Select Two (Multi-Select) Questions

Enable 'REST API' in the 'Feature Key' or 'System' settings

Enabling the REST API in the feature key or System settings activates the appliance's API service, which is otherwise disabled by default. This satisfies the stem's requirement for API access, since no API calls can succeed until the interface is explicitly switched on.

API user account with appropriate roles

API access on the Cisco Secure Web Appliance requires a dedicated local account holding the API-enabled role, since the appliance authenticates API calls against its own user database rather than Microsoft Entra ID. Without this account, requests to the configuration API are rejected regardless of network or certificate configuration.

The candidate store can be discarded if the proposed changes are incorrect.

The candidate store holds uncommitted configuration changes separately from the running datastore, so a `<discard-changes>` operation reverts it to the running configuration without affecting live traffic. This satisfies the stem's requirement that proposed changes can be abandoned when found incorrect, before any commit makes them active.

The candidate store must be explicitly 'committed' to move changes to the running store.

Changes placed in the candidate store remain isolated until an explicit commit operation copies them into the running store, which is what makes the device's active configuration change. Without commit, the running datastore stays untouched.

Swagger/OpenAPI specifications

Swagger/OpenAPI specifications are a documented API documentation type, publishing machine-readable endpoint schemas, parameters and response models. This satisfies the stem's requirement for a genuine Cisco Security API documentation category, since these specifications are formally maintained and distributed for Cisco security APIs.

Developer portal HTML/web docs

Developer portal HTML/web docs are a recognised API documentation type, presenting human-readable reference material, guides and endpoint descriptions through a browser-based portal. This satisfies the stem's requirement for a Cisco Security API documentation category, complementing machine-readable specifications with narrative usage guidance.

It requires an API Key and Secret

Authentication to the Cisco Umbrella API uses a key and secret pair, exchanged for a time-limited OAuth 2.0 bearer token. This satisfies the stem's requirement for a true statement about the API's access model, since every management and reporting endpoint rejects unauthenticated calls.

It is based on REST principles

REST principles underpin the Cisco Umbrella API, meaning it uses stateless HTTP requests with standard verbs and resource-oriented URIs. This architectural style satisfies the stem's requirement for a factual characteristic of the API, distinguishing it from RPC-style or proprietary interfaces.

It supports both management and reporting

The Cisco Umbrella API exposes distinct endpoint families covering both management operations and reporting data retrieval. This dual capability satisfies the stem's requirement, since the API is not limited to configuration alone but also returns telemetry and reporting information.

API Scope

API Scope defines the permissions granted to the SecureX API client, satisfying the requirement to authorise specific access to Cisco SecureX APIs. Without a scope, the generated client credentials cannot be limited to the intended operations, so the client registration would be incomplete.

Client Secret

A client secret authenticates the API client against the Cisco SecureX identity service, satisfying the credential requirement for machine-to-machine access. Without it, the registered client cannot obtain tokens, so the integration fails authorisation. This credential pairs with the client ID and scopes to complete the OAuth configuration.

Client ID

Client ID uniquely identifies the registered application within Cisco SecureX, forming one of the three mandatory credentials alongside Client Secret and the token endpoint. Without it, the API client cannot authenticate or obtain access tokens, so it directly satisfies the stem's requirement for configuring an API client.

Principle of Least Privilege

Least Privilege limits each API consumer and service account to only the permissions its function requires, shrinking the blast radius if credentials leak. This directly satisfies the stem's demand for a core secure network design principle governing API authorisation scope.

Use of TLS for all API communication

Ensures transit encryption of sensitive configuration data.

Audit logging for all API transactions

Audit logging records every API transaction, creating the traceability that Secure Network Design demands for detecting anomalous access and supporting forensic investigation. It satisfies the accountability principle by capturing who called which endpoint, when, and with what outcome, enabling breach detection and compliance evidence across distributed API traffic.

HTTP Method (e.g., GET, POST, PUT, DELETE).

The HTTP method defines the operation the API performs on the target resource, mapping to create, read, update or delete semantics. Without it, the server cannot determine the intended action, so it forms one of the three essential components alongside the URI and headers.

URI (Uniform Resource Identifier) identifying the resource.

The URI specifies the exact resource the request targets, such as an FMC policy or Stealthwatch host, giving the server its address. Combined with the HTTP method and headers, it completes the essential trio needed for any valid REST call.

Headers for authentication and data format specifications.

Headers carry authentication tokens such as the FMC or Stealthwatch bearer token, plus content-type and accept values declaring the data format. They satisfy the requirement for authenticating the caller and negotiating payload representation, making them essential alongside the method and URI.

