify the target device IP address.
C.To define the API version.
D.To enable debugging mode.
AnswerA

The X-Auth-Access-Token header carries the access token issued by Microsoft Entra ID, enabling the FMC API to authenticate each request without resending credentials. This satisfies the stem's authentication requirement by supplying the bearer credential the API validates before processing the call.

Why this answer

The FMC REST API uses a token-based authentication model: after POSTing credentials to /api/fmc_platform/v1/auth/generatetoken, the response includes X-auth-access-token (and a refresh token). Every subsequent API call must include that token in the X-Auth-Access-Token header so FMC can associate the request with the authenticated session. It is purely an authentication artifact, not a routing or versioning parameter.

Exam trap

SAUTO often tests whether candidates conflate authentication headers with request-routing or versioning parameters, causing them to pick options that describe URL path elements instead of the token header's real purpose.

How to eliminate wrong answers

Option B is wrong because the target device is specified in the URL path (e.g., /api/fmc_config/v1/domain/{domainUUID}/devices/devicerecords/{objectId}), not in an authentication header. Option C is wrong because API version is encoded in the URI path segment (v1, v2) and negotiated via the domain UUID, not via X-Auth-Access-Token. Option D is wrong because debugging is controlled through FMC logging settings and query parameters, not through the auth token header.

Full explanation →
238
MCQhard

Your team runs a Cisco Secure Email Gateway (AsyncOS) and wants to automate message tracking lookups for incident response. A script authenticates with a valid session and queries /esa/api/v2.0/message-tracking/messages. The API returns HTTP 404 for every query even though messages exist. Which configuration issue is the most likely cause?

A.The OAuth 2.0 token has expired and must be refreshed before retrying.
B.The message tracking database has been purged and no messages remain to query.
C.The ESA API feature is disabled or the wrong API version is enabled in the gateway configuration.
D.The API account lacks the Administrator or Operator role required for message tracking.
AnswerC

AsyncOS exposes API access only when the API feature is enabled, and the endpoint version must match the enabled API version. If the feature is off or only v1.0 is enabled while the script calls /v2.0, the gateway returns 404 because the requested resource path does not exist. Enabling the API and matching the version resolves the failure.

Why this answer

HTTP 404 from an AsyncOS API endpoint usually means the requested path is not exposed. The API feature must be enabled on the gateway, and the endpoint version in the URL must match the enabled version. Authentication failures produce 401, and empty data produces 200 with an empty result, so those do not fit the symptom.

Exam trap

The trap here is treating a 404 as an authentication or data-availability problem when it actually indicates a disabled or version-mismatched API resource.

Full explanation →
239
MCQeasy

When using the Cisco Umbrella Reporting API, which format is the default output for retrieving threat activity logs to ensure compatibility with most data analysis tools?

A.XML
B.Binary
C.JSON
D.CSV
AnswerC

JSON is the Cisco Umbrella Reporting API's default response format, returning structured key-value threat activity data. This satisfies the compatibility constraint because JSON parses natively in most data analysis tools, unlike XML or CSV, which need extra transformation before ingestion.

Why this answer

The Cisco Umbrella Reporting API returns JSON by default, which is the native format for most modern data analysis tools, SIEMs, and scripting languages. JSON's structure maps cleanly to Python dictionaries and JavaScript objects, making it the standard interchange format for API-driven log retrieval. XML, CSV, and binary are not the default output for Umbrella Reporting API responses.

Exam trap

SAUTO often tests whether candidates assume Cisco APIs default to XML (a legacy Cisco habit) — the trap is picking XML when the modern Umbrella Reporting API actually returns JSON.

How to eliminate wrong answers

Option A is wrong because XML is not the default Umbrella Reporting API format — while some legacy Cisco APIs use XML, Umbrella's reporting endpoints return JSON. Option B is wrong because binary output is not used for structured log retrieval; it would be unusable for analysis tools without a decoder. Option D is wrong because CSV is not the default response format — CSV exports may be available via the dashboard, but the API returns JSON.

Full explanation →
240
Multi-Selecthard

Which THREE of the following are best practices for managing API keys? (Choose three)

Select 3 answers
A.Rotate keys regularly
B.Use least privilege access for keys
C.Never hardcode keys in scripts
D.Use the same key for every project
E.Share keys via email with the team
AnswersA, B, C

Regular rotation limits the window in which a leaked or stolen API key remains usable, containing exposure if credentials are compromised. This reduces the blast radius of credential theft and is a foundational practice for managing long-lived API keys securely.

Why this answer

Option A (Rotate keys regularly) is correct because periodic rotation limits the window of exposure if a key is leaked or compromised, and it supports compliance requirements such as those in PCI DSS and NIST guidelines. Option B (Use least privilege access for keys) is correct because scoping each key to only the permissions and resources it needs reduces the blast radius of a compromised key, following the principle of least privilege. Option C (Never hardcode keys in scripts) is correct because hardcoded keys end up in source control, logs, and build artifacts, where they are easily exposed; instead, keys should be stored in a secrets manager or injected via environment variables at runtime.

Option D is wrong because reusing one key across every project violates least privilege and isolation, so a single leak compromises all projects and makes auditing impossible. Option E is wrong because email is unencrypted in transit and at rest on many servers, so sharing keys that way exposes them to interception and unauthorized access; keys should be distributed through a secure secrets management system.

Full explanation →
241
MCQmedium

You are configuring a CI/CD pipeline to deploy Cisco ASA firewall rules. Which step is essential to ensure the changes are correct before applying them to production?

