troubleshooting

You are automating the deletion of a sandbox report in Threat Grid. Which HTTP method should you use?

Which TWO of the following are components of a URL? (Choose two)

Which data format is the standard for Cisco's cloud-based security APIs?

You are automating Cisco Adaptive Security Appliance (ASA) configurations using NETCONF. Which protocol data store should you target to ensure your changes take effect immediately in the running configuration?

When automating Cisco Stealthwatch (Secure Network Analytics) alerts, which API endpoint is used to query flow data?

You need to retrieve the current status of all Cisco Umbrella 'Virtual Appliances' using the API. Which API resource is the most appropriate?

Which THREE actions are essential when implementing a Python-based automation script that interacts with a Cisco REST API using the 'requests' library to ensure secure communication?

You are automating policy updates for Cisco Umbrella using the Umbrella Management API. You need to identify the correct endpoint to retrieve the list of destination lists for a specific organization. Which HTTP method and path should you use?

When using the Cisco ISE REST API, what does the 'ERAS' (External RESTful Services) framework provide?

Which TWO of the following steps are involved in the Cisco Firepower API authentication workflow? (Choose two)

You are performing a bulk update of Security Group Tags (SGTs) in Cisco ISE. Which mechanism should you prioritize to minimize load on the API when processing thousands of tags?

Which TWO of the following are primary benefits of automating Cisco security policies via APIs? (Choose two)

A network security engineer is using Ansible to automate configuration of Cisco ASA firewalls. The engineer needs to ensure that the playbook can handle authentication to the ASA devices securely without hardcoding credentials. Which Ansible feature should be used to store and retrieve the ASA credentials?

You are automating Firepower Management Center event retrieval. You notice your script is getting an HTTP 429 response. What should your automation script implement?

Which THREE of the following are valid HTTP methods supported by REST APIs for managing network configurations?

You are designing a YANG model for a custom security policy. Which statement accurately describes the function of a 'leaf' node in YANG?

You are automating Cisco ASA firewall rule updates using the REST API. Which data format is required in the request body when pushing a new access control entry?

Which TWO of the following are true regarding the 'requests' library's exception handling?

You are writing a script that interacts with Cisco DNA Center. You need to keep the session alive after authentication. Which token is commonly used for subsequent API calls?

A security automation engineer is writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of computers. The script must handle pagination because the environment has thousands of endpoints. Which HTTP response header should the script inspect to determine the URL for the next page of results?

How do you retrieve the API credentials for Cisco Secure Endpoint?

Which JSON-related error occurs if you try to parse a string that is missing a closing brace?

When using the Umbrella Investigate API, what does the 'co-occurrences' result represent?

What is the primary advantage of using JSON over XML when interacting with modern Cisco security APIs?

When designing an automation workflow using Postman, which feature allows you to dynamically pass a value from the response of one request to the input of a subsequent request?

You are building a SOAR playbook that ingests observables from Cisco Threat Response and needs to automatically create a case in Cisco Threat Response for every observable that has a verdict of 'malicious'. After authenticating with the Cisco Threat Response API, which HTTP method and endpoint should your playbook use to create a new case?

While testing a REST API call in Postman for Cisco ISE, you receive a 403 Forbidden error. What is the most likely cause of this issue in the context of network programmability?

You are building a Python automation that rotates the API key used by a Cisco Umbrella Reporting API integration every 30 days. The script authenticates with the Umbrella Management API to create a new key and then deletes the old key. Which HTTP header must every Management API request include to prove the caller is authorized?

Which statement best describes JSON?

You are automating the blocking of a specific URL on a Cisco WSA. You have verified the API reachability, but the rule is not being applied. What is the most common reason?

Which THREE of the following are common benefits of using REST APIs for network automation?

Which Python library is most commonly used for handling REST API requests in SecureX automation scripts?

Which TWO of the following are valid methods for interacting with Cisco ISE programmatically?

You are developing an integration for the Cisco Secure Endpoint API. What is the result of using a pagination parameter?

What is the function of the Cisco SecureX 'Threat Response' module?

Which Cisco security product API supports 'Bulk' operations to improve efficiency when modifying large numbers of objects?

