SAUTO · domain
Network Security
This domain covers programmatic interaction with Cisco security platforms: ASA REST API access rules, Firepower/FMC and Umbrella APIs, and DevNet sandbox usage. Questions test API documentation types, request payload formats, authentication, and secure design principles when automating firewall and policy changes across Cisco security products.
Focused practice
Practice Network Security questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about Network Security
You must be able to identify Cisco Security API documentation types, use DevNet sandboxes correctly, and send properly formatted JSON to the ASA REST API for firewall rule changes. Getting the request body format and authentication right is most important.
Cisco DevNet sandbox purpose for testing security APIs without production impact
Types of Cisco Security API documentation including Swagger/OpenAPI and DevNet references
Secure network design principles for API authentication, authorization, and encrypted transport
Watch out for
Common Network Security exam traps
- ▸Assuming ASA REST API accepts XML or form-encoded bodies when JSON is required for access control entries
- ▸Confusing DevNet sandbox with production environments, missing that sandboxes are isolated test instances
- ▸Overlooking authentication token handling and HTTPS requirements, treating API calls as unauthenticated requests
Question index
All Network Security questions (75)
Click any question to see the full explanation, or start a practice session above.
Which TWO of the following are components of a URL? (Choose two)
Medium2When automating Cisco Stealthwatch (Secure Network Analytics) alerts, which API endpoint is used to query flow data?
Medium3Which TWO of the following steps are involved in the Cisco Firepower API authentication workflow? (Choose two)
Hard4You are performing a bulk update of Security Group Tags (SGTs) in Cisco ISE. Which mechanism should you prioritize to minimize load on the API when processing thousands of tags?
Hard5Which TWO of the following are primary benefits of automating Cisco security policies via APIs? (Choose two)
Medium6A network security engineer is using Ansible to automate configuration of Cisco ASA firewalls. The engineer needs to ensure that the playbook can handle authentication to the ASA devices securely without hardcoding credentials. Which Ansible feature should be used to store and retrieve the ASA credentials?
Medium7You are automating Firepower Management Center event retrieval. You notice your script is getting an HTTP 429 response. What should your automation script implement?
Hard8You are automating Cisco ASA firewall rule updates using the REST API. Which data format is required in the request body when pushing a new access control entry?
Medium9Which TWO of the following are valid methods for interacting with Cisco ISE programmatically?
Medium10Which Cisco security product API supports 'Bulk' operations to improve efficiency when modifying large numbers of objects?
Medium11You are automating Cisco Firepower Management Center (FMC) object creation using the REST API. You successfully POST a new network object, but the changes do not appear on the managed Firepower Threat Defense (FTD) device. What is the mandatory final step to ensure the changes take effect?
Medium12What is the primary function of a 'Bearer Token' in an API request?
Easy13You are configuring an Ansible playbook to manage Cisco Firepower policies. Which module is specifically designed to interact with FMC objects?
Medium14When interacting with the Cisco ISE ERS API, you receive an HTTP 401 error. What is the most likely cause?
Hard15Which THREE of the following are common issues encountered when automating Cisco Security APIs? (Choose three)
Hard16Which THREE of the following are key considerations when designing an automated security script? (Choose three)
Hard17You are using the Cisco ASA REST API to retrieve the current status of an interface. Which HTTP method should be used to perform this read operation?
Easy18A network engineer is using the Cisco Firepower Management Center (FMC) API to retrieve access control policy information. Which HTTP method should be used to perform a read-only request for a specific policy resource?
Easy19You are running a script that interacts with the Cisco ISE ERS API. The script is designed to perform a bulk import of users. Which HTTP code should you expect for a successful creation request?
Hard20Which element in an API request is most often used to filter the amount of data returned?
Medium21Which THREE of the following actions can be automated via the Cisco ASA REST API?
Hard22Which protocol is primarily used for the transport of API calls in the Cisco security portfolio?
Easy23Which THREE of the following are methods used in REST APIs? (Choose three)
Hard24When using the Cisco ISE ERS API, what is the impact of not specifying the 'Accept' header in your request?
Hard25When working with Cisco Firepower API, what is the role of the 'ETag' header in an API response?
Hard26Which Python library is the industry standard for sending HTTP requests to Cisco security APIs?
Easy27Which TWO of the following are key features of the Cisco DevNet site? (Choose two)
Medium28You are using the Cisco Firepower Management Center (FMC) API to retrieve a list of Access Control Policies. Which URL endpoint is correct?
Medium29Which TWO components are typically required to initiate a connection to the Cisco Umbrella API?
Easy30In a Cisco security automation environment, what does the 'API Rate Limit' represent?
Easy31Which TWO of the following are true regarding the Cisco Firepower Management Center (FMC) API?
Medium32When designing secure network automation, which practice is considered the most critical for API credentials?
Easy33When using the Cisco Umbrella Reporting API, what is the default limit for the number of records returned in a single GET request?
Medium34You are automating the deployment of Cisco ASA firewall rules using the ASA REST API. You need to ensure that the API calls are secure and that changes are properly applied. Which two practices are essential for secure and successful automation? (Choose two.)
Hard35When automating security, which methodology is used to treat infrastructure configurations as code?
Medium36What does the 'Authorization' header in a REST API call carry?
Easy37When using the Cisco SecureX API, what is the purpose of the 'Application Name' field in the API client registration?