A.Deploy to a sandbox or staging environment for validation.
B.Rely on automated rollback without testing.
C.Directly apply to production to save time.
D.Only test the API connectivity.
AnswerA

Deploying to a sandbox or staging environment validates the ASA rule syntax and behaviour before production, catching errors that would otherwise disrupt live traffic. This satisfies the stem's requirement to confirm changes are correct prior to applying them.

Why this answer

Validating changes in a staging or pre-production environment is critical to ensure logic and syntax correctness.

Full explanation →
242
Multi-Selecthard

Which TWO of the following are true regarding the use of the Python 'requests' library?

Select 2 answers
A.It only supports the synchronous execution model.
B.It can automatically serialize dictionaries to JSON via the json parameter.
C.It simplifies HTTP interactions with methods like .get() and .post()
D.It requires manual management of connection pools.
E.It is only compatible with Python 2.7.
AnswersB, C

The requests library's json parameter accepts a Python dictionary and serialises it to JSON automatically, setting the Content-Type header accordingly. This removes the need to call json.dumps() manually, satisfying the stem's claim about automatic serialisation of dictionaries.

Why this answer

Option B is correct because requests accepts a json= keyword argument on methods such as post(), put(), and patch(), which serializes a Python dictionary to a JSON body and automatically sets the Content-Type header to application/json. Option C is correct because the library's core purpose is to provide a high-level, human-friendly API for HTTP, exposing convenience methods like requests.get(), requests.post(), requests.put(), and requests.delete() that wrap urllib3 under the hood. Option A is not correct because requests is built on urllib3 and supports connection pooling and keep-alive, and while the base API is synchronous, it is not limited to a single execution model in the sense implied.

Option D is not correct because requests manages connection pooling automatically via HTTPAdapter and urllib3's PoolManager, so manual pool management is not required. Option E is not correct because requests supports Python 3.x (and historically 2.7), not exclusively Python 2.7.

Exam trap

The trap is overgeneralizing requests' capabilities — candidates may believe it requires manual connection pool management or only works with Python 2.7, when in fact it auto-manages pools and supports modern Python 3.

Full explanation →
243
MCQeasy

Which Cisco security product uses the pxGrid framework to share contextual information with other network devices?

A.Cisco ISE
B.Cisco Firepower
C.Cisco ASA
D.Cisco Umbrella
AnswerA

Cisco Identity Services Engine publishes contextual identity and posture data over pxGrid, letting other platforms consume that information for policy decisions. This matches the stem's requirement for the product using pxGrid to share context with network devices.

Why this answer

Cisco ISE (Identity Services Engine) is the primary platform that utilizes pxGrid to share identity and policy context across the network ecosystem.

Full explanation →
244
MCQhard

When writing a Python request to the SecureX API, which Content-Type header is required for POST requests?

A.application/xml
B.application/x-www-form-urlencoded
C.application/json
D.text/plain
AnswerC

SecureX API POST requests expect JSON payloads, so the Content-Type header must be application/json. This tells the API how to parse the request body; other content types cause the endpoint to reject or misread the submission.

Why this answer

For POST requests to the SecureX API, the required Content-Type header is application/json. The SecureX API expects JSON-formatted request bodies, so the Content-Type must be set accordingly to ensure the server parses the payload correctly.

Exam trap

SAUTO often tests the confusion between Content-Type values, leading candidates to choose form-urlencoded or XML instead of the required application/json.

How to eliminate wrong answers

Option A is wrong because application/xml is not supported for SecureX API POST requests; the API expects JSON. Option B is wrong because application/x-www-form-urlencoded is used for HTML form submissions, not for SecureX API JSON payloads. Option D is wrong because text/plain is not a structured format and would not be parsed as JSON by the API.

Full explanation →
245
MCQeasy

What is the purpose of the 'Client ID' and 'Client Secret' when authenticating with the Cisco Secure Email Gateway API?

A.To directly access the email logs
B.To encrypt the email traffic
C.To obtain an OAuth 2.0 access token
D.To unlock the appliance for SSH access
AnswerC

The Client ID identifies the registered application, while the Client Secret authenticates it to the authorisation server. Together they satisfy the OAuth 2.0 client credentials grant, which Microsoft Entra ID validates before issuing an access token. That token is then presented as a bearer credential on Cisco Secure Email Gateway API calls.

Why this answer

The Cisco Secure Email Gateway API uses OAuth 2.0 for authentication, and the Client ID and Client Secret are the credentials the client presents to the authorization server's token endpoint to obtain an access token. That access token is then included as a Bearer token in subsequent API calls. The Client ID identifies the registered API client, and the Client Secret proves its identity.

Exam trap

SAUTO often tests the confusion between authentication credentials (Client ID/Secret) and the resulting authorization artifact (access token), so candidates who pick 'directly access logs' miss that the credentials only yield a token.

How to eliminate wrong answers

Option A is wrong because Client ID and Client Secret do not directly access email logs — they are used to obtain a token, and the token (not the credentials) authorizes log retrieval. Option B is wrong because these credentials are for authentication/authorization, not for encrypting email traffic; encryption is handled by TLS/S/MIME. Option D is wrong because SSH access to the appliance uses separate credentials (username/password or SSH keys), not OAuth client credentials.