In an HTTP request, what does the '201 Created' status code signify?

Your automated script is designed to update a Cisco Umbrella policy. What is the correct procedure to ensure that changes do not cause downtime?

You are writing a Python script to retrieve a list of network objects from a Cisco Firepower Management Center (FMC) using its REST API. The script authenticates with a username and password and must maintain the session for subsequent requests. Which authentication mechanism should the script use to obtain a token that is valid for the duration of the session?

In a Cisco Threat Grid API workflow, what does the 'state' field in the analysis report indicate?

You are automating the quarantine of endpoints in Cisco Secure Endpoint (formerly AMP for Endpoints) using its API. Your script must first obtain an access token and then perform actions. Which TWO statements are correct about authenticating to the Cisco Secure Endpoint API? (Choose two.)

You are using the Cisco Umbrella API. Which TWO of the following are valid ways to manage domain blocking?

You are automating Cisco Firepower Management Center (FMC) object creation using the REST API. You successfully POST a new network object, but the changes do not appear on the managed Firepower Threat Defense (FTD) device. What is the mandatory final step to ensure the changes take effect?

Which of the following is a key requirement for using the Cisco Umbrella API successfully?

What is the primary function of a 'Bearer Token' in an API request?

What is the primary function of the Cisco SecureX 'Inspect' feature when using the browser extension?

Which THREE of the following are examples of SaaS security posture automation tasks you can perform with the Cloudlock API?

You are troubleshooting a Python script that uses the 'requests' library. The script fails with a 'SSLError'. What is the most likely cause?

Which THREE types of observables can be looked up using the Cisco SecureX Threat Intelligence API?

You are configuring an Ansible playbook to manage Cisco Firepower policies. Which module is specifically designed to interact with FMC objects?

When interacting with the Cisco ISE ERS API, you receive an HTTP 401 error. What is the most likely cause?

When integrating Cisco Umbrella with a SOAR platform, what is the best practice for handling API rate limits?

Which component of Cisco SecureX allows users to create automation workflows without writing code?

Which THREE of the following are common issues encountered when automating Cisco Security APIs? (Choose three)

Which THREE of the following are key considerations when designing an automated security script? (Choose three)

You are automating the deletion of an old Umbrella API key. Why is it important to ensure that no active scripts are using this key before deletion?

You are using the Cisco ASA REST API to retrieve the current status of an interface. Which HTTP method should be used to perform this read operation?

A network engineer is using the Cisco Firepower Management Center (FMC) API to retrieve access control policy information. Which HTTP method should be used to perform a read-only request for a specific policy resource?

Which THREE of the following are common benefits of using NETCONF for device management?

You are running a script that interacts with the Cisco ISE ERS API. The script is designed to perform a bulk import of users. Which HTTP code should you expect for a successful creation request?

You are writing a script to check for new security policy updates on a Cisco WSA. You notice that your script pulls the same configuration repeatedly. What should you use to check if the policy has changed?

Which THREE components are typically involved in a SecureX orchestration workflow that automates the isolation of a host based on an Umbrella alert?

When interacting with the Cisco WSA API, you want to retrieve the 'System Status'. What does the 'uptime' field in the JSON response represent?

A network engineer is testing a Cisco ASA REST API call using Postman. The request returns a 401 Unauthorized status code. What is the most likely cause of this error?

Which element in an API request is most often used to filter the amount of data returned?

Which data format is primarily used by all Cisco Security APIs (Secure Endpoint, Umbrella, Threat Grid)?

Which THREE of the following actions can be automated via the Cisco ASA REST API?

Which protocol is primarily used for the transport of API calls in the Cisco security portfolio?

You are writing an automation that pulls incident data from Cisco Cloudlock's Incidents API for a daily security report. The script currently retrieves only the first page of results and silently drops the rest, so the report undercounts high-severity events. Which change should you make to ensure the script captures every incident in the requested window?

When using the Cisco Secure Email (formerly ESA) AsyncOS API to fetch message tracking data, what is the mandatory header required for authentication?

When performing an API audit, you want to ensure that all requests are logged. In Postman, which feature can you use to view the raw HTTP request and response details?

