Network Security practice questions

Configure the ASA to allow API access via 'api-server enable' in the CLI.

Why it fails: This is a prerequisite, not a step in the programmatic authentication process itself.

Use Basic Auth in every request instead of a token.

Why it fails: Basic Auth is generally deprecated or not the primary method for the REST API session lifecycle.

X-Auth-Token

Why it fails: This header is used in other Cisco platforms like APIC, but not ASA.

User-Agent: API-Client

Why it fails: User-Agent is not an authentication requirement.

Cookie: session_id

Why it fails: While cookies may be used in web UI, the REST API standard for ASA is Bearer authentication.

Umbrella Enforcement API

Why it fails: Used for pushing domain blocks via external sources.

Umbrella Reporting API

Why it fails: Used for retrieving log data.

Umbrella Investigate API

Why it fails: Used for threat lookups.

Cisco IOS XE

Why it fails: IOS XE does not natively use webhooks for security alerts.

Cisco ASA

Why it fails: ASA does not natively support webhooks for alert streaming.

Cisco AnyConnect

Why it fails: AnyConnect is a VPN client.

It requires an active VPN session.

Why it fails: The get_logs endpoint's documented constraint concerns retrieval scope and buffered data rather than VPN state; API authentication uses tokens over HTTPS regardless of tunnel. It tempts because ASA management access is often reached through VPN, so candidates assume session dependency where none is specified.

It only supports XML format.

Why it fails: The endpoint returns JSON, matching the REST API's default representation, so an XML-only restriction is inaccurate. It tempts because NETCONF and older ASA interfaces are XML-centric, leading candidates to carry that assumption across to the REST implementation.

It does not support real-time logs.

Why it fails: It is intended for monitoring, but not high-volume storage.

Request Body

Why it fails: A request body is optional; GET and DELETE requests typically carry none, so it is not mandatory. It is tempting because POST and PUT operations require a body to supply resource data, making it essential in those specific cases rather than in every REST request.

Database Password

Why it fails: Database credentials are never part of an HTTP REST request; the API server handles database access internally. It is tempting because authentication is mandatory, but that uses the Authorization header with API credentials, not a database password.

3xx (Redirection)

Why it fails: Not a common return for API data calls.

7xx (Security Error)

Why it fails: 7xx is not a standard HTTP class.

Authorization: Bearer

Why it fails: The ASA REST API expects its own token header rather than an OAuth-style bearer scheme, so Authorization: Bearer is rejected or ignored. Bearer tokens are the correct mechanism for OAuth 2.0-protected APIs such as Microsoft Entra ID-secured endpoints, which is why the header looks familiar.

Session-Key

Why it fails: Session-Key is not the header name the ASA REST API validates; the token must be supplied as X-Auth-Token. The plausible-sounding name tempts candidates generalising from other session mechanisms. Session-Key would be the right concept where an appliance documents that exact header, which the ASA does not.

Cookie: session_id

Why it fails: The ASA REST API does not maintain sessions through browser-style cookies; it authenticates each call with the X-Auth-Token header carrying the token from the login response. Cookie: session_id is correct for cookie-based web sessions, which is why it appears credible here.

/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies/deploy

Why it fails: Deployment is triggered through the deployment endpoint under /api/fmc_config/v1/domain/{domainUUID}/deployment/deployabledevices, not a sub-path of accesspolicies. It is tempting because the ACP was just modified, but that collection manages policy objects; the deploy action lives on the deployment resource.

/api/fmc_config/v1/domain/{domainUUID}/devices/deploys

Why it fails: The devices collection exposes device records, not deployment tasks; the correct path is /api/fmc_config/v1/domain/{domainUUID}/deployment/deployabledevices. It is tempting because deployment targets devices, but the URI must name the deployment resource, and deploys is not a valid segment there.

/api/fmc_config/v1/domain/{domainUUID}/action/deploy

Why it fails: The deploy endpoint is /api/fmc_platform/v1/domain/{domainUUID}/action/deploy, not the fmc_config path, so this URL returns 404. It is tempting because fmc_config hosts most object and policy CRUD operations, and would be the correct base for creating or updating an ACP rather than triggering its deployment.

OAuth 2.0 with client credentials grant

Why it fails: FMC does not use OAuth 2.0 for its REST API authentication. While OAuth 2.0 is common in many modern APIs, FMC uses a simpler token-based mechanism. Using OAuth would require additional configuration and is not supported natively by the FMC REST API, so this method would fail.