Full explanation →
246
MCQhard

An engineer is using NETCONF to retrieve configuration data from a Cisco IOS XE device. The engineer wants to filter the response to only include interface configuration for GigabitEthernet1. Which YANG filter correctly achieves this using the subtree filter?

A.<filter type="subtree"><interface><name>GigabitEthernet1</name></interface></filter>
B.<filter type="subtree"><interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces"><interface><name>GigabitEthernet1</name></interface></interfaces></filter>
C.<filter type="subtree"><interfaces><interface><name>GigabitEthernet1</name></interface></interfaces></filter>
D.<filter type="xpath" select="/interfaces/interface[name='GigabitEthernet1']"/>
AnswerB

This filter uses the subtree filtering mechanism with the correct namespace for the ietf-interfaces module. It selects the interfaces container and filters for the interface with name GigabitEthernet1. The structure matches the YANG model, ensuring only the desired interface configuration is returned. This is the standard way to filter NETCONF responses.

Why this answer

The correct subtree filter includes the proper namespace for the ietf-interfaces module and follows the hierarchy: interfaces > interface > name. This ensures the NETCONF server correctly interprets the filter and returns only the configuration for GigabitEthernet1. Omitting the namespace or parent container leads to invalid filters and incorrect results.

Exam trap

The trap here is forgetting to include the namespace in the subtree filter, which is required for the device to match the filter to the correct YANG module.

Full explanation →
247
MCQeasy

A network security engineer is writing a Python script to interact with the Cisco Identity Services Engine (ISE) External RESTful Services (ERS) API. The script must create a new endpoint and then retrieve its details. Which HTTP status code should the script expect upon successful creation of the endpoint?

A.302 Found
B.200 OK
C.204 No Content
D.201 Created
AnswerD

The ISE ERS API returns HTTP 201 Created when a new resource is successfully created via POST. This status indicates that the request has been fulfilled and resulted in a new resource being created. The response typically includes a Location header with the URI of the new resource.

Why this answer

The ISE ERS API follows REST conventions and returns HTTP 201 Created when a new resource is successfully created via a POST request. This status confirms the creation and often includes a Location header pointing to the new resource. A 200 OK is used for successful GET or PUT, but not for creation.

Exam trap

The trap here is assuming that any successful request returns 200 OK, overlooking that 201 Created is the specific code for resource creation in REST APIs.

Full explanation →
248
MCQeasy

Which data format is primarily used by REST APIs and is considered the standard for programmatic device interaction in Cisco security environments?

A.YAML
B.JSON
C.XML
D.Binary
AnswerB

JSON's lightweight, text-based structure parses directly into native objects, making it the de facto payload format for REST APIs. Cisco security platforms such as SecureX and Firepower Management Center expose JSON over HTTPS for programmatic device interaction, satisfying the stem's requirement for the standard REST data format.

Why this answer

JSON (JavaScript Object Notation) is the lightweight, human-readable format preferred by modern REST APIs.

Full explanation →
249
MCQmedium

A security engineer is automating Cisco Identity Services Engine (ISE) using the REST API. The script must retrieve a list of all network devices configured in ISE. Which API endpoint should the engineer use?

A.GET /api/v1/device-administration
B.GET /api/v1/network-device-group
C.GET /api/v1/identity-group
D.GET /api/v1/network-device
AnswerD

This endpoint returns a list of all network devices in Cisco ISE. It supports filtering, sorting, and pagination. The response includes device details such as name, IP address, and device type. This is the correct endpoint for retrieving network devices programmatically.

Why this answer

The Cisco ISE REST API provides a dedicated resource for network devices at /api/v1/network-device. A GET request to this endpoint returns all network devices. Other endpoints deal with device groups, identity groups, or administrative settings, none of which return the list of network devices.

Exam trap

The trap here is selecting the network-device-group endpoint, which sounds similar but returns groups, not the devices themselves.

Full explanation →
250
MCQhard

You are writing a script to update Cisco Secure Email (ESA) configuration. You need to push a new 'Content Filter' rule. Why is it recommended to perform a 'Get' request before the 'Put' request?

A.To lock the configuration database
B.To verify the user has write permissions
C.To preserve existing configuration attributes not being modified
D.To check if the API is responsive
AnswerC

A GET retrieves the current rule, so the subsequent PUT can include all existing attributes alongside the change. This satisfies the stem's requirement to avoid overwriting unmodified fields, since PUT replaces the whole resource representation.

Why this answer

Performing a 'Get' request before a 'Put' request is recommended to preserve existing configuration attributes that are not being modified. The 'Put' request typically replaces the entire resource, so if you omit fields, they may be reset to defaults. By retrieving the current configuration first, you can modify only the desired fields and send back the complete object.

Exam trap

SAUTO often tests the importance of GET before PUT, and candidates may overlook the risk of overwriting unspecified fields.

How to eliminate wrong answers

Option A is wrong because 'Get' does not lock the configuration database; locking is not a feature of the API. Option B is wrong because 'Get' does not verify write permissions; it only requires read permissions. Option D is wrong because checking API responsiveness is not the primary reason; it's about data integrity.

Full explanation →
251
MCQeasy

What is the primary function of the Cisco Secure Email API 'Message Tracking' interface?

A.Configuring SMTP relay settings
B.Creating user mailboxes
C.Searching and retrieving email metadata
D.Updating system firmware
AnswerC

The Message Tracking interface queries Cisco Secure Email's tracking database to locate messages by sender, recipient, subject or time range, returning delivery metadata such as timestamps and verdicts. This satisfies the stem's requirement for the primary function: searching and retrieving email metadata, rather than altering message content or managing policy.