When managing Cisco Umbrella policies, which TWO types of destination lists can you create via the API?

Which THREE of the following are methods used in REST APIs? (Choose three)

When using the Cisco ISE ERS API, what is the impact of not specifying the 'Accept' header in your request?

When working with Cisco Firepower API, what is the role of the 'ETag' header in an API response?

When using the 'ncclient' library in Python, what is the primary purpose of the 'manager.connect()' method?

You are automating a threat hunt using SecureX. Which API response field confirms that an observable is malicious?

Which Python library is the industry standard for sending HTTP requests to Cisco security APIs?

You are developing a script to pull Threat Grid sandbox reports. You receive a 401 Unauthorized error. What is the most likely cause?

You are using the Cisco Cloudlock API to retrieve a list of users. The API returns an 'error: 403 Forbidden'. What is the most likely cause?

Which Cisco technology provides a unified dashboard to visualize data from AMP, Umbrella, and Threat Grid?

Which Cisco security product uses the 'AsyncOS' platform, and for which automation tasks is its API most commonly used?

Which THREE of the following are valid methods within a Python script to handle potential errors when making API calls to a Cisco platform?

Which TWO of the following are key features of the Cisco DevNet site? (Choose two)

You are using the Cisco Firepower Management Center (FMC) API to retrieve a list of Access Control Policies. Which URL endpoint is correct?

When working with Cisco security APIs, which authentication mechanism is most commonly required to maintain a session after the initial credentials have been exchanged?

Which tool is best suited for testing Umbrella API queries before deploying them into your automated production script?

An automation script is querying the Cisco Secure Endpoint (AMP for Endpoints) API to retrieve file trajectory data for a specific SHA-256 hash. The script is returning a 429 status code. What is the most efficient way to handle this in your automation code?

When managing Cisco devices via RESTCONF, what is the benefit of using the 'PATCH' method instead of 'PUT'?

Which TWO components are typically required to initiate a connection to the Cisco Umbrella API?

You are writing a Python script to interact with the Cisco Secure Web Appliance (WSA) REST API to pull 'Access Logs'. When parsing the response, you notice the data is chunked. What is the most appropriate way to handle large log datasets when using the REST API?

Which TWO of the following are true regarding YANG models?

In a Cisco security automation environment, what does the 'API Rate Limit' represent?

Which TWO of the following are true regarding the Cisco Firepower Management Center (FMC) API?

A Python script authenticates to the Cisco Identity Services Engine (ISE) REST API and must send the credentials in a way that avoids placing them in the URL. Which approach correctly satisfies this requirement when using the requests library?

You are automating Cisco Cloudlock incident retrieval with a Python script. The script must authenticate and then fetch incidents filtered by severity. Which two elements are required to build a valid Cloudlock API request for this purpose? (Choose two.)

When designing secure network automation, which practice is considered the most critical for API credentials?

Which TWO methods are used by the Cisco Threat Grid API to notify external systems when a file analysis has completed?

Which THREE of the following are true about the Cisco Umbrella API?

An engineer runs a Python script that calls the Cisco Firepower Management Center (FMC) REST API to list all access control policies. The script uses the requests library and the response object r. Which attribute of r gives the HTTP status code so the script can branch on success versus failure?

When using the Cisco Umbrella Reporting API, what is the default limit for the number of records returned in a single GET request?

A security automation engineer is building a Python script that queries the Cisco Firepower Management Center (FMC) REST API to retrieve a list of intrusion policies. The engineer wants to ensure the script can handle the case where the requested resource does not exist, returning a 404 status code. Which HTTP status code class indicates a client error, and how should the script interpret a 404 response?

You are automating the deployment of Cisco ASA firewall rules using the ASA REST API. You need to ensure that the API calls are secure and that changes are properly applied. Which two practices are essential for secure and successful automation? (Choose two.)

When using the Cisco IOS-XE RESTCONF API, which header is required to tell the server the format of the payload being sent?

When automating security, which methodology is used to treat infrastructure configurations as code?

You want to automate the download of 'Web Access Logs' from the WSA. You have authorized your session. What is the final step before the download begins?

Which THREE of the following are true about Postman environments?