Request examples

Request examples show concrete API calls with headers, parameters and payloads, letting developers see exactly how to invoke SecureX endpoints. This satisfies the documentation requirement for practical usage guidance, complementing the reference material rather than merely describing authentication or rate limits.

Schema definitions

Schema definitions form part of the Cisco SecureX API documentation, satisfying the requirement for documented response structures. They describe the exact fields, data types and object relationships returned by each endpoint, letting integrations validate payloads and parse responses programmatically rather than guessing at formats.

Endpoint definitions

Endpoint definitions document each SecureX API resource, its URL path, HTTP methods, parameters and response schema. This satisfies the documentation requirement for a complete API reference, enabling developers to construct valid requests against threat-response and intelligence endpoints.

number

JSON defines number as a primitive value type, covering integers and floating-point values with optional exponents and signs. This satisfies the stem's requirement for a common JSON data type, alongside string, boolean, null, object and array. Numbers require no quoting, unlike string values.

string

A string is a valid JSON data type, satisfying the stem's requirement for common JSON types. JSON defines strings as sequences of Unicode characters enclosed in double quotes, alongside number, boolean, null, object and array. This directly meets the constraint of identifying recognised JSON data types.

boolean

Boolean is a native JSON data type, representing the logical values true and false. It satisfies the stem's requirement for a common JSON type, alongside string, number, object, array and null. JSON booleans are unquoted literals, distinguishing them from the quoted strings "true" and "false".

Rotate keys regularly

Regular rotation limits the window in which a leaked or stolen API key remains usable, containing exposure if credentials are compromised. This reduces the blast radius of credential theft and is a foundational practice for managing long-lived API keys securely.

Use least privilege access for keys

Granting each API key only the permissions its integration needs limits blast radius if the key leaks. Broad wildcard scopes let a compromised key perform unrelated privileged actions, so least privilege is a core key-management practise.

Never hardcode keys in scripts

Hardcoding embeds credentials directly in source code, exposing them to anyone with repository access and leaving them in commit history even after removal. Storing keys in environment variables or a managed secret store such as Azure Key Vault satisfies the stem's best-practise constraint by keeping secrets outside version-controlled artefacts and enabling rotation without code changes.

It can automatically serialize dictionaries to JSON via the json parameter.

The requests library's json parameter accepts a Python dictionary and serialises it to JSON automatically, setting the Content-Type header accordingly. This removes the need to call json.dumps() manually, satisfying the stem's claim about automatic serialisation of dictionaries.

It simplifies HTTP interactions with methods like .get() and .post()

The requests library wraps HTTP interactions in simple methods such as .get() and .post(), abstracting socket handling and header construction. This directly satisfies the stem's claim that it simplifies HTTP interactions, unlike the lower-level http.client module.

Use the raise_for_status() method on the response object to automatically raise an exception for HTTP error codes.

The raise_for_status() method of the requests library's Response object raises an HTTPError exception if the HTTP status code indicates an error (4xx or 5xx). This allows the script to catch these exceptions and handle them appropriately, such as logging the error or retrying the request. It is a best practice for robust error handling in API interactions.

Catch requests.exceptions.RequestException to handle all possible exceptions raised by the requests library.

requests.exceptions.RequestException is the base class for all exceptions raised by the requests library, including ConnectionError, HTTPError, Timeout, and others. Catching this exception ensures that any request-related error is handled, preventing the script from crashing due to unhandled exceptions. This is a recommended practice for comprehensive error handling.

Organization ID

The Organization ID is a unique identifier for your Umbrella organization. During silent installation, you must specify this ID so the Roaming Client can register with the correct Umbrella instance and download policies. Without it, the client cannot associate with your organization, and registration will fail. This parameter is typically passed via the command line as ORG_ID=your_org_id or through a transforms file. It is essential for large-scale deployments to ensure each endpoint is correctly linked to your Umbrella dashboard.

Registration Token

The registration token is a secret key that authenticates the Roaming Client with Umbrella during initial registration. It ensures that only authorized clients can join your organization. In silent installations, you must provide this token, often as REG_TOKEN=your_token. Without it, the client cannot complete registration and will not enforce policies. The token is generated in the Umbrella dashboard and should be kept secure. For mass deployment, embedding it in your installation script is common, but rotate it periodically for security.

A 'leaf-list' node allows for multiple instances of a specific value type.

A leaf-list defines a node holding multiple instances of the same data type, unlike a leaf. This satisfies the stem's requirement by describing the multi-value collection behaviour that distinguishes leaf-list from single-value leaf nodes in YANG models.

