71 questions · Network Security topic · All types, answers revealed
Which TWO of the following are components of a URL? (Choose two)
Mandatory for REST calls.
Why this answer
A URL typically includes the protocol (e.g., HTTPS) and the host/domain name.
When automating Cisco Stealthwatch (Secure Network Analytics) alerts, which API endpoint is used to query flow data?
This is the correct endpoint for flow-based data queries.
Why this answer
The Stealthwatch API provides specific endpoints under '/sw-reporting/v1/' for flow data retrieval.
You are implementing automated log retrieval from Cisco ASA using the REST API. What is the limitation of the 'get_logs' endpoint?
Why this answer
The ASA REST API is limited in how much logging data it can stream; it is not designed for bulk historical log aggregation.
Mandatory to specify the endpoint.
Why this answer
A valid HTTP request must include the method, the destination URL, and appropriate headers.
Which TWO of the following steps are involved in the Cisco Firepower API authentication workflow? (Choose two)
This token is used for all subsequent calls.
Why this answer
The workflow involves sending credentials to the authentication endpoint and capturing the returned access token.
You are performing a bulk update of Security Group Tags (SGTs) in Cisco ISE. Which mechanism should you prioritize to minimize load on the API when processing thousands of tags?
The Batch API allows processing multiple resource updates in a single request.
Why this answer
Using the bulk API endpoints or ERS (External RESTful Services) with batch processing is the correct way to handle large datasets effectively.
Which TWO of the following are primary benefits of automating Cisco security policies via APIs? (Choose two)
Scripts ensure uniform policy application.
Why this answer
Automation reduces human error and ensures configuration consistency across the environment.
You are automating Firepower Management Center event retrieval. You notice your script is getting an HTTP 429 response. What should your automation script implement?
Exponential backoff is the standard mechanism to gracefully handle rate-limiting.
Why this answer
An HTTP 429 'Too Many Requests' error indicates rate-limiting. A robust script must implement exponential backoff to respect the API rate limits.
Which TWO of the following are valid methods for interacting with Cisco ISE programmatically?
pxGrid is the standard interface for ISE context sharing.
Why this answer
Cisco ISE provides the ERS (RESTful) API for configuration and the pxGrid API for context sharing.
Which Cisco security product API supports 'Bulk' operations to improve efficiency when modifying large numbers of objects?
FMC supports bulk operations for objects.
Why this answer
The FMC API includes 'bulk' endpoints to allow creating or updating multiple objects in a single API call.
You are automating Cisco Firepower Management Center (FMC) object creation using the REST API. You successfully POST a new network object, but the changes do not appear on the managed Firepower Threat Defense (FTD) device. What is the mandatory final step to ensure the changes take effect?
Deployment is a separate asynchronous operation from the configuration update in the FMC API.
Why this answer
After pushing configuration changes via the FMC REST API, the configuration must be deployed to the FTD devices using the /api/fmc_config/v1/domain/{domainUUID}/deployment/deployabledevices endpoint to trigger the deployment process.
What is the primary function of a 'Bearer Token' in an API request?
It acts as the credential.
Why this answer
A Bearer Token is a credential that allows the holder (the bearer) to access the protected resource.
You are configuring an Ansible playbook to manage Cisco Firepower policies. Which module is specifically designed to interact with FMC objects?
This is the official collection for managing FMC through Ansible.
Why this answer
The 'cisco.fmcansible' collection provides the specific modules required to manage FMC objects via the API.
When interacting with the Cisco ISE ERS API, you receive an HTTP 401 error. What is the most likely cause?
401 Unauthorized is returned when credentials fail verification.
Why this answer
HTTP 401 indicates unauthorized access, which means the provided credentials or the authentication token is invalid or missing.
Which THREE of the following are common issues encountered when automating Cisco Security APIs? (Choose three)
Common cause of 'not found' errors.
Why this answer
Common issues include authentication failure, rate limiting, and incorrect API versions or endpoints.
Which THREE of the following are key considerations when designing an automated security script? (Choose three)
Essential for debugging.
Why this answer
Scripts must handle errors, log activities, and be secure.
GET is the read-only method for resource retrieval.
Why this answer
The GET method is standard for retrieving resource state information from the REST API without modifying the configuration.