What does the 'Authorization' header in a REST API call carry?

When using the Cisco SecureX API, what is the purpose of the 'Application Name' field in the API client registration?

You are automating the addition of malicious URLs to a Cisco Umbrella destination list. After sending a POST request with the new domains, you receive a '409 Conflict' error. What is the likely cause?

In the context of the Cisco Cloudlock API, what is the significance of the 'app_id' field?

You are automating Cisco Umbrella policy changes using the Umbrella API. Which resource is used to update the blocked destination list?

When using the SecureX Orchestration 'HTTP Request' activity, what is the best practice for handling sensitive API keys?

What is the primary benefit of using a REST API over manual CLI configuration for security policy deployment?

Which TWO of the following are true about Cisco Firepower API? (Choose two)

Which TWO parameters are typically required for paginating through large result sets in the Secure Endpoint API?

You are writing a Python script using the requests library to retrieve configuration from a Cisco Firepower Management Center (FMC). Which specific header must be included in your request to ensure that the server returns the response in JSON format?

Which THREE of the following are parameters that can be used to filter Cisco Secure Email Gateway reports via the Reporting API?

You are automating the retrieval of threat intelligence logs from Cisco Secure Email Cloud Gateway. Which API interface provides the most efficient way to fetch historical message tracking logs for automated analysis?

When parsing a complex JSON response from a Cisco Stealthwatch API call, you need to extract the value associated with a key nested deep within the hierarchy. Which Python approach is most idiomatic and robust for this task?

Your team automates Cisco Secure Email Gateway quarantine actions. A script must release a message from quarantine and simultaneously add the sender to a safelist so future messages bypass quarantine. Which combination of API actions accomplishes this?

You are constructing an XML payload for a NETCONF <edit-config> operation. Which namespace must be included to ensure the device correctly interprets the configuration data?

When using the 'requests' library to call an API with a self-signed certificate, which parameter can be used to disable verification for testing?

What is the purpose of the 'json.loads()' function in Python?

An automation engineer is using Cisco SecureX Orchestration to build a workflow that automatically creates a ticket in a ticketing system when a high-severity alert is detected by Cisco Secure Endpoint. The engineer needs to pass the alert details, such as the endpoint hostname and the detection name, to the ticketing system. Which SecureX Orchestration feature should be used to extract these specific values from the alert payload?

In the context of Cisco Umbrella, what is the primary difference between the 'Management' API and the 'Reporting' API?

Which Cisco security component provides visibility and control over cloud-based threats?

Which THREE of the following are essential components of a REST API request for a Cisco security product?

A security operations team uses a Python script to poll the Cisco Stealthwatch API every 30 seconds for new alarms. The script occasionally receives HTTP 429 responses. Which change best addresses the root cause while preserving timely alarm detection?

A security engineer is automating Cisco Firepower Management Center (FMC) using its REST API. The script must create a new access control policy and then deploy it to managed devices. After creating the policy, the engineer attempts to deploy it but receives an HTTP 400 error stating 'Deployment failed: policy not associated with any device.' What is the most likely cause?

You are automating Cisco Umbrella policy changes. You wish to update an existing policy to use a new 'Content Settings' object. Which HTTP header is required in your request to ensure the update follows optimistic concurrency control?

You are writing a Python script that authenticates to the Cisco Umbrella API using OAuth 2.0 client credentials and then calls multiple endpoints. Which two statements about this authentication flow are correct? (Choose two.)

You are using the Cloudlock API to fetch 'Application' data. You receive a response with a 'next_page' token. What does this indicate about the API behavior?

You are writing a Python script using the Requests library to retrieve information from a Cisco FTD device. Which HTTP method should be used to ensure the operation is idempotent and does not modify the device configuration state?

In Python, which HTTP library is most recommended for interacting with Cisco Security APIs due to its simplicity and features?

You are writing a script to parse FMC API response data. The response is a nested JSON object. Which Python library is standard for handling this task?

An engineer is automating a Cisco Identity Services Engine (ISE) deployment using the ERS API. The API requires a secure transport and the engineer wants to verify the server's certificate against a corporate CA bundle in a Python script. The script uses the requests library. Which code snippet correctly performs the GET request to retrieve all network devices while ensuring certificate validation?

