Advanced Threat And Endpoint Security

You are automating the deletion of a sandbox report in Threat Grid. Which HTTP method should you use?

A security automation engineer is writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of computers. The script must handle pagination because the environment has thousands of endpoints. Which HTTP response header should the script inspect to determine the URL for the next page of results?

How do you retrieve the API credentials for Cisco Secure Endpoint?

When using the Umbrella Investigate API, what does the 'co-occurrences' result represent?

You are building a SOAR playbook that ingests observables from Cisco Threat Response and needs to automatically create a case in Cisco Threat Response for every observable that has a verdict of 'malicious'. After authenticating with the Cisco Threat Response API, which HTTP method and endpoint should your playbook use to create a new case?

Which Python library is most commonly used for handling REST API requests in SecureX automation scripts?

You are developing an integration for the Cisco Secure Endpoint API. What is the result of using a pagination parameter?

What is the function of the Cisco SecureX 'Threat Response' module?

Your automated script is designed to update a Cisco Umbrella policy. What is the correct procedure to ensure that changes do not cause downtime?

In a Cisco Threat Grid API workflow, what does the 'state' field in the analysis report indicate?

You are automating the quarantine of endpoints in Cisco Secure Endpoint (formerly AMP for Endpoints) using its API. Your script must first obtain an access token and then perform actions. Which TWO statements are correct about authenticating to the Cisco Secure Endpoint API? (Choose two.)

You are using the Cisco Umbrella API. Which TWO of the following are valid ways to manage domain blocking?

What is the primary function of the Cisco SecureX 'Inspect' feature when using the browser extension?

Which THREE types of observables can be looked up using the Cisco SecureX Threat Intelligence API?

Which component of Cisco SecureX allows users to create automation workflows without writing code?

Which THREE components are typically involved in a SecureX orchestration workflow that automates the isolation of a host based on an Umbrella alert?

Which data format is primarily used by all Cisco Security APIs (Secure Endpoint, Umbrella, Threat Grid)?

When managing Cisco Umbrella policies, which TWO types of destination lists can you create via the API?

You are automating a threat hunt using SecureX. Which API response field confirms that an observable is malicious?

You are developing a script to pull Threat Grid sandbox reports. You receive a 401 Unauthorized error. What is the most likely cause?

Which Cisco technology provides a unified dashboard to visualize data from AMP, Umbrella, and Threat Grid?

An automation script is querying the Cisco Secure Endpoint (AMP for Endpoints) API to retrieve file trajectory data for a specific SHA-256 hash. The script is returning a 429 status code. What is the most efficient way to handle this in your automation code?

Which TWO methods are used by the Cisco Threat Grid API to notify external systems when a file analysis has completed?

You are automating Cisco Umbrella policy changes using the Umbrella API. Which resource is used to update the blocked destination list?

When using the SecureX Orchestration 'HTTP Request' activity, what is the best practice for handling sensitive API keys?

Which TWO parameters are typically required for paginating through large result sets in the Secure Endpoint API?

An automation engineer is using Cisco SecureX Orchestration to build a workflow that automatically creates a ticket in a ticketing system when a high-severity alert is detected by Cisco Secure Endpoint. The engineer needs to pass the alert details, such as the endpoint hostname and the detection name, to the ticketing system. Which SecureX Orchestration feature should be used to extract these specific values from the alert payload?

You are automating the deployment of Cisco Umbrella Roaming Client to a large number of remote Windows endpoints using a configuration management tool. To ensure the client registers correctly and enforces policies, you need to provide the necessary parameters during silent installation. Which two parameters are required for a successful silent installation of the Cisco Umbrella Roaming Client? (Choose two.)

Which TWO items are required to properly authenticate a SecureX API request using an API Client?

In Cisco SecureX Orchestration, you are building an atomic workflow to isolate an endpoint. Which input parameter is required to identify the target host in the Secure Endpoint 'Isolate Host' activity?

Which of the following is a core benefit of using APIs for Cisco Security?

You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?

You are configuring an Umbrella API callback. What happens if the callback URL is unreachable?

You are configuring a SecureX workflow to notify a team. Which THREE notification methods are available via standard activities?

Your script is pulling alerts from the Cisco Secure Endpoint API and needs to filter for only 'Critical' detections. How is this filtering best accomplished?

Which Python library is most commonly used in Cisco security automation scripts to interact with REST APIs?

When automating threat hunting with Cisco SecureX, which object type is used to represent an observable that has been aggregated from multiple sources?

When investigating an IP address in Cisco SecureX, which TWO pieces of intelligence data are typically provided by the Threat Intelligence API?

In a Python script, how do you handle a 202 Accepted response from the Threat Grid API during file submission?

You are developing a script to automate the creation of a new destination list in Cisco Umbrella using the Umbrella Enforcement API. The script must ensure that the list is created only if it does not already exist. Which HTTP status code should your script check for after attempting to create the list to determine if it already exists?

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

Which Cisco Secure Endpoint feature allows automated movement of hosts into different groups based on threat activity?

In Threat Grid, what is the purpose of the 'Tags' field in an analysis report submission?

Which THREE components are required to configure an API client for Cisco SecureX?

Which TWO of the following are benefits of using the Cisco Secure Endpoint API for automated threat hunting?

Which TWO actions can be automated via the Cisco Secure Endpoint API to improve incident response?

Which THREE features are provided by the Cisco SecureX API documentation?

You are writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of all endpoints in your organization. After authenticating with OAuth 2.0, you need to handle pagination because the API returns a limited number of results per page. Which HTTP response header should your script inspect to obtain the URL for the next page of results?

Which TWO of the following are valid ways to obtain threat intelligence data within the Cisco SecureX ecosystem?

Which THREE headers are commonly used when sending authenticated requests to Cisco Security APIs?

What is the benefit of integrating Cisco Threat Grid with Secure Endpoint?

You are automating the deletion of an indicator in Cisco Threat Grid. Which HTTP method must be used to ensure the request is idempotent and compliant with the RESTful design of the API?

When using the Cisco Umbrella Reporting API, which format is the default output for retrieving threat activity logs to ensure compatibility with most data analysis tools?

When writing a Python request to the SecureX API, which Content-Type header is required for POST requests?

A network security engineer is automating the deployment of Cisco Umbrella policies using the Umbrella API. The engineer needs to create a new destination list that blocks access to known malicious domains. Which HTTP method and endpoint should be used to create this list?

You are using the Cisco Secure Endpoint (formerly AMP for Endpoints) API to query file trajectory data for a specific SHA-256 hash. The API returns a 429 Too Many Requests status code. What is the most efficient way to handle this in your automation script?

Which THREE actions are essential when designing a secure automation script that interacts with the Cisco Secure Endpoint API?

When managing Secure Endpoint through the API, which TWO pieces of information are used to track endpoint health?

You are using the Cisco Umbrella Investigate API to check if a specific IP address is associated with a known threat. Which domain of the API should you query?

When using the Cisco Threat Grid API, which TWO methods can be used to retrieve report data?