Why this answer

The Cisco Secure Email API 'Message Tracking' interface is designed to provide visibility into email flow by allowing administrators to search for and retrieve metadata about messages processed by the email security appliance. This includes details such as sender, recipient, subject, timestamp, and delivery status, which are essential for troubleshooting and auditing. It does not perform configuration or management functions like setting SMTP relays or creating mailboxes.

Exam trap

SAUTO often tests the distinction between configuration APIs and monitoring/reporting APIs, so candidates might confuse Message Tracking with configuration tasks like SMTP relay setup or firmware updates.

How to eliminate wrong answers

Option A is wrong because configuring SMTP relay settings is a system configuration task typically performed through the administrative GUI or configuration APIs, not the Message Tracking interface. Option B is wrong because creating user mailboxes is not a function of the Cisco Secure Email API; mailbox management is handled by the email server (e.g., Exchange), not the security appliance. Option D is wrong because updating system firmware is a maintenance operation performed via the appliance's upgrade interface or CLI, not through the Message Tracking API.

Full explanation →
252
Multi-Selectmedium

Which TWO of the following are key features of the Cisco Cloudlock API?

Select 2 answers
A.Incident retrieval
B.Firmware deployment
C.Hardware firewall rule management
D.Packet inspection at Layer 2
E.OAuth application auditing
AnswersA, E

Incident retrieval is a core Cloudlock API capability, exposing security incidents and policy violations through REST endpoints so automation can pull alerts into external SIEM or ticketing systems. This satisfies the stem's requirement for a key API feature, enabling programmatic incident data access rather than manual console review.

Why this answer

Option A (Incident retrieval) is correct because the Cisco Cloudlock API exposes REST endpoints that let security teams programmatically pull incident data—such as policy violations and DLP events—from the Cloudlock platform for SIEM/SOAR ingestion and automated response. Option E (OAuth application auditing) is correct because Cloudlock's core CASB capability includes discovering and auditing third-party OAuth applications connected to SaaS tenants (e.g., Google Workspace, Microsoft 365), and the API surfaces this app-risk and permission data for review. The remaining options do not belong: firmware deployment (B) is a network-device management function, hardware firewall rule management (C) is performed on firewalls like Cisco Secure Firewall/ASA rather than a cloud CASB API, and Layer 2 packet inspection (D) is a network-layer function, whereas Cloudlock is an API-based cloud security service that inspects SaaS data and activity, not raw frames.

Exam trap

The trap is confusing Cloudlock's CASB/cloud-security scope with network infrastructure management — candidates who see 'Cisco Security' may incorrectly attribute firewall or firmware functions to Cloudlock.

Full explanation →
253
Multi-Selectmedium

Which THREE of the following are true regarding REST API design in Cisco security products?

Select 3 answers
A.Standard HTTP methods should be used for CRUD
B.All requests must be synchronous
C.XML is the only supported format
D.Resources are identified by unique URLs
E.Meaningful HTTP status codes indicate success or failure
AnswersA, D, E

Using standard HTTP methods (GET, POST, PUT, DELETE) for CRUD operations satisfies REST's uniform-interface constraint, which Cisco security product APIs such as Firepower and Umbrella enforce. This stateless, resource-oriented approach ensures predictable, interoperable calls across endpoints, unlike RPC-style designs that embed actions in the URL.

Why this answer

Option A is correct because REST API design in Cisco security products follows the standard HTTP verb mapping for CRUD operations: GET to read, POST to create, PUT/PATCH to update, and DELETE to remove resources. Option D is correct because REST is resource-oriented, so each resource is addressed by a unique URL (for example, /api/fmc_config/v1/domain/{domainUUID}/object/networks/{objectId}), which clients use to identify and manipulate that resource. Option E is correct because REST APIs return meaningful HTTP status codes such as 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, and 404 Not Found to indicate whether a request succeeded or failed.

Option B is not correct because REST APIs can support asynchronous operations, and Cisco security APIs commonly return task or job identifiers that clients poll for completion rather than requiring every request to be synchronous. Option C is not correct because Cisco security REST APIs typically support JSON, and many also support XML, so XML is not the only supported format.

Exam trap

The trap is overgeneralizing REST constraints — candidates assume REST must be synchronous or XML-only, when in fact REST is format-agnostic and supports async patterns via task polling.

Full explanation →
254
MCQeasy

Which programming language is most commonly used for Cisco Security automation tasks?

A.Java
B.Python
C.C++
D.PHP
AnswerB

Python dominates Cisco security automation because Cisco exposes SDKs such as requests-based RESTCONF and YANG tooling, plus libraries for SecureX and Firepower. It satisfies the stem as the language with the broadest first-party Cisco automation support.

Why this answer

Python is the industry standard for network and security automation due to its extensive library support and readability.

Full explanation →
255
MCQeasy

Which Cisco security product should you use if your main goal is to automate the blocking of malicious DNS queries?

A.Cisco Umbrella
B.Cisco Secure Web Appliance
C.Cisco Cloudlock
D.Cisco Secure Email
AnswerA

Cisco Umbrella resolves DNS in the cloud and enforces blocklists at the recursive resolver, so malicious domain queries are denied before any connection is made. Its policy and API-driven enforcement let administrators automate blocking across roaming clients and network devices without manual firewall rule changes.

Why this answer

Cisco Umbrella is the industry-standard cloud solution for DNS-layer security and policy automation.