Which authentication method is most commonly used by Cisco SecureX for API access?

You are automating the deployment of Cisco Umbrella Roaming Client to a large number of remote Windows endpoints using a configuration management tool. To ensure the client registers correctly and enforces policies, you need to provide the necessary parameters during silent installation. Which two parameters are required for a successful silent installation of the Cisco Umbrella Roaming Client? (Choose two.)

Which TWO of the following are valid components of a YANG model definition?

You are building a Python automation that creates a new destination list in Cisco Umbrella and then adds 500 domains to it. After authenticating with OAuth 2.0, your script must create the list before adding entries. Which HTTP method and endpoint should the script use to create the destination list?

Which Cisco technology allows you to automate the distribution of Indicators of Compromise (IoCs) across the security stack?

You are integrating Cisco Umbrella with your SIEM using the Umbrella Reporting API. Which authentication mechanism is required to access the Reporting API endpoints?

When automating Cisco Stealthwatch, which authentication type is utilized for the API?

Which TWO items are required to properly authenticate a SecureX API request using an API Client?

When working with NETCONF, what is the role of the <edit-config> operation?

When working with YANG data models in Cisco security automation, which TWO statements accurately describe the role of the 'leaf' and 'leaf-list' nodes?

In Cisco SecureX Orchestration, you are building an atomic workflow to isolate an endpoint. Which input parameter is required to identify the target host in the Secure Endpoint 'Isolate Host' activity?

Which THREE metrics are commonly retrieved from the Cisco Secure Email (ESA) Reporting API to monitor mail flow health?

Which Python library is the industry standard for handling REST API requests when automating Cisco security solutions?

You are writing a script to monitor 'Cloudlock' alerts. Which API endpoint provides the most relevant data for SOC integration?

Which of the following is a core benefit of using APIs for Cisco Security?

You are utilizing the Cisco ISE ERS API to provision a guest account. If the API returns a '409 Conflict', what is the most likely cause?

You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?

You are configuring an Umbrella API callback. What happens if the callback URL is unreachable?

Which Cisco tool is best suited for centralizing the management of security APIs across multiple platforms?

When automating the integration between Cisco Cloudlock and a third-party platform, which TWO data types are typically fetched via the Cloudlock API?

Which TWO of the following are accurate regarding the structure and usage of YANG data models?

You are configuring a SecureX workflow to notify a team. Which THREE notification methods are available via standard activities?

Your script is pulling alerts from the Cisco Secure Endpoint API and needs to filter for only 'Critical' detections. How is this filtering best accomplished?

When automating threat hunting with the Cisco SecureX Threat Response API, which object type is commonly used as a search parameter?

When automating Secure Email Gateway tasks, what does a '429' status code indicate?

Which TWO of the following are characteristics of the Cisco ISE ERS API? (Choose two)

Your team automates Cisco Secure Web Appliance (SWA) policy reporting. A Python script logs in, receives a JSESSIONID cookie, and then issues a series of GET requests to the reporting endpoints. After roughly 30 minutes the script starts receiving 401 responses even though the credentials are unchanged. Which action should the script take to keep the automation reliable?

In a YANG model, which statement is used to define an operational constraint that must be true for the data to be valid?

Which Python library is most commonly used in Cisco security automation scripts to interact with REST APIs?

You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?

When automating the deletion of Cisco Umbrella 'Destination Lists' via API, what happens to the policies currently associated with that list?

Which Cisco security product provides an API to automate the management of web proxy policies and access logs?

When automating threat hunting with Cisco SecureX, which object type is used to represent an observable that has been aggregated from multiple sources?

When investigating an IP address in Cisco SecureX, which TWO pieces of intelligence data are typically provided by the Threat Intelligence API?

You are integrating Cisco Cloudlock with an external SIEM using the Cloudlock API. Which mechanism should you implement to receive real-time security events instead of polling the API repeatedly?

A security automation engineer is writing a Python script that uses the Cisco Firepower Management Center (FMC) REST API to modify an existing access control policy. The script must first obtain the current policy object, change its default action, and then submit the update. Which HTTP method and endpoint pattern should the script use to apply the change to the existing policy?