Basic authentication with username and password

Why it fails: Basic authentication is not used to generate a token; it sends credentials in every request. The FMC API uses a dedicated token generation endpoint. While you might use basic auth as part of the token request, the primary method to obtain a token is not basic authentication alone. The question asks for the method to generate the token, which involves a specific header.

API key passed as a query parameter

Why it fails: FMC does not use API keys passed as query parameters. API keys are common in other platforms, but FMC requires a token obtained via a specific authentication endpoint. Query parameters are not used for authentication in FMC and would be insecure if they were. The correct method involves headers and a token.

GET /domains/security/{domain}

Why it fails: The /domains/security/{domain} endpoint is not a standard Umbrella Investigate API endpoint. While there is a /security endpoint for IPs, for domains the security information is part of the categorization response. Using this endpoint would fail. The correct approach is to use the categorization endpoint or other documented endpoints like /domains/volume.

GET /domains/volume/{domain}

Why it fails: The /domains/volume/{domain} endpoint does exist in the Umbrella Investigate API, but it returns request volume information, not general security information. The question asks for retrieving security information, which is more directly obtained from categorization. Volume data is about traffic patterns, not threat categorization. So this is not the best answer for security information.

GET /domains/risk-score/{domain}

Why it fails: The Umbrella Investigate API does not have a /domains/risk-score/{domain} endpoint. Risk score information is typically included in the categorization response or via other endpoints like /domains/security. Attempting to use this endpoint would result in a 404 Not Found error. The correct endpoints for risk-related data are different.

X-auth-access-token: <token>

Why it fails: The X-auth-access-token header is used by Cisco FMC REST API, not by Cisco ISE. ISE uses a different authentication mechanism, typically an ERS token or a session cookie. Using this header with ISE will not authenticate the request.

Authorization: Basic <base64-encoded-credentials>

Why it fails: While Basic Authentication is used to obtain an authentication token, subsequent API calls must use the token in a custom header or as a cookie. Using Basic Auth for every call is not the intended method and may not be supported for all endpoints after token generation.

Cookie: ISE_SESSION=<session-cookie>

Why it fails: While ISE may use a session cookie for authentication in some contexts, the standard REST API authentication after obtaining a token uses the token in a custom header or as a query parameter. The session cookie is not the primary method for API authentication.

PATCH

Why it fails: PATCH performs a partial modification of an existing resource, altering only supplied fields rather than retrieving data. It is tempting because PATCH targets a specific resource URI, mirroring the addressing a read would use, but its semantics are write-only. A read-only request requires GET, which returns the resource representation without side effects.

POST

Why it fails: POST submits data to create a subordinate resource or trigger an operation, so it changes state rather than returning a representation. It is tempting because POST can target a collection URI and its response may echo data, but no retrieval semantics apply. A read-only request requires GET, which is safe and idempotent.

PUT

Why it fails: PUT replaces an entire resource with the supplied representation, making it a write operation, not a read. It is tempting because PUT addresses a specific resource URI exactly as a retrieval would, but it overwrites rather than returns content. A read-only request requires GET, which performs no modification.

POST /ers/config/guestuser/update

Why it fails: ERS updates an existing guest user by PUT to /ers/config/guestuser/{id}; there is no /update suffix and POST targets the collection for creation. It is tempting because POST is widely used for state changes, but Cisco ISE ERS reserves POST for creating resources, not modifying an identified one.

UPDATE /ers/config/guestuser/{id}

Why it fails: UPDATE is not an HTTP method; ERS expects PUT against /ers/config/guestuser/{id} to replace the guest user representation. It is tempting because the verb describes the intent, but REST constrains methods to the standard set, and ISE returns an error for unrecognised verbs.

PATCH /ers/config/guestuser/{id}

Why it fails: ISE ERS does not support PATCH for guest user updates; partial modification is not offered, so PUT to /ers/config/guestuser/{id} is required. It is tempting because PATCH suits partial updates generally, yet the ERS API documents PUT only for this resource.

/api/fmc_config/v1/policy/access

Why it fails: The FMC configuration API requires the domain UUID segment, so the correct path is /api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies; omitting it returns an error. It is tempting because it mirrors the visible resource hierarchy, but the mandatory domain scoping segment is missing.

/api/v1/fmc/acp

Why it fails: The FMC REST API is versioned under /api/fmc_config/v1/, not /api/v1/, and access control policies are addressed as domain-scoped objects rather than an fmc/acp path. It tempts because a short, readable v1-style route resembles other Cisco controller APIs, yet FMC exposes no such endpoint.

