1
MCQeasy
Which data format is the standard for Cisco's cloud-based security APIs?
Why this answer
JSON (JavaScript Object Notation) is the standard data exchange format for almost all modern Cisco security APIs.
72 questions · Cloud Web And Email Security Automation topic · All types, answers revealed
Which data format is the standard for Cisco's cloud-based security APIs?
Why this answer
JSON (JavaScript Object Notation) is the standard data exchange format for almost all modern Cisco security APIs.
You need to retrieve the current status of all Cisco Umbrella 'Virtual Appliances' using the API. Which API resource is the most appropriate?
This endpoint is designed to expose the state and configuration of VAs.
Why this answer
The 'Virtual Appliances' endpoint in the Umbrella API specifically provides status and heartbeat information for registered VAs.
You are automating policy updates for Cisco Umbrella using the Umbrella Management API. You need to identify the correct endpoint to retrieve the list of destination lists for a specific organization. Which HTTP method and path should you use?
This is the correct endpoint path for retrieving destination lists in the Umbrella Management API.
Why this answer
The Cisco Umbrella Management API uses the GET method with the /organizations/{organizationId}/destinationlists path to retrieve the destination lists associated with an organization.
Which TWO of the following are valid HTTP methods supported by the Cisco Umbrella Management API?
POST is used for creating new resources.
Why this answer
The Umbrella Management API follows REST principles, and POST (create) and DELETE (remove) are standard methods for managing destination lists and policies.
When automating a Cisco Secure Web Appliance (WSA) task, you need to trigger a 'policy push'. Which API component allows you to initiate this?
This is the official method to apply staged configurations on WSA.
Why this answer
The WSA configuration API provides a 'commit' or 'push' endpoint to apply staged changes to the active configuration.
You are automating the 'App Firewall' in Cisco Cloudlock. You want to change an OAuth app's status from 'Approved' to 'Revoked'. Which object structure must be sent in the request body?
The API expects a JSON body defining the target state.
When automating the Cisco Secure Email (ESA) configuration via the API, which file format is required to import a new set of content filters?
AsyncOS configuration exports and imports are formatted in XML.
Why this answer
Cisco Secure Email uses XML for configuration exports and imports via the API.
You are automating the blocking of a specific URL on a Cisco WSA. You have verified the API reachability, but the rule is not being applied. What is the most common reason?
WSA configuration changes are staged and must be committed to take effect.
Why this answer
The WSA API often requires a 'commit' action after updating rules; without this, the changes remain in a staging area and are not active.
Which TWO of the following are mandatory fields when creating a new 'Destination List' via the Cisco Umbrella API?
Every list needs a unique name.
Why this answer
To create a destination list, one must provide a name and the specific list access type (block or allow).
You are automating Cisco Secure Email (ESA) using the Management API. You need to trigger an immediate update of the Anti-Spam engine. Which action is required to ensure the API call succeeds?
The API requires a POST request to the engine update endpoint to initiate the fetch.
Why this answer
The update mechanism in the ESA Management API requires authenticated administrative access and the correct POST trigger to the engine-update resource.
When developing an automation script for Cisco Cloudlock, which TWO authentication methods are supported for API access?
API tokens are used for authentication in Cloudlock integrations.
Why this answer
Cloudlock primarily uses OAuth2 Client Credentials and API Tokens for programmatic access.
Which of the following is a key requirement for using the Cisco Umbrella API successfully?
These are the mandatory credentials for authentication.
Why this answer
Generating and properly storing API keys from the Umbrella dashboard is the fundamental requirement for all API interactions.
Which TWO of the following steps are required to automate the retrieval of reporting data from the Cisco Secure Email Gateway?
Authentication is the first step in any API interaction.
Why this answer
To extract data, one must authenticate via the API and then query the Reporting API endpoint for the specific data set.
Which THREE of the following are examples of SaaS security posture automation tasks you can perform with the Cloudlock API?
Token revocation is a key automation task.
Why this answer
Cloudlock provides API-based control over user access, application auditing, and threat detection policies.
When integrating Cisco Umbrella with a SOAR platform, what is the best practice for handling API rate limits?
This ensures the script waits appropriately before retrying after a rate limit hit.