An engineer is automating Cisco Identity Services Engine (ISE) using the External RESTful Services (ERS) API. After creating a new endpoint group with a POST request, the engineer wants to verify the group was created and retrieve its unique identifier. Which HTTP method and endpoint should be used to retrieve the details of the newly created endpoint group?

Which Python construct is best for iterating over a list of IP addresses returned by an API call?

In the context of REST APIs, which status code indicates that a request was successful and a new resource was created on the server?

You are parsing a complex JSON response from a Cisco ISE API. You need to extract the value of the 'macAddress' field nested inside an object named 'endpoint'. Which Python library is best suited for handling this data structure?

In a Python script, how do you handle a 202 Accepted response from the Threat Grid API during file submission?

When parsing a JSON response from a Cisco Adaptive Security Appliance (ASA) REST API call using the Python requests library, you notice the data structure contains a list of objects under the key 'items'. Which Python expression correctly accesses the 'name' field of the first object in that list?

Which HTTP method is most appropriate for retrieving information from a Cisco Security API?

You are configuring a Webex CASB integration. To automate the reporting of anomalous file sharing events from a third-party cloud storage service, which API mechanism should you configure to receive real-time updates?

You are developing a script to automate the creation of a new destination list in Cisco Umbrella using the Umbrella Enforcement API. The script must ensure that the list is created only if it does not already exist. Which HTTP status code should your script check for after attempting to create the list to determine if it already exists?

Which THREE of the following are true about Cisco API rate limiting?

When using the Umbrella API to create a new 'Domain' block rule, you need to specify the 'type'. Which of the following is a valid type?

What is the primary function of an API 'sandbox' in Cisco DevNet?

Which TWO components are required when configuring the Cisco Secure Web Appliance (SWA) to allow API access?

Which component in the Cisco security portfolio is most effectively automated using the 'AsyncOS' Reporting API?

What is the significance of the 'Accept' header in a REST API request?

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

You are automating Cisco Secure Email Gateway (AsyncOS) quarantine management. After authenticating and obtaining a session token, your script must release a message from quarantine. Which HTTP request should the script issue?

Which THREE of the following are common challenges when automating Cisco Security appliance APIs?

Which Cisco Secure Endpoint feature allows automated movement of hosts into different groups based on threat activity?

Which mechanism in YANG allows you to group multiple data nodes that are used in various parts of the model to reduce duplication?

You are writing a Python script to interact with the Cisco Firepower Management Center (FMC) API. You need to authenticate to obtain an authentication token. Which HTTP method and endpoint must your script utilize to initiate this process?

Which TWO statements accurately describe the behavior of the NETCONF 'candidate' data store?

Which TWO of the following are types of Cisco Security API documentation? (Choose two)

In Threat Grid, what is the purpose of the 'Tags' field in an analysis report submission?

When modeling network data with YANG, what is the difference between a 'state' data node and a 'config' data node?

In the context of the Cisco Adaptive Security Appliance (ASA) REST API, what does a 'PATCH' method perform compared to a 'PUT' method?

Which Python library is the standard for performing HTTP requests in an automation script?

You are writing a Python script to retrieve interface statistics from a Cisco Firepower Management Center (FMC) using the REST API. When making the GET request, which header must be included to ensure the server understands the client prefers JSON format?

Which THREE of the following are core principles of Secure Network Design when using APIs?

Which THREE steps are required to automate the update of an Umbrella policy using the Umbrella Management API?

What is the role of an 'OAuth Bearer Token' in Cisco security automation?

Which THREE components are required to configure an API client for Cisco SecureX?

Which TWO of the following are benefits of using the Cisco Secure Endpoint API for automated threat hunting?

You are developing a script to interact with the Cisco Cloudlock API to identify risky OAuth applications. Which THREE actions are valid when using the Cloudlock REST API to manage application risk?

Which THREE of the following fields are commonly found in a JSON API response object? (Choose three)

Which TWO actions must you perform to successfully integrate an automation script with the Cisco Secure Email API?

You are automating the retrieval of blocked file hashes from Cisco Secure Email (ESA). Which API object provides the most granular view of file-based security events?