A network engineer is using the Cisco Firepower Management Center (FMC) API to retrieve access control policy information. Which HTTP method should be used to perform a read-only request for a specific policy resource?
GET is used to retrieve data.
You are running a script that interacts with the Cisco ISE ERS API. The script is designed to perform a bulk import of users. Which HTTP code should you expect for a successful creation request?
201 is the correct code for resource creation.
Why this answer
HTTP 201 Created is the standard response for a successful POST request that creates a new resource.
Which element in an API request is most often used to filter the amount of data returned?
Query parameters filter the response.
Why this answer
Query parameters (e.g., ?limit=10 or ?offset=5) are the standard way to filter and paginate API responses.
Which THREE of the following actions can be automated via the Cisco ASA REST API?
Retrieving state information is a standard operation.
Why this answer
The ASA REST API supports CRUD operations on objects, interface status checks, and the configuration of access control rules.
Which protocol is primarily used for the transport of API calls in the Cisco security portfolio?
Which THREE of the following are methods used in REST APIs? (Choose three)
Standard create method.
Why this answer
GET, POST, and DELETE are fundamental HTTP verbs used in RESTful interactions.
When using the Cisco ISE ERS API, what is the impact of not specifying the 'Accept' header in your request?
Standard behavior for REST services.
Why this answer
If 'Accept' is not specified, the server might default to an unexpected content format, leading to parsing errors in the client application.
When working with Cisco Firepower API, what is the role of the 'ETag' header in an API response?
ETags prevent overwriting concurrent changes.
Why this answer
The ETag (Entity Tag) is used for optimistic concurrency control to ensure that an update is only applied if the resource has not changed since it was last retrieved.
You are writing a Python script to interact with the Cisco Adaptive Security Appliance (ASA) via the REST API. You need to verify that your session token remains valid. Which header must be included in subsequent API calls to maintain the authenticated session?
The ASA REST API uses the X-Auth-Token header to validate the session.
Why this answer
The 'X-Auth-Token' header is the standard mechanism for passing the authentication token obtained from the initial login request to the ASA REST API.
Which Python library is the industry standard for sending HTTP requests to Cisco security APIs?
The requests library is the standard choice for API automation.
Why this answer
The 'requests' library is the most widely used and recommended library for interacting with REST APIs in Python due to its simplicity and robust feature set.
Which TWO of the following are key features of the Cisco DevNet site? (Choose two)
Essential for testing.
Why this answer
DevNet provides both learning labs and API sandboxes for developers.
You are using the Cisco Firepower Management Center (FMC) API to retrieve a list of Access Control Policies. Which URL endpoint is correct?
This is the correct path for accessing ACPs.
Why this answer
The FMC API structure follows the /api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies path.
Which TWO components are typically required to initiate a connection to the Cisco Umbrella API?
Required for cryptographic authentication.
Why this answer
To interact with the Umbrella API, you need a generated API Key and the corresponding Secret to authenticate requests.
Which Cisco Security tool uses 'Webhooks' to push real-time threat intelligence to external systems?
Umbrella supports webhooks for event streaming.
Why this answer
Cisco Umbrella and SecureX leverage webhooks to send alerts to external platforms in real time.
In a Cisco security automation environment, what does the 'API Rate Limit' represent?
Rate limits protect the infrastructure from overload.
Why this answer
Rate limits restrict the number of requests a client can make in a specified time window to protect API availability.
Which TWO of the following are true regarding the Cisco Firepower Management Center (FMC) API?
Authentication is performed via token generation endpoints.
Why this answer
The FMC API is REST-based and uses OAuth 2.0 (via the /api/fmc_platform/v1/auth/generatetoken endpoint) for session management.
When designing secure network automation, which practice is considered the most critical for API credentials?
Externalizing secrets is the standard for secure automation.
Why this answer
Storing credentials in plaintext is a severe security vulnerability. Using secret managers (like HashiCorp Vault) or environment variables is the required best practice.
When using the Cisco Umbrella Reporting API, what is the default limit for the number of records returned in a single GET request?
100 is the standard default limit for Umbrella API reports.
Why this answer
The Umbrella Reporting API enforces a default limit (typically 100) on the number of results per request to ensure system performance; pagination is required for larger sets.
When automating security, which methodology is used to treat infrastructure configurations as code?
IaC defines infrastructure via code.