Why this answer
Implementing exponential backoff logic is the standard practice for handling 429 'Too Many Requests' responses from APIs.
You are automating the deletion of an old Umbrella API key. Why is it important to ensure that no active scripts are using this key before deletion?
Deletion of credentials is irreversible and immediate.
Why this answer
Once an API key is deleted, any application using that key will immediately lose access, causing potential service disruption.
When configuring the Cisco Secure Web Appliance (SWA) via the API, which object attribute is critical to ensure that a newly created policy is immediately active upon deployment?
The enabled boolean attribute is required to activate the policy.
Why this answer
The 'enabled' boolean flag must be set to true in the object JSON payload.
You are developing a script to pull alerts from Cisco Cloudlock. You want to filter for 'High Severity' incidents only. Which parameter should you include in your API call?
The Cloudlock API uses this query parameter to filter incidents by severity level.
Why this answer
The Cloudlock API supports filtering incident logs via query parameters like 'severity_level' or 'severity'.
You are writing a script to check for new security policy updates on a Cisco WSA. You notice that your script pulls the same configuration repeatedly. What should you use to check if the policy has changed?
These headers allow for conditional GETs, preventing redundant data transfer.
Why this answer
The 'Last-Modified' header or an ETag check is the standard way to verify if a resource has changed since the last request, saving bandwidth and processing.
When interacting with the Cisco WSA API, you want to retrieve the 'System Status'. What does the 'uptime' field in the JSON response represent?
Uptime is the standard metric for time since the last system boot.
Why this answer
The uptime field in the WSA API provides the time elapsed since the last appliance restart or service initialization.
When using the Cisco Secure Email (formerly ESA) AsyncOS API to fetch message tracking data, what is the mandatory header required for authentication?
The AsyncOS API utilizes standard HTTP Basic Auth via the Authorization header.
Why this answer
The AsyncOS API requires the 'Authorization' header using Basic authentication with encoded credentials.
You are using the Cisco Cloudlock API to retrieve a list of users. The API returns an 'error: 403 Forbidden'. What is the most likely cause?
403 indicates a lack of authorization for the requested resource.
Why this answer
A 403 Forbidden error indicates that the API key or token used does not have the necessary permissions to access the specific endpoint or resource.
You are using the Cisco Umbrella Investigate API to enrich an incident response playbook. Which endpoint should you query to retrieve the security status and associated domains for an IP address?
This endpoint returns the domains associated with the specified IP.
Why this answer
The Investigate API provides specific endpoints for IP reputation and related domains.
Which Cisco security product uses the 'AsyncOS' platform, and for which automation tasks is its API most commonly used?
AsyncOS is the OS for these appliances, and the API enables automation of their administration.
Why this answer
Cisco Secure Email and Secure Web appliances run on AsyncOS and use the AsyncOS API for reporting, configuration, and monitoring.
Which tool is best suited for testing Umbrella API queries before deploying them into your automated production script?
Postman is highly effective for prototyping and testing REST API interactions.
When integrating Cisco Umbrella with a SIEM using the Cisco Umbrella Investigate API, which TWO pieces of information are required to authenticate and query domain status?
The API token is the primary credential for Investigate API access.
Why this answer
The Investigate API requires an API token (key) and an Authorization header to validate requests.
You are writing a Python script to interact with the Cisco Secure Web Appliance (WSA) REST API to pull 'Access Logs'. When parsing the response, you notice the data is chunked. What is the most appropriate way to handle large log datasets when using the REST API?
Pagination is the standard method for safely retrieving large log datasets from the WSA API.
Why this answer
The WSA REST API handles large datasets through pagination (offset and limit parameters) to prevent memory exhaustion on the client and server.
Which THREE of the following are true about the Cisco Umbrella API?
These are necessary for authentication.
Why this answer
It is a REST-based API, supports management and reporting, and requires proper API key management.
When automating the deployment of Cisco Umbrella virtual appliances (VAs) using APIs, what is the primary prerequisite that must be configured in the dashboard?
The VAs must be active and registered in the portal to be accessible via API.
Why this answer
Before VAs can be managed or reported on via API, they must be registered in the Cisco Umbrella Dashboard under 'Deployments' > 'Core Identities' > 'Virtual Appliances'.