You are automating Cisco Umbrella policy enforcement through the Umbrella Management API. A Python script must periodically retrieve the list of identities (networks) that are currently associated with a specific destination list so the script can compute a delta and push updates. Which HTTP method and endpoint pattern should the script use to read the current members of a destination list?

You are automating Cisco Firepower Management Center (FMC) via the REST API. You need to update an existing object. Which HTTP method must you use to ensure a full update of the resource representation?

You are automating Firepower Management Center (FMC) object creation using the REST API. You send a POST request to /api/fmc_config/v1/domain/{domainUUID}/object/networkaddresses with a body containing a name and type. The request returns a 400 Bad Request error. What is the most likely cause?

When using NETCONF to manage a Cisco device, which message type is used to establish the initial session and exchange capability information?

When automating Cisco Security solutions, what is the primary benefit of using a 'Service Account' instead of a personal user account for API authentication?

Which TWO of the following are valid ways to test Cisco APIs before deployment? (Choose two)

Which TWO actions can be automated via the Cisco Secure Endpoint API to improve incident response?

Which THREE features are provided by the Cisco SecureX API documentation?

You are developing a Python script to automate Cisco Umbrella enforcement of security policies. The script must retrieve the list of identities and then apply a block action to a specific domain. Which API endpoint and method should you use to apply the block action?

A security automation engineer is designing a Python script that interacts with multiple Cisco security appliances' REST APIs. The script must handle HTTP errors gracefully and implement retry logic for transient failures. Which two practices should be followed to ensure robust error handling? (Choose two.)

You are automating threat response using Cisco Threat Response. You want to retrieve a list of verdicts for a specific observable (e.g., an IP address). Which API provides this capability?

A network automation engineer is writing a Python script to interact with a Cisco Firepower Management Center (FMC) REST API. The script must authenticate and obtain a token for subsequent requests. Which HTTP header is used to pass the authentication token in subsequent API calls?

In the context of the Cisco Firepower API, what does a 'GET' request to '/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies' return?

You are writing a Python script to automate management of destination lists in Cisco Umbrella. The script must retrieve the current contents of a specific destination list before adding new domains. Which HTTP request should the script make to obtain the list details?

You are developing a Python script that uses the ncclient library to configure a Cisco IOS-XE device via NETCONF. You need to send a <edit-config> operation that merges a new interface configuration. Which NETCONF operation and default-operation value should you use to ensure that only the specified configuration is merged without affecting other interfaces?

You are writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of all endpoints in your organization. After authenticating with OAuth 2.0, you need to handle pagination because the API returns a limited number of results per page. Which HTTP response header should your script inspect to obtain the URL for the next page of results?

Which TWO of the following are valid ways to obtain threat intelligence data within the Cisco SecureX ecosystem?

Which THREE headers are commonly used when sending authenticated requests to Cisco Security APIs?

Which YANG node type is used specifically to group reusable definitions that can be imported by other modules?

You are automating Cisco Identity Services Engine (ISE) using the External RESTful Services (ERS) API. Your Python script needs to query all network devices and then update a specific device group. After authenticating with HTTPS Basic Authentication, you receive an HTTP 401 response when attempting to retrieve devices. Which action should you take to resolve this?

What is the benefit of integrating Cisco Threat Grid with Secure Endpoint?

You are automating the deletion of an indicator in Cisco Threat Grid. Which HTTP method must be used to ensure the request is idempotent and compliant with the RESTful design of the API?

In a Cisco REST API implementation using Python, you receive a '429 Too Many Requests' error. What is the appropriate programmatic response?

You are automating the addition of an IP blocklist in Umbrella. You have the IP address and the list ID. Which HTTP method and path is correct?

You are writing a script to automate firewall rules. When using the 'pyang' tool, what is the primary purpose of the '--format' option?

Which THREE of the following are common JSON data types?

When using the FMC API, what is the purpose of the 'X-Auth-Access-Token' header?

Your team runs a Cisco Secure Email Gateway (AsyncOS) and wants to automate message tracking lookups for incident response. A script authenticates with a valid session and queries /esa/api/v2.0/message-tracking/messages. The API returns HTTP 404 for every query even though messages exist. Which configuration issue is the most likely cause?