Why this answer
Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure through machine-readable definition files.
What does the 'Authorization' header in a REST API call carry?
This is the standard location for authentication data.
Why this answer
The 'Authorization' header typically carries the bearer token or credentials required to prove the client's identity to the API server.
When using the Cisco SecureX API, what is the purpose of the 'Application Name' field in the API client registration?
It facilitates tracking and management in SecureX.
Why this answer
The Application Name (or Client Name) is used for identification and auditing in the SecureX dashboard, allowing administrators to track which application is consuming resources.
You are automating Cisco Firepower policy deployment. After updating the Access Control Policy (ACP) via the API, you must initiate the deployment. Which API endpoint triggers the deployment task?
This endpoint is correctly defined for triggering deployment tasks.
Why this answer
The /api/fmc_config/v1/domain/{domainUUID}/deployment/deployabledevices endpoint is used to initiate the deployment process after changes are made.
Which TWO of the following are true about Cisco Firepower API? (Choose two)
Primary function of FMC API.
Why this answer
The FMC API is REST-based and allows for configuration of policies and objects.
Which Cisco security component provides visibility and control over cloud-based threats?
Umbrella is cloud-native security.
Why this answer
Cisco Umbrella is the primary cloud-delivered security service (DNS-layer security and SWG).
In Python, which HTTP library is most recommended for interacting with Cisco Security APIs due to its simplicity and features?
It is the standard for API automation.
Why this answer
The 'requests' library is the industry standard for HTTP interactions in Python due to its human-readable syntax and built-in features.
You are writing a script to parse FMC API response data. The response is a nested JSON object. Which Python library is standard for handling this task?
The json module is standard for parsing JSON structures.
Why this answer
The 'json' module is the built-in Python library for encoding and decoding JSON objects.
Which authentication method is most commonly used by Cisco SecureX for API access?
SecureX leverages OAuth 2.0 for secure API access.
Why this answer
SecureX uses OAuth 2.0 with Client Credentials for machine-to-machine authentication.
Which Cisco technology allows you to automate the distribution of Indicators of Compromise (IoCs) across the security stack?
TID is specifically designed for IoC intake and automated distribution.
Why this answer
Cisco Threat Intelligence Director (TID), integrated into Firepower, automates the intake and distribution of IoCs to various sensors and devices.
When automating Cisco Stealthwatch, which authentication type is utilized for the API?
These are the common methods for Stealthwatch.
Why this answer
Stealthwatch uses a combination of API keys or username/password authentication depending on the version and configuration.
You are utilizing the Cisco ISE ERS API to provision a guest account. If the API returns a '409 Conflict', what is the most likely cause?
409 status code signals an object conflict.
Why this answer
A 409 Conflict indicates that the request could not be processed because the resource (e.g., a guest account with the same ID) already exists.
Which Cisco tool is best suited for centralizing the management of security APIs across multiple platforms?
Designed for cross-platform API automation.
Why this answer
Cisco SecureX Orchestration (formerly Cisco Defense Orchestrator/Cisco Cloud Orchestrator) provides the ability to chain and automate API calls across Cisco security products.
When automating threat hunting with the Cisco SecureX Threat Response API, which object type is commonly used as a search parameter?
Observables are the building blocks of threat hunting in SecureX.
Why this answer
Threat Response uses 'observables' (e.g., IP addresses, file hashes, domains) as the primary objects for investigation.
Which TWO of the following are characteristics of the Cisco ISE ERS API? (Choose two)
Core function of the ERS API.
Why this answer
ERS is a RESTful API and supports CRUD operations on ISE resources.
You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?
The ERS API follows standard REST conventions where PUT is used for updates.
Why this answer
The Cisco ISE ERS API uses PUT for updates. For guest users, the correct path is /ers/config/guestuser/{id}.
What is the primary function of an API 'sandbox' in Cisco DevNet?
They isolate testing from production.
Why this answer
Sandboxes provide a pre-configured environment for developers to test and validate their API calls without affecting production networks.
Which TWO of the following are types of Cisco Security API documentation? (Choose two)
Standard machine-readable docs.
Why this answer
Cisco provides Swagger (OpenAPI) and HTML-based documentation for its APIs.
Which THREE of the following are core principles of Secure Network Design when using APIs?
Limit API key permissions to only what is required.