You want to automate the download of 'Web Access Logs' from the WSA. You have authorized your session. What is the final step before the download begins?
Retrieving the file content requires a GET request to the file's resource location.
Why this answer
In WSA automation, you must select the specific log type and file, then initiate the download, usually via a GET request to the file resource.
You are automating the addition of malicious URLs to a Cisco Umbrella destination list. After sending a POST request with the new domains, you receive a '409 Conflict' error. What is the likely cause?
The API returns 409 when attempting to add a duplicate entry.
Why this answer
A 409 Conflict error in the Umbrella Destination List API indicates that the domain already exists in the list.
In the context of the Cisco Cloudlock API, what is the significance of the 'app_id' field?
All App Firewall API operations require the specific app_id.
Why this answer
The 'app_id' is the unique identifier used to target specific OAuth applications when performing actions like revoking permissions or changing status.
Which THREE of the following are parameters that can be used to filter Cisco Secure Email Gateway reports via the Reporting API?
Filtering by recipient address is a core reporting function.
Why this answer
The Reporting API allows filtering by date ranges, specific message IDs, and user/sender/recipient addresses.
You are automating the retrieval of threat intelligence logs from Cisco Secure Email Cloud Gateway. Which API interface provides the most efficient way to fetch historical message tracking logs for automated analysis?
The Reporting API is designed for extracting historical metrics and message logs.
In the context of Cisco Umbrella, what is the primary difference between the 'Management' API and the 'Reporting' API?
This accurately describes the functional split of the Umbrella API sets.
Why this answer
The Management API is used for configuration (policies, lists), while the Reporting API is used to extract log data and security events.
You are automating Cisco Umbrella policy changes. You wish to update an existing policy to use a new 'Content Settings' object. Which HTTP header is required in your request to ensure the update follows optimistic concurrency control?
If-Match is the standard header for implementing optimistic concurrency via ETags.
Why this answer
The Umbrella API uses the 'If-Match' header containing an ETag to ensure that the object being updated has not changed since it was last read (optimistic locking).
You are using the Cloudlock API to fetch 'Application' data. You receive a response with a 'next_page' token. What does this indicate about the API behavior?
Cursor-based pagination requires using the provided token to fetch the next set of data.
Why this answer
The Cloudlock API utilizes cursor-based pagination for large data sets, where the 'next_page' token provides the reference to the subsequent result set.
When configuring Cisco Cloudlock to monitor SaaS applications, you need to automate the revocation of compromised OAuth tokens. Which mechanism within the Cloudlock API allows you to programmatically trigger a token revocation event?
The App Firewall API is the designated interface for managing OAuth app permissions and revoking tokens.
Why this answer
Cloudlock provides the 'Revoke' action via the 'Events' or 'App Firewall' API endpoints to handle OAuth token lifecycle management programmatically.
You are integrating Cisco Umbrella with your SIEM using the Umbrella Reporting API. Which authentication mechanism is required to access the Reporting API endpoints?
Umbrella uses OAuth 2.0 flows requiring a client ID and secret to get an access token.
Why this answer
Umbrella API access requires a set of API keys (Key and Secret) generated in the Umbrella Dashboard, which are then used to obtain an OAuth 2.0 bearer token.
Which THREE metrics are commonly retrieved from the Cisco Secure Email (ESA) Reporting API to monitor mail flow health?
A standard reporting metric.
Why this answer
The Reporting API provides metrics such as incoming volume, spam rejection rates, and recipient statistics.
Which Python library is the industry standard for handling REST API requests when automating Cisco security solutions?
The requests library is the de facto standard for Python API automation.
Why this answer
The 'requests' library is the Python standard for making HTTP requests in a clear, human-readable manner.
You are writing a script to monitor 'Cloudlock' alerts. Which API endpoint provides the most relevant data for SOC integration?
The Incidents endpoint is the primary source for security alerts in Cloudlock.
Why this answer
The 'Incidents' endpoint provides the stream of security events that a SOC would monitor.
Which HTTP method should you use when updating an existing Cisco Cloudlock policy?
PUT is used to update an existing resource.
Why this answer
The PUT method is standard for replacing or updating an existing resource in RESTful APIs like Cloudlock's.
When automating the integration between Cisco Cloudlock and a third-party platform, which TWO data types are typically fetched via the Cloudlock API?