Hard38Which TWO of the following are true about Cisco Firepower API? (Choose two)
Medium39Which Cisco security component provides visibility and control over cloud-based threats?
Easy40A security engineer is automating Cisco Firepower Management Center (FMC) using its REST API. The script must create a new access control policy and then deploy it to managed devices. After creating the policy, the engineer attempts to deploy it but receives an HTTP 400 error stating 'Deployment failed: policy not associated with any device.' What is the most likely cause?
Hard41In Python, which HTTP library is most recommended for interacting with Cisco Security APIs due to its simplicity and features?
Easy42You are writing a script to parse FMC API response data. The response is a nested JSON object. Which Python library is standard for handling this task?
Medium43Which authentication method is most commonly used by Cisco SecureX for API access?
Medium44Which Cisco technology allows you to automate the distribution of Indicators of Compromise (IoCs) across the security stack?
Medium45When automating Cisco Stealthwatch, which authentication type is utilized for the API?
Medium46You are utilizing the Cisco ISE ERS API to provision a guest account. If the API returns a '409 Conflict', what is the most likely cause?
Hard47Which Cisco tool is best suited for centralizing the management of security APIs across multiple platforms?
Medium48When automating threat hunting with the Cisco SecureX Threat Response API, which object type is commonly used as a search parameter?
Medium49Which TWO of the following are characteristics of the Cisco ISE ERS API? (Choose two)
Hard50You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?
Hard51A security automation engineer is writing a Python script that uses the Cisco Firepower Management Center (FMC) REST API to modify an existing access control policy. The script must first obtain the current policy object, change its default action, and then submit the update. Which HTTP method and endpoint pattern should the script use to apply the change to the existing policy?
Medium52An engineer is automating Cisco Identity Services Engine (ISE) using the External RESTful Services (ERS) API. After creating a new endpoint group with a POST request, the engineer wants to verify the group was created and retrieve its unique identifier. Which HTTP method and endpoint should be used to retrieve the details of the newly created endpoint group?
Medium53What is the primary function of an API 'sandbox' in Cisco DevNet?
Easy54Which TWO of the following are types of Cisco Security API documentation? (Choose two)
Medium55Which THREE of the following are core principles of Secure Network Design when using APIs?
Hard56Which THREE of the following fields are commonly found in a JSON API response object? (Choose three)
Medium57You are automating Cisco Firepower Management Center (FMC) via the REST API. You need to update an existing object. Which HTTP method must you use to ensure a full update of the resource representation?
Medium58You are automating Firepower Management Center (FMC) object creation using the REST API. You send a POST request to /api/fmc_config/v1/domain/{domainUUID}/object/networkaddresses with a body containing a name and type. The request returns a 400 Bad Request error. What is the most likely cause?
Medium59When automating Cisco Security solutions, what is the primary benefit of using a 'Service Account' instead of a personal user account for API authentication?
Hard60Which TWO of the following are valid ways to test Cisco APIs before deployment? (Choose two)
Medium61You are developing a Python script to automate Cisco Umbrella enforcement of security policies. The script must retrieve the list of identities and then apply a block action to a specific domain. Which API endpoint and method should you use to apply the block action?
Medium62You are automating threat response using Cisco Threat Response. You want to retrieve a list of verdicts for a specific observable (e.g., an IP address). Which API provides this capability?
Hard63In the context of the Cisco Firepower API, what does a 'GET' request to '/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies' return?
Hard64You are automating Cisco Identity Services Engine (ISE) using the External RESTful Services (ERS) API. Your Python script needs to query all network devices and then update a specific device group. After authenticating with HTTPS Basic Authentication, you receive an HTTP 401 response when attempting to retrieve devices. Which action should you take to resolve this?
Medium65When using the FMC API, what is the purpose of the 'X-Auth-Access-Token' header?
Easy66Which THREE of the following are best practices for managing API keys? (Choose three)
Hard67You are configuring a CI/CD pipeline to deploy Cisco ASA firewall rules. Which step is essential to ensure the changes are correct before applying them to production?
Medium68Which Cisco security product uses the pxGrid framework to share contextual information with other network devices?
Easy69A network security engineer is writing a Python script to interact with the Cisco Identity Services Engine (ISE) External RESTful Services (ERS) API. The script must create a new endpoint and then retrieve its details. Which HTTP status code should the script expect upon successful creation of the endpoint?
Easy70A security engineer is automating Cisco Identity Services Engine (ISE) using the REST API. The script must retrieve a list of all network devices configured in ISE. Which API endpoint should the engineer use?
Medium71Which programming language is most commonly used for Cisco Security automation tasks?
Easy72Which TWO steps are required to properly authenticate to the Cisco Firepower Management Center (FMC) API using the REST API Explorer?
Hard73You are troubleshooting a Python script using the Cisco pxGrid API. The script fails to receive notifications from ISE. Which component must be verified first?
Hard74A script needs to update a Cisco Firepower object. Which API workflow is correct?
Medium75In the context of the Cisco ASA REST API, what is the role of the 'ETag' header in an API response?
MediumOther domains
All SAUTO exam domains
Frequently asked questions
- What does the Network Security domain cover on the SAUTO exam?
- You must be able to identify Cisco Security API documentation types, use DevNet sandboxes correctly, and send properly formatted JSON to the ASA REST API for firewall rule changes. Getting the request body format and authentication right is most important.
- How many questions are in this domain?
- This page lists all 75 Network Security questions in the SAUTO question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only Network Security questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.