When using the Cisco Umbrella Reporting API, which format is the default output for retrieving threat activity logs to ensure compatibility with most data analysis tools?

Which THREE of the following are best practices for managing API keys? (Choose three)

You are configuring a CI/CD pipeline to deploy Cisco ASA firewall rules. Which step is essential to ensure the changes are correct before applying them to production?

Which TWO of the following are true regarding the use of the Python 'requests' library?

Which Cisco security product uses the pxGrid framework to share contextual information with other network devices?

When writing a Python request to the SecureX API, which Content-Type header is required for POST requests?

What is the purpose of the 'Client ID' and 'Client Secret' when authenticating with the Cisco Secure Email Gateway API?

An engineer is using NETCONF to retrieve configuration data from a Cisco IOS XE device. The engineer wants to filter the response to only include interface configuration for GigabitEthernet1. Which YANG filter correctly achieves this using the subtree filter?

A network security engineer is writing a Python script to interact with the Cisco Identity Services Engine (ISE) External RESTful Services (ERS) API. The script must create a new endpoint and then retrieve its details. Which HTTP status code should the script expect upon successful creation of the endpoint?

Which data format is primarily used by REST APIs and is considered the standard for programmatic device interaction in Cisco security environments?

A security engineer is automating Cisco Identity Services Engine (ISE) using the REST API. The script must retrieve a list of all network devices configured in ISE. Which API endpoint should the engineer use?

You are writing a script to update Cisco Secure Email (ESA) configuration. You need to push a new 'Content Filter' rule. Why is it recommended to perform a 'Get' request before the 'Put' request?

What is the primary function of the Cisco Secure Email API 'Message Tracking' interface?

Which TWO of the following are key features of the Cisco Cloudlock API?

Which THREE of the following are true regarding REST API design in Cisco security products?

Which programming language is most commonly used for Cisco Security automation tasks?

Which Cisco security product should you use if your main goal is to automate the blocking of malicious DNS queries?

A network security engineer is automating the deployment of Cisco Umbrella policies using the Umbrella API. The engineer needs to create a new destination list that blocks access to known malicious domains. Which HTTP method and endpoint should be used to create this list?

Which TWO steps are required to properly authenticate to the Cisco Firepower Management Center (FMC) API using the REST API Explorer?

You are using the Cisco Secure Endpoint (formerly AMP for Endpoints) API to query file trajectory data for a specific SHA-256 hash. The API returns a 429 Too Many Requests status code. What is the most efficient way to handle this in your automation script?

Which THREE actions are essential when designing a secure automation script that interacts with the Cisco Secure Endpoint API?

When managing Secure Endpoint through the API, which TWO pieces of information are used to track endpoint health?

A script interacting with Cisco Cloudlock is receiving a 429 Too Many Requests error. What should the automation script implement to handle this gracefully?

When utilizing the Cisco Secure Email Reporting API, which format is best for programmatic data processing?

Which component of a REST API request is used to pass information about the requested resource in the URL?

You are managing Cisco Cloudlock settings via the API. You need to ensure that specific SaaS file-sharing events are flagged. Which API object must you target to define a new policy violation trigger?

You are using the Cisco Umbrella Investigate API to check if a specific IP address is associated with a known threat. Which domain of the API should you query?

Which of the following is a key advantage of using the Cisco Secure Email 'AsyncOS' API over manual CLI configuration for mass blocklist updates?

You are using Postman to test an API that requires an API key in the header. Where should this be configured in Postman?

A security operations team wants to automatically block domains that appear in Cisco Umbrella Investigate results for newly registered malicious infrastructure. The automation will call the Umbrella Management API to add those domains to a destination list. Which API object must the script modify to add a domain to a destination list?

You are troubleshooting a Python script using the Cisco pxGrid API. The script fails to receive notifications from ISE. Which component must be verified first?

When using the Cisco Threat Grid API, which TWO methods can be used to retrieve report data?

A script needs to update a Cisco Firepower object. Which API workflow is correct?

In the context of the Cisco ASA REST API, what is the role of the 'ETag' header in an API response?