The API is designed to pull security event data.
Why this answer
Cloudlock APIs are commonly used to pull incident data and policy violation reports.
When automating Secure Email Gateway tasks, what does a '429' status code indicate?
429 is the standard HTTP code for rate limiting.
Why this answer
A 429 status code indicates that the client has sent too many requests and has exceeded the API rate limit.
When automating the deletion of Cisco Umbrella 'Destination Lists' via API, what happens to the policies currently associated with that list?
Policies are objects that point to lists; if the list is gone, the rule is effectively disabled/removed.
Why this answer
When a destination list is deleted, any policies referencing that list will lose the associated destination blocking rule, effectively removing that specific block or allow rule from the policy.
Which Cisco security product provides an API to automate the management of web proxy policies and access logs?
WSA is the platform specifically designed for web proxy and policy management.
Why this answer
Cisco Secure Web Appliance (WSA) features an extensive management API for configuration and log retrieval.
You are integrating Cisco Cloudlock with an external SIEM using the Cloudlock API. Which mechanism should you implement to receive real-time security events instead of polling the API repeatedly?
Cloudlock supports outgoing webhooks to push security incidents to external systems.
Why this answer
Cloudlock supports Webhooks, which allow the system to push events to a configured URL endpoint.
You are configuring a Webex CASB integration. To automate the reporting of anomalous file sharing events from a third-party cloud storage service, which API mechanism should you configure to receive real-time updates?
Webhooks are designed to push event data to your automation service as they occur.
Why this answer
Webhooks are the standard mechanism for receiving push notifications from CASB providers regarding security events.
You are automating the retrieval of security logs from Cisco Umbrella using the Reporting API. You need to pull logs for a specific time range. Which parameter must be included in the API request to ensure the response is correctly paginated and contains the requested data slice?
The 'limit' parameter defines the number of records returned per request.
Why this answer
The Cisco Umbrella Reporting API uses a 'limit' and 'offset' parameter for pagination to ensure large datasets are handled efficiently.
When using the Umbrella API to create a new 'Domain' block rule, you need to specify the 'type'. Which of the following is a valid type?
This is the correct object type for blocklist entries.
Why this answer
In Umbrella destination lists, domains are managed under the 'domain' type when adding entries to a block/allow list.
Which TWO components are required when configuring the Cisco Secure Web Appliance (SWA) to allow API access?
The service must be explicitly enabled on the appliance.
Why this answer
You must enable the API feature and define an API user with appropriate permissions.
Which component in the Cisco security portfolio is most effectively automated using the 'AsyncOS' Reporting API?
The Reporting API is a core part of the Secure Email Gateway automation suite.
Why this answer
The AsyncOS Reporting API is specifically designed for the Secure Email and Web appliances to extract logs and traffic statistics.
Which THREE of the following are common challenges when automating Cisco Security appliance APIs?
Tokens require periodic renewal/refresh.
Why this answer
Handling rate limits, properly managing authentication tokens, and ensuring configuration changes are committed are common automation hurdles.
Which THREE steps are required to automate the update of an Umbrella policy using the Umbrella Management API?
Necessary to retrieve the existing object structure.
Why this answer
Updating a policy involves retrieving the current configuration, modifying the JSON, and performing a PUT operation.
What is the role of an 'OAuth Bearer Token' in Cisco security automation?
The bearer token is the standard way to authorize API requests in OAuth 2.0.
Why this answer
The bearer token is a temporary credential that proves the client is authorized to access the requested API resources.
You are developing a script to interact with the Cisco Cloudlock API to identify risky OAuth applications. Which THREE actions are valid when using the Cloudlock REST API to manage application risk?
The API allows revoking access tokens for specific applications.
Why this answer
Cloudlock APIs allow for retrieving app risk scores, revoking app access, and listing users granted access to specific applications.
Which TWO actions must you perform to successfully integrate an automation script with the Cisco Secure Email API?
Basic Auth is the required method for the AsyncOS API.
Why this answer
You must enable the API service in the appliance settings and provide correct credentials via HTTP Basic Auth.
You are automating the retrieval of blocked file hashes from Cisco Secure Email (ESA). Which API object provides the most granular view of file-based security events?