/api/fmc_config/v1/domain/policy/accesspolicies

Why it fails: Access control policies are retrieved through the policy/accesspolicies collection, but the domain segment must carry the actual domain UUID; the literal placeholder 'domain' is not a resolvable path element. It tempts because the surrounding structure matches the genuine FMC REST hierarchy, so only the substituted domain identifier is wrong.

The FMC automatically pushes objects immediately after the POST request returns 201.

Why it fails: POSTing an object to FMC stores it in the configuration database; a deploy request is required to push changes to managed FTD devices. It is tempting because a 201 response confirms creation, and automatic push would be correct only if the platform propagated changes without an explicit deployment step.

Send a commit command to the FTD device directly via SSH.

Why it fails: FTD devices do not accept object configuration directly over SSH; they receive policy and object changes from the FMC through a deployment job. It is tempting because CLI commits are standard on other Cisco platforms, but FMC-managed FTD is configured centrally, not per-device.

Restart the snort process via the API.

Why it fails: Restarting Snort reloads the inspection engine but does not deploy the staged object; the change stays in the FMC database. It is tempting because Snort restarts do apply some policy changes, but object deployment requires submitting a deployment job through the FMC API.

Use Basic Auth in the header with admin credentials

Why it fails: FMC's REST API Explorer authenticates by generating a token from a POST to /api/fmc_platform/v1/auth/generatetoken, then using that token in the X-auth-access-token header; Basic Auth with admin credentials is rejected. It is tempting because Basic Auth is common for REST APIs generally.

Perform a GET request to the root URL

Why it fails: A GET to the root URL returns API discovery information, not an authentication token, so it cannot satisfy the login step. It is tempting because discovery is a legitimate first call in many REST workflows, but FMC requires the generatetoken POST before any authenticated request.

Send credentials in the URL query string

Why it fails: FMC rejects credentials placed in the URL query string; authentication requires a POST to the generatetoken endpoint with credentials in the body, returning a token for the X-auth-access-token header. It is tempting because query-string credentials appear in some legacy APIs, but FMC does not accept them.

POST

Why it fails: POST creates a new subordinate resource and cannot replace an existing object's full representation. PUT performs the complete replacement the task demands. POST would be correct when creating a new object or invoking an action endpoint, not when fully overwriting an existing one.

GET

Why it fails: GET is a safe, read-only method that retrieves a resource representation and cannot modify an object at all. PUT performs the full update the scenario requires. GET is tempting because you often call it first to fetch the object's current state before editing, but retrieval alone never persists changes.

PATCH

Why it fails: PATCH applies a partial modification, sending only changed fields, so untouched properties remain as-is rather than being replaced. PUT is the method that overwrites the entire resource representation. PATCH is tempting because it reduces payload size and suits targeted edits, but the stem demands a full update.

cisco.ise.ise_policy

Why it fails: cisco.ise.ise_policy manages Cisco Identity Services Engine policy objects, not Firepower Management Center configuration. It tempts because both are Cisco security platforms with policy constructs, so the module name reads plausibly, yet it never authenticates to FMC or manipulates access control policies, objects, or device records.

cisco.asa.asa_config

Why it fails: cisco.asa.asa_config pushes configuration lines to Cisco ASA appliances over SSH, not to the FMC REST API. It tempts because ASA and Firepower share heritage and both enforce access control, but the module targets ASA CLI syntax and cannot create or modify FMC policy objects.

cisco.ios.ios_config

Why it fails: cisco.ios.ios_config applies configuration to Cisco IOS devices via network CLI transport, not FMC's REST interface. It tempts because IOS access lists also filter traffic, so the module appears policy-related, but it addresses routers and switches rather than Firepower Management Center object models.

To specify the target device IP address.

Why it fails: The X-Auth-Access-Token header carries the authentication token returned by the FMC login, authorising subsequent API calls; it does not address devices. It is tempting because device targeting also appears in FMC API paths and payloads, but that is handled by resource URIs and object fields, not this header.

To define the API version.

Why it fails: API version selection in the FMC API is expressed through the request URL path, not through the authentication header. X-Auth-Access-Token exists solely to present the session token obtained at login. It is tempting because headers commonly carry metadata such as content type, but versioning here is a URI concern.

To enable debugging mode.

Why it fails: The X-Auth-Access-Token header carries the access token that authenticates each FMC API request, so it grants authorisation rather than toggling debug output. Debugging is controlled through logging configuration and diagnostic endpoints, making this header the wrong mechanism for that purpose.