Full explanation →
256
MCQeasy

A network security engineer is automating the deployment of Cisco Umbrella policies using the Umbrella API. The engineer needs to create a new destination list that blocks access to known malicious domains. Which HTTP method and endpoint should be used to create this list?

A.POST to /v1/destinationlists
B.GET to /v1/destinationlists
C.PUT to /v1/destinationlists/{id}
D.PATCH to /v1/destinationlists/{id}
AnswerA

The Cisco Umbrella API uses POST /v1/destinationlists to create a new destination list. The request body must include a name and a list of destinations. This is the correct method to programmatically create a block list for malicious domains.

Why this answer

To create a new destination list in Cisco Umbrella via the API, a POST request to /v1/destinationlists is required. The request body includes the list name and destinations. This is the standard RESTful approach for creating a resource in a collection.

Exam trap

The trap here is confusing the HTTP method for creating a resource with methods for updating or retrieving, such as PUT or GET.

Full explanation →
257
Multi-Selecthard

Which TWO steps are required to properly authenticate to the Cisco Firepower Management Center (FMC) API using the REST API Explorer?

Select 2 answers
A.Use Basic Auth in the header with admin credentials
B.Send a POST request to /api/fmc_platform/v1/auth/generatetoken
C.Perform a GET request to the root URL
D.Send credentials in the URL query string
E.Capture the X-auth-access-token header from the response
AnswersB, E

Sending a POST to /api/fmc_platform/v1/auth/generatetoken returns the authentication token required for subsequent FMC REST API calls, satisfying the stem's authentication requirement. The token is supplied via the X-auth-access-token header, and the call uses HTTP Basic credentials.

Why this answer

Option B is correct because the FMC REST API requires you to POST to the token-generation endpoint /api/fmc_platform/v1/auth/generatetoken, supplying credentials (typically Basic Auth) to obtain an authentication token. Option E is correct because the token returned in the response's X-auth-access-token header must be captured and reused in subsequent API calls as the authentication credential. The other options are incorrect: A is not one of the two required steps since Basic Auth is only the mechanism used within the generatetoken POST, not a standalone required step; C is unnecessary because a GET to the root URL does not authenticate you; and D is wrong because credentials must not be placed in the URL query string, as the FMC API expects them in the request header/body of the token request.

Full explanation →
258
MCQhard

You are using the Cisco Secure Endpoint (formerly AMP for Endpoints) API to query file trajectory data for a specific SHA-256 hash. The API returns a 429 Too Many Requests status code. What is the most efficient way to handle this in your automation script?

A.Switch from HTTPS to HTTP to reduce overhead.
B.Increase the API rate limit in the Cisco Secure Endpoint dashboard.
C.Force an authentication refresh on every request.
D.Implement an exponential backoff strategy with a retry logic.
AnswerD

Exponential backoff waits progressively longer after each 429, for example 1, 2, 4 and 8 seconds, with random jitter so many clients do not retry at once, and gives up after a set number of tries. If the response includes a Retry-After header or rate-limit reset time, use that value. In Python, urllib3's Retry or the tenacity library implement this pattern.

Why this answer

HTTP 429 Too Many Requests means the client has exceeded the API's rate limit, and the correct, standards-aligned response is to back off and retry. Exponential backoff (e.g., wait 1s, 2s, 4s, 8s, with jitter) with retry logic prevents hammering the API, respects the server's Retry-After header when present, and lets the script eventually succeed once the window resets. This is the recommended pattern in Cisco's Secure Endpoint API documentation and in RFC 6585, which defines 429.

Exam trap

SAUTO often tests whether candidates treat 429 as an authentication or configuration problem rather than a rate-limit signal, luring them toward credential refresh or dashboard changes instead of backoff-and-retry.

How to eliminate wrong answers

Option A is wrong because switching from HTTPS to HTTP does not change rate limiting and would break authentication/security — the API requires TLS, and the 429 is about request volume, not transport overhead. Option B is wrong because API rate limits are set by Cisco per tenant/plan and cannot be raised by the customer from the dashboard; there is no such self-service control. Option C is wrong because forcing an authentication refresh on every request actually increases API calls (token endpoint hits) and worsens rate-limit pressure, plus it is unnecessary since tokens are valid for a period.

Full explanation →
259
Multi-Selectmedium

Which THREE actions are essential when designing a secure automation script that interacts with the Cisco Secure Endpoint API?

Select 3 answers
A.Use the root admin password directly in the script
B.Implement exponential backoff for rate-limited responses
C.Store API credentials in an environment variable or secrets manager
D.Disable SSL verification to increase script speed
E.Implement robust logging for all API requests and responses
AnswersB, C, E

Exponential backoff retries rate-limited API calls with progressively longer delays, preventing the script from being throttled or blocked. This satisfies the requirement to handle Cisco Secure Endpoint API rate limits without losing requests or triggering defensive controls.

Why this answer

Option B is correct because the Cisco Secure Endpoint API enforces rate limits and returns HTTP 429 responses; exponential backoff with retry logic prevents the script from being throttled or blocked while handling transient failures gracefully. Option C is correct because hardcoding credentials in scripts exposes secrets in source control and logs; storing them in environment variables or a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) keeps API keys and client secrets out of the codebase and supports rotation. Option E is correct because robust logging of API requests and responses provides an audit trail for troubleshooting, detecting anomalies, and meeting compliance requirements, while ensuring sensitive data like tokens is redacted.