Message Tracking provides event-level granularity, including file attachment metadata.
Why this answer
The Message Tracking API provides the most detailed logs regarding individual file attachments and their disposition.
You are automating the quarantine of emails in Cisco Secure Email (formerly IronPort). Which API interaction is required to trigger a move of a specific message ID into the quarantine?
This is the documented API call to perform actions like quarantine on a Message ID.
Why this answer
The Secure Email Message Tracking API allows you to perform actions on specific messages, including 'quarantine' via a POST request to the message action endpoint.
You are automating the addition of an IP blocklist in Umbrella. You have the IP address and the list ID. Which HTTP method and path is correct?
This is the correct path for adding destinations to a list.
Why this answer
Adding an entry to a destination list uses the POST method on the specific list resource.
What is the purpose of the 'Client ID' and 'Client Secret' when authenticating with the Cisco Secure Email Gateway API?
OAuth 2.0 uses these credentials to authenticate the client and issue a bearer token.
Why this answer
These credentials are used to identify the client application to the OAuth authorization server in order to obtain a temporary access token.
You are automating the extraction of SaaS security incidents from Cloudlock. You observe that incidents are being missed by your script. What is the most likely cause if your script is calling the API every 60 seconds?
To avoid missing events, one must use timestamps to ensure sequential fetching of data.
Why this answer
The Cloudlock API may have rate limits or specific event ingestion windows; if the script is not handling pagination or 'since' timestamps correctly, data might be skipped.
You are writing a script to update Cisco Secure Email (ESA) configuration. You need to push a new 'Content Filter' rule. Why is it recommended to perform a 'Get' request before the 'Put' request?
This is the 'read-modify-write' pattern essential for preventing accidental misconfiguration.
Why this answer
Performing a GET before a PUT allows the script to preserve existing configuration attributes that are not being modified, preventing accidental erasure of other fields.
What is the primary function of the Cisco Secure Email API 'Message Tracking' interface?
This is the primary purpose of the Message Tracking API.
Why this answer
The Message Tracking API allows administrators to search and retrieve metadata about specific emails that have passed through the gateway.
Which TWO of the following are key features of the Cisco Cloudlock API?
Retrieving security incidents is a core feature.
Why this answer
Cloudlock's API provides extensive capabilities for incident management and OAuth application auditing.
You are automating Cisco Umbrella reporting using the Reporting API. You need to pull threat activity logs for a specific destination. Which request header is mandatory to include in your HTTP GET call to authorize the request?
The Umbrella Reporting API requires an OAuth2 Bearer token in the Authorization header.
Why this answer
Cisco Umbrella Reporting API uses a Bearer token in the Authorization header for API authentication.
Which Cisco security product should you use if your main goal is to automate the blocking of malicious DNS queries?
Umbrella is built specifically for DNS-layer security.
Why this answer
Cisco Umbrella is the industry-standard cloud solution for DNS-layer security and policy automation.
A script interacting with Cisco Cloudlock is receiving a 429 Too Many Requests error. What should the automation script implement to handle this gracefully?
Exponential backoff is the standard mechanism to respect API rate limits.
Why this answer
Rate limiting (429) requires the implementation of an exponential backoff strategy.
When utilizing the Cisco Secure Email Reporting API, which format is best for programmatic data processing?
JSON is the standard format for modern, machine-readable API payloads.
Why this answer
JSON is the standard format for most Cisco APIs, including the Reporting API, as it is easily parsed by Python and other scripting languages.
You are managing Cisco Cloudlock settings via the API. You need to ensure that specific SaaS file-sharing events are flagged. Which API object must you target to define a new policy violation trigger?
The Policies API allows programmatic configuration of detection logic.
Why this answer
The Cloudlock API uses the 'Policies' endpoint to create or modify triggers that flag specific SaaS events.
Which of the following is a key advantage of using the Cisco Secure Email 'AsyncOS' API over manual CLI configuration for mass blocklist updates?
Automation via API ensures consistency and scalability that manual CLI work cannot match.
Why this answer
The AsyncOS API allows for programmatic, idempotent updates, which reduces human error and ensures consistency across multiple appliances.
Ready to test yourself?
Try a timed practice session using only Cloud Web And Email Security Automation questions.