Why this answer
Secure API design relies on Principle of Least Privilege, robust logging/auditing, and encrypted communication channels (TLS).
Which THREE of the following fields are commonly found in a JSON API response object? (Choose three)
Helps in handling large datasets.
Why this answer
JSON responses typically contain data, status codes, and message information.
PUT is the standard method for full resource updates in RESTful APIs.
Why this answer
The PUT method is used for full updates of resources in the FMC REST API, replacing the existing object with the provided payload.
You are automating Firepower Management Center (FMC) object creation using the REST API. You send a POST request to /api/fmc_config/v1/domain/{domainUUID}/object/networkaddresses with a body containing a name and type. The request returns a 400 Bad Request error. What is the most likely cause?
The API requires the 'value' field for network objects to define the IP/CIDR.
Why this answer
When creating network objects, the 'value' field is mandatory for defining the subnet or host address. Without it, the schema validation fails.
When automating Cisco Security solutions, what is the primary benefit of using a 'Service Account' instead of a personal user account for API authentication?
Service accounts prevent script failure when employees leave.
Why this answer
Service accounts provide non-expiring credentials that are not tied to an individual's lifecycle, ensuring script continuity.
Which TWO of the following are valid ways to test Cisco APIs before deployment? (Choose two)
Safest way to test.
Why this answer
Testing in a lab environment or using a dedicated API tool like Postman is best practice.
You are automating threat response using Cisco Threat Response. You want to retrieve a list of verdicts for a specific observable (e.g., an IP address). Which API provides this capability?
The CTR API provides access to integrated verdict data for observables.
Why this answer
The Cisco Threat Response API (often integrated via the 'private cloud' or 'public cloud' API endpoints) allows querying indicators and verdicts for specific observables.
In the context of the Cisco Firepower API, what does a 'GET' request to '/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies' return?
Correct path for retrieving access policies.
Why this answer
This path is the standard RESTful endpoint for listing all access control policies within a specific domain on the FMC.
When using the FMC API, what is the purpose of the 'X-Auth-Access-Token' header?
This header provides the token required for authorized access.
Why this answer
The X-Auth-Access-Token is used to authenticate subsequent API requests after the initial authentication handshake.
Which THREE of the following are best practices for managing API keys? (Choose three)
Reduces impact of compromised keys.
Why this answer
Keys should never be hardcoded, should be rotated regularly, and restricted to the least privilege.
You are configuring a CI/CD pipeline to deploy Cisco ASA firewall rules. Which step is essential to ensure the changes are correct before applying them to production?
Staging ensures configuration validity.
Why this answer
Validating changes in a staging or pre-production environment is critical to ensure logic and syntax correctness.
Which Cisco security product uses the pxGrid framework to share contextual information with other network devices?
ISE is the core identity platform for pxGrid integration.
Why this answer
Cisco ISE (Identity Services Engine) is the primary platform that utilizes pxGrid to share identity and policy context across the network ecosystem.
Which programming language is most commonly used for Cisco Security automation tasks?
Python is the preferred language for Cisco automation.
Why this answer
Python is the industry standard for network and security automation due to its extensive library support and readability.
Which TWO steps are required to properly authenticate to the Cisco Firepower Management Center (FMC) API using the REST API Explorer?
This is the entry point for API authentication.
Why this answer
Authentication requires sending a POST request to /api/fmc_platform/v1/auth/generatetoken and storing the returned X-auth-access-token header.
You are troubleshooting a Python script using the Cisco pxGrid API. The script fails to receive notifications from ISE. Which component must be verified first?
Verification of the active connection is essential for data flow.
Why this answer
The pxGrid connection state must be established and 'active' to receive notifications. The connection is a two-way handshake process.
A script needs to update a Cisco Firepower object. Which API workflow is correct?
Standard RESTful update pattern for FMC.
Why this answer
The standard workflow is to GET the current object to retrieve its 'id' and 'version', then perform a PUT to update it.
In the context of the Cisco ASA REST API, what is the role of the 'ETag' header in an API response?
ETags track resource versions to prevent conflicts during concurrent modifications.
Why this answer
The ETag (Entity Tag) is used for concurrency control. It ensures that when you update a resource, you are modifying the version you expect, preventing 'lost updates'.
Ready to test yourself?
Try a timed practice session using only Network Security questions.