Option A is wrong because embedding the root admin password in a script violates least-privilege and secret-management principles, and the API should use dedicated API credentials rather than the root admin account. Option D is wrong because disabling SSL/TLS verification enables man-in-the-middle attacks and exposes credentials and data in transit, which is never acceptable for a secure automation script.

Exam trap

SAUTO often tests the misconception that convenience (e.g., disabling SSL or hardcoding credentials) improves automation, when in fact it introduces critical security vulnerabilities.

Full explanation →
260
Multi-Selectmedium

When managing Secure Endpoint through the API, which TWO pieces of information are used to track endpoint health?

Select 2 answers
A.Event logs
B.Network speed
C.BIOS version
D.Connector status
E.Installed printer drivers
AnswersA, D

Tracks activity.

Why this answer

Event logs (A) are correct because the Secure Endpoint API exposes event streams (e.g., /v1/event or /v1/events endpoints) that report detections, quarantines, and other activity used to gauge an endpoint's security health. Connector status (D) is correct because the API's computer/endpoint resource reports the connector's state (e.g., connected, disconnected, or the connector version and last-seen time), which directly indicates whether the endpoint is protected and communicating. Network speed (B) is a performance metric unrelated to endpoint security health, BIOS version (C) is a hardware/firmware attribute not used for health tracking, and installed printer drivers (E) are peripheral software details with no bearing on Secure Endpoint health.

Exam trap

SAUTO often tests the assumption that any system attribute (BIOS, network speed, drivers) is available via the security API, when in fact only security-relevant telemetry like connector status and event logs is exposed.

Full explanation →
261
MCQmedium

A script interacting with Cisco Cloudlock is receiving a 429 Too Many Requests error. What should the automation script implement to handle this gracefully?

A.Increase the timeout duration
B.Exponential backoff
C.Retry immediately
D.Switch to a different API key
AnswerB

Exponential backoff progressively increases the delay between retries after each 429, preventing the script from hammering Cloudlock's rate limiter and allowing the quota window to reset. This satisfies the stem's requirement to handle throttling gracefully without triggering further rejections.

Why this answer

Rate limiting (429) requires the implementation of an exponential backoff strategy.

Full explanation →
262
MCQmedium

When utilizing the Cisco Secure Email Reporting API, which format is best for programmatic data processing?

A.HTML
B.JSON
C.PDF
D.Raw binary logs
AnswerB

JSON is natively parsed by scripting languages, yielding structured key-value objects that map directly to code variables. This removes the brittle string splitting and positional parsing that flat or delimited formats force on automated pipelines.

Why this answer

JSON is the best format for programmatic data processing because it is structured, machine-parseable, and natively supported by virtually every programming language and automation framework. The Cisco Secure Email Reporting API returns JSON responses that can be directly consumed by scripts, SIEM integrations, or orchestration tools without parsing overhead.

Exam trap

SAUTO often tests whether candidates confuse human-readable formats (HTML, PDF) with machine-readable formats (JSON) — the trap is picking HTML because it looks structured, but it is not designed for programmatic parsing.

How to eliminate wrong answers

Option A is wrong because HTML is designed for human-readable web rendering and requires scraping or parsing libraries to extract data programmatically, which is fragile and inefficient. Option C is wrong because PDF is a presentation format optimized for printing and visual layout, not for machine parsing — extracting structured data from PDFs requires specialized libraries and is error-prone. Option D is wrong because raw binary logs are unstructured and require custom parsing logic; they are not a standardized API response format and are unsuitable for direct programmatic consumption without significant transformation.

Full explanation →
263
MCQmedium

Which component of a REST API request is used to pass information about the requested resource in the URL?

A.Cookies
B.Headers
C.Path parameters
D.Body
AnswerC

Path parameters are embedded directly within the URL path, for example /devices/{id}, so they identify the specific resource being addressed. Query parameters instead filter or modify the request after the path. This satisfies the stem's requirement for passing resource-identifying information in the URL itself.

Why this answer

Path parameters are embedded directly in the URL path and identify a specific resource — for example, /users/{id} where {id} is the path parameter. They are the standard REST mechanism for passing resource identifiers in the URL itself, distinguishing them from query strings, headers, and body content.

Exam trap

SAUTO often tests whether candidates confuse path parameters (resource identity in the URL path) with query parameters (filters/modifiers after ?) or with headers and body, which serve entirely different roles in HTTP.

How to eliminate wrong answers

Option A is wrong because cookies are sent in the Cookie header and carry session state, not resource identifiers in the URL. Option B is wrong because headers carry metadata (content type, auth tokens, caching directives) outside the URL. Option D is wrong because the request body carries the payload for POST/PUT/PATCH operations, not URL-embedded resource identifiers.

Full explanation →
264
MCQmedium

You are managing Cisco Cloudlock settings via the API. You need to ensure that specific SaaS file-sharing events are flagged. Which API object must you target to define a new policy violation trigger?

A.Policies API
B.Configuration API
C.Audit API
D.Applications API
E.Users API
AnswerA

The Policies API defines policy violation triggers, letting you specify which SaaS file-sharing events Cloudlock flags. It satisfies the requirement to create a new trigger by targeting the policy object directly, rather than querying events or configuring tenants. This is the correct endpoint for authoring detection rules.