A 'leaf' node contains a single value of a specific type.

A leaf node holds exactly one value of a defined type and cannot repeat, which is the defining contrast with leaf-list. This matches the stem's demand for an accurate statement about leaf node semantics in YANG data models.

Meta/Pagination info

Meta or pagination information accompanies the payload, carrying counts, page numbers and next/previous links so clients can iterate large result sets. Its presence satisfies the question's requirement for a field commonly found in JSON API response objects.

Status code/Message

A status code or message field reports the outcome of the request, letting the client distinguish success from failure without inspecting the payload. This satisfies the question's requirement for a field commonly found in JSON API response objects.

Data field (payload)

The data field carries the actual payload, such as the requested records or object attributes, separate from envelope metadata. Its presence satisfies the question's requirement for a field commonly found in JSON API response objects.

Webex

Webex is exposed as a standard SecureX workflow activity, letting a workflow post notifications into Webex spaces without custom code. It satisfies the requirement for an available notification method, using the built-in connector rather than an HTTP request activity.

PagerDuty

PagerDuty is provided as a standard SecureX workflow activity, raising incidents and alerts through the PagerDuty service. It satisfies the requirement for an available notification method, using the built-in connector to page on-call responders rather than sending plain messages.

Email

Email is a standard SecureX notification activity, satisfying the requirement for a built-in method without custom development. It dispatches messages through the configured SMTP or mail relay, letting the workflow alert a team directly. This makes it one of the three available standard notification methods.

It supports CRUD (Create, Read, Update, Delete) operations

ERS exposes ISE's configuration objects through full CRUD semantics, letting automation create, read, update and delete endpoints, identity groups and network devices. This satisfies the stem's requirement for a management API capable of programmatic object lifecycle operations rather than read-only monitoring.

It uses RESTful principles

ERS is built on RESTful principles: resource-oriented URIs, standard HTTP verbs and JSON payloads over HTTPS. This satisfies the stem's requirement that the API be a modern, stateless, HTTP-based interface suitable for scripted automation rather than legacy SOAP or CLI scraping.

Headers may include quota information

Cisco API responses commonly expose rate-limit state through headers such as X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, letting clients read remaining quota and reset timing. This satisfies the stem's requirement for a true statement about rate limiting.

It helps ensure API service stability

Rate limiting caps how many requests a client can make within a defined window, shielding backend API services from overload or abuse. This throttling preserves responsiveness and availability, directly ensuring the API service remains stable for all consumers.

It usually results in an HTTP 429 status code

Rate limiting rejects excess requests with HTTP 429 Too Many Requests, signalling the client to back off and retry later. This status code is the standard mechanism Cisco APIs use to enforce request quotas, satisfying the question's requirement for a true statement about rate-limiting behaviour.

Structured data format (XML)

NETCONF encodes configuration and state data in XML, giving a hierarchical, schema-defined structure that YANG models validate. This satisfies the stem's requirement for a common benefit by enabling programmatic parsing, filtering and atomic edits, unlike unstructured CLI screen-scraping, so automation tools can reliably read and modify specific configuration nodes.

Transaction-based configuration commits

Transaction-based commits let NETCONF stage candidate configurations and apply them atomically, so a failed change rolls back rather than leaving the device partially configured. This directly satisfies the stem's benefit criterion by guaranteeing configuration consistency across the whole device, unlike CLI scripting where partial application is possible.

Logical separation of datastores

Logical separation of datastores lets NETCONF keep running configuration, candidate configuration and startup configuration as distinct stores, so changes are staged and validated before commit. This satisfies the need to prepare and verify configuration edits without immediately affecting the live device state.

Incorrect URL endpoints or API versioning

Automation scripts frequently fail because hard-coded URLs point at retired or incorrect endpoints, or because the API version in the path no longer matches the deployed platform. This mismatch between script and live API surface is a genuine, commonly encountered automation issue, satisfying the scenario's requirement.

Exceeding API rate limits

Cisco Security APIs enforce request quotas per time window, so high-volume automation can trigger HTTP 429 responses and throttling. Exceeding these rate limits is a genuine, frequently encountered automation issue, satisfying the scenario's requirement to identify common problems when automating Cisco Security APIs.

Invalid authentication tokens

Tokens and API keys expire or are revoked, so automation using stale credentials receives HTTP 401 or 403 responses and fails. Invalid authentication tokens are a genuine, frequently encountered automation issue, satisfying the scenario's requirement to identify common problems when automating Cisco Security APIs.