Why this answer

The Cisco Cloudlock Policies API is the object used to create, retrieve, update, and delete policy definitions and their violation triggers. Policy violations in Cloudlock are defined as policy objects with matching criteria (e.g., file-sharing events, DLP patterns, user activity), so a new violation trigger must be created through the Policies API endpoint. The other APIs manage configuration, audit retrieval, application inventory, or user data — none of them define violation logic.

Exam trap

SAUTO often tests whether candidates confuse the read-only Audit API with the write-capable Policies API — the misconception that any API touching 'events' can define a violation trigger.

How to eliminate wrong answers

Option B is wrong because the Configuration API manages tenant-level settings and feature toggles, not the definition of policy violation triggers. Option C is wrong because the Audit API is read-only and returns event/audit records; it does not create or modify policy definitions. Option D is wrong because the Applications API enumerates and manages SaaS application metadata and onboarding, not policy rules.

Option E is wrong because the Users API handles user identity and account data, not policy violation logic.

Full explanation →
265
MCQmedium

You are using the Cisco Umbrella Investigate API to check if a specific IP address is associated with a known threat. Which domain of the API should you query?

A./ips/
B./files/
C./domains/
D./security/
AnswerA

The /ips/ endpoint returns threat intelligence for a specific IP address, including associated domains, ASNs and security categories. Querying it satisfies the requirement to check whether that IP is linked to a known threat, whereas /domains/ handles domain lookups instead.

Why this answer

The Umbrella Investigate API organizes its data by object type, and IP address intelligence is exposed under the /ips/ domain. Querying /ips/{ip} returns reputation, ASN, geolocation, and associated threat indicators for that IP. To check whether a specific IP is tied to a known threat, /ips/ is the correct endpoint.

Exam trap

SAUTO often tests whether candidates know the Investigate API's object-based URL structure, tempting them to pick a generic or wrong namespace like /security/ instead of the correct /ips/ endpoint.

How to eliminate wrong answers

Option B is wrong because /files/ is used to query file hash intelligence (e.g., SHA-256 reputation), not IP addresses. Option C is wrong because /domains/ is for domain reputation and categorization queries, not IPs. Option D is wrong because /security/ is not a valid Investigate API domain; the API uses object-specific namespaces like /ips/, /domains/, /files/, and /samples/.

Full explanation →
266
MCQmedium

Which of the following is a key advantage of using the Cisco Secure Email 'AsyncOS' API over manual CLI configuration for mass blocklist updates?

A.It allows direct access to the underlying OS kernel
B.It enables programmatic and repeatable updates across multiple appliances
C.It provides faster packet-level filtering
D.It bypasses the need for authentication
AnswerB

The AsyncOS API exposes REST endpoints that let scripts push blocklist changes to many appliances in one repeatable operation, eliminating per-device CLI sessions. This directly satisfies the mass-update constraint, ensuring consistent, auditable configuration across the fleet rather than error-prone manual entry.

Why this answer

The AsyncOS API for Cisco Secure Email exposes programmatic endpoints that let you push blocklist changes consistently across many appliances, which is the key advantage over manual CLI configuration. This enables repeatable, auditable automation instead of error-prone one-off commands. It does not grant kernel access, change packet filtering speed, or remove authentication requirements.

Exam trap

SAUTO often tests whether candidates confuse management-plane automation benefits with data-plane performance — the API improves consistency and speed of configuration, not packet filtering throughput.

How to eliminate wrong answers

Option A is wrong because the AsyncOS API operates at the application/management layer and does not expose the underlying OS kernel — that would be a security and stability risk Cisco does not permit. Option C is wrong because packet-level filtering performance is determined by the email gateway's data plane, not by whether configuration is applied via API or CLI; the API changes management, not throughput. Option D is wrong because AsyncOS API calls require authentication (typically via API keys or credentials), and bypassing authentication is neither possible nor desirable.

Full explanation →
267
MCQmedium

You are using Postman to test an API that requires an API key in the header. Where should this be configured in Postman?

A.Params tab
B.Headers tab
C.Body tab
D.Authorization tab
AnswerB

The Headers tab accepts arbitrary key–value pairs sent with every request, so an API key header such as `x-api-key: <value>` is transmitted exactly as the API expects. This satisfies the stem's requirement that the key travel in the request header, unlike query parameters or the body.

Why this answer

The Headers tab in Postman is where you configure custom HTTP headers, including API keys that must be sent in the request header (e.g., 'X-API-Key: abc123'). This is the correct location because API keys in headers are not part of the URL, body, or authorization framework.

Exam trap

SAUTO often tests the confusion between the Authorization tab and the Headers tab — candidates may think all auth-related configuration belongs in Authorization, but custom API key headers are configured in Headers.

How to eliminate wrong answers

Option A is wrong because the Params tab is for query parameters appended to the URL (e.g., ?key=value), not for headers. Option C is wrong because the Body tab is for the request payload (JSON, form data, etc.), not for headers. Option D is wrong because the Authorization tab is specifically for standard auth schemes like Basic, Bearer, OAuth 2.0, and API Key — but when API Key is selected there, Postman adds it as a header or query param automatically; however, the question asks where to configure it manually, and the Headers tab is the direct location.

Additionally, some APIs require custom header names that the Authorization tab's API Key helper may not support.

Full explanation →
268
MCQeasy

A security operations team wants to automatically block domains that appear in Cisco Umbrella Investigate results for newly registered malicious infrastructure. The automation will call the Umbrella Management API to add those domains to a destination list. Which API object must the script modify to add a domain to a destination list?

A.The destination list's destinations collection, using a POST that includes the domain name and a comment.
B.The identities collection, by adding a new identity for the malicious domain.
C.The Investigate API's domain categorization endpoint, by submitting a new category label for the domain.
D.The policies collection, by creating a new policy that references the domain as a rule name.
AnswerA

Destination lists in the Umbrella Management API hold entries in a destinations collection. Adding a domain is a POST to that collection with the domain value and optional comment. This is exactly the operation the automation needs: after Investigate confirms the domain is malicious, the script posts it to the list, and Umbrella begins enforcing the block for identities associated with that list.

Why this answer

Enforcement in Umbrella is driven by destination lists, and their entries live in a destinations collection within the Management API. Adding a malicious domain is a POST to that collection with the domain and an optional comment. Identities, policies, and Investigate categorization endpoints do not store or enforce blocked domains, so they cannot accomplish the automated block.

Exam trap

The trap here is confusing the identity or policy objects with the destinations collection where blocked domains are actually stored.

Full explanation →
269
MCQhard

You are troubleshooting a Python script using the Cisco pxGrid API. The script fails to receive notifications from ISE. Which component must be verified first?

A.The local machine's DNS settings.
B.The pxGrid controller status and connection state.
C.The ISE ERS API status.
D.The TACACS+ shared secret.
AnswerB

Notifications flow only through an established pxGrid connection, so the controller's status and the client's connection state must be verified first. If the controller is down or the session is not subscribed, no notifications will ever arrive.

Why this answer

The pxGrid connection state must be established and 'active' to receive notifications. The connection is a two-way handshake process.

Full explanation →
270
Multi-Selectmedium

When using the Cisco Threat Grid API, which TWO methods can be used to retrieve report data?

Select 2 answers
A.GET by ID
B.DELETE by report
C.POST by ID
D.PUT by search
E.GET by search query
AnswersA, E

The Threat Grid API exposes a submission endpoint addressed by its unique identifier, returning the full report for that sample. Supplying the ID directly satisfies the stem's requirement for a supported method of retrieving report data.

Why this answer

Option A (GET by ID) is correct because the Threat Grid API exposes a REST endpoint such as GET /api/v2/samples/{id} or /api/v2/submissions/{id} that returns the full report for a specific sample or submission identified by its unique ID. Option E (GET by search query) is correct because the API also supports GET requests against search endpoints (e.g., /api/v2/search/submissions or /api/v2/search/samples) with query parameters, allowing report data to be retrieved by matching criteria rather than a single ID. The remaining options do not belong: DELETE by report (B) removes or deletes a resource rather than retrieving report data, POST by ID (C) is used to create or submit resources, and PUT by search (D) is used to update or replace a resource, not to fetch reports.

Exam trap

SAUTO often tests whether candidates assume any HTTP verb can carry a query — the trap is forgetting that search is still a GET operation, not POST or PUT.

Full explanation →
271
MCQmedium

A script needs to update a Cisco Firepower object. Which API workflow is correct?

A.POST directly to the object ID.
B.PATCH the entire configuration file.
C.DELETE the object, then POST a new version.
D.GET to retrieve current state, then PUT the updated state.
AnswerD

Firepower objects use REST semantics: GET returns the object's current representation, including its version identifier, then PUT submits the modified body. Supplying the retrieved state prevents overwriting concurrent changes and satisfies the API's version-check requirement.

Why this answer

The correct workflow for updating a Cisco Firepower object via the REST API is to first perform a GET request to retrieve the current representation of the object, modify the desired fields, and then send a PUT request with the complete updated object. This ensures that all existing properties are preserved and only the intended changes are applied. The Firepower Management Center (FMC) API requires the full object body for PUT operations, so retrieving the current state is mandatory to avoid overwriting unspecified fields with nulls or defaults.

Exam trap

SAUTO often tests the misconception that REST APIs support partial updates via PATCH or that POST can be used for updates, but Cisco Firepower specifically requires a full-object PUT after a GET, and candidates who assume flexibility from other APIs fall for distractor options like PATCH or DELETE-then-POST.

How to eliminate wrong answers

Option A is wrong because POST to an object ID is not a valid update method; POST is used to create new resources, and targeting an existing ID with POST typically results in an error or unintended duplication. Option B is wrong because PATCH is not supported for Firepower object updates; the API does not accept partial modifications, and attempting to PATCH the entire configuration file is both technically invalid and impractical. Option C is wrong because deleting and recreating an object changes its unique identifier, breaks references from policies or rules, and is not an atomic update, leading to potential inconsistencies and downtime.

Full explanation →
272
MCQmedium

In the context of the Cisco ASA REST API, what is the role of the 'ETag' header in an API response?

A.To cache the response
B.To provide concurrency control for updates
C.To identify the user session
D.To encrypt the payload
AnswerB

The ETag header carries a resource version identifier; clients return it via If-Match so the ASA rejects updates when the resource changed since retrieval, preventing lost updates. This satisfies the stem's concurrency control requirement by enforcing optimistic locking on conflicting simultaneous modifications.

Why this answer

The ETag (Entity Tag) is used for concurrency control. It ensures that when you update a resource, you are modifying the version you expect, preventing 'lost updates'.

Full explanation →
Page 3

Page 4 of 4

All pages

1234

Practice SAUTO by domain

Target a specific domain to shore up weak areas.

Network SecurityAdvanced Threat And Endpoint SecurityNetwork Programmability FoundationCloud Web And Email Security Automation
See all domains with question counts →