300-735
Automating and Programming Cisco Security Solutions (300-735 SAUTO)
Automating and Programming Cisco Security Solutions (300-735 SAUTO) Exam Guide
The 300-735 SAUTO exam validated the ability to implement security automation with programming concepts, RESTful APIs, data models, protocols, firewalls, web and DNS security, cloud and email security, and Cisco ISE. It served candidates pursuing Cisco security automation and programmability skills, including concentration requirements for selected professional certifications. Cisco now lists SAUTO as retired, so the key decision is not how to schedule it, but whether its skills or certification history still fit your current plan.
What is the current status of 300-735 SAUTO?
Cisco lists 300-735 SAUTO as retired and shows February 2, 2026 as its last day to test for CCNP Security. Cisco states that retired exams are no longer available for certifying or recertifying, although certifications based on retired exams remain valid until their individual expiration dates.
This changes the preparation decision completely. A candidate who hoped to book SAUTO should not treat an old study plan, course listing, or practice-test catalogue as evidence that the exam is still available. Verify Cisco’s current certification and exam information before spending time or money on a replacement path.
The official exam overview records February 24, 2020 as the first date candidates could test for 300-735 SAUTO. That date is historical context, not a current scheduling window. The retirement notice is the relevant source for availability and certification status.
What did the exam validate?
SAUTO assessed implementation of security automation solutions rather than only memorization of product terminology. The official blueprint describes programming concepts, RESTful APIs, data models, protocols, firewalls, web, DNS, cloud and email security, and Cisco ISE as part of the tested scope.
The practical theme was integration: understand a security platform, identify the appropriate API or automation interface, work with structured data, and create or select an implementation that produces a useful security outcome. Preparation therefore needed to connect Python, API behavior, authentication concepts, platform objects, and policy changes instead of studying each topic as an isolated vocabulary list.
A useful interpretation for historical candidates is that the exam sat at the intersection of security operations and software development. Someone strong in firewall administration but weak in scripting could have needed programming practice; someone comfortable with Python but unfamiliar with identity, endpoint, and firewall policy workflows could have needed more platform labs.
Who was SAUTO designed for?
SAUTO was most relevant to candidates combining Cisco security administration with automation development. It suited practitioners who needed to automate policy, retrieve telemetry, connect security products, or use APIs and infrastructure-automation tools in a controlled workflow.
The certification outcomes were broader than one standalone badge. Cisco says passing SAUTO earned the Cisco Certified DevNet Specialist—Security Automation and Programmability certification and satisfied the concentration-exam requirement for CCNP Security and Cisco Certified DevNet Professional.
That made the exam attractive to at least three groups: security engineers extending operational workflows with code, DevNet candidates adding a security specialization, and CCNP Security or Cisco Certified DevNet Professional candidates using SAUTO as a concentration option. Because the exam is retired, those historical pathways should be checked against Cisco’s current requirements rather than assumed to remain available.
For a present-day learner, the underlying skills may still be useful even when the exam is not. The sensible distinction is between studying the blueprint as a technical skills map and treating it as an active certification target.
Which blueprint areas deserved the most attention?
The v1.1 blueprint assigns 35% to the Network Security domain, 30% to the Advanced Threat and Endpoint Security domain, and 10% to the Network Programmability Foundation domain. These percentages are attached to their official domain names and should guide historical study prioritization, but they do not establish a complete current exam plan now that SAUTO is retired.
Network Security was the largest named area. It included the Cisco Secure Firewall Management Center eStreamer API and APIs for Cisco Secure Firewall Management Center, Cisco Secure Firewall Device Manager, ISE, pxGRID, and Cisco Secure Network Analytics Enterprise. It also included implementing firewall objects, rules, intrusion policies, and access policies through Secure Firewall Management Center and Secure Firewall Device Manager APIs.
Advanced Threat and Endpoint Security covered Cisco Cloud Security APIs such as Umbrella and Investigate, the Cisco Secure Endpoint API, Cisco Secure Malware Analytics API, and Cisco XDR solution APIs. The emphasis was not limited to one endpoint product; it required candidates to understand automation across cloud security, endpoint response, malware analysis, and XDR capabilities.
Network Programmability Foundation covered common Git operations, REST and RPC API styles, synchronous and asynchronous API-consumption patterns, Python scripts, Python virtual environments, and Ansible or Terraform for security-platform automation. Although the domain carried 10% in the v1.1 blueprint, its skills supported work in the larger security domains.
How should the percentages affect study time?
For a historical preparation plan, begin with the named domain weights, then adjust for personal weakness. Network Security should normally anchor the plan because the Network Security domain carries 35%, while Advanced Threat and Endpoint Security carries 30%. Do not neglect the Network Programmability Foundation domain because its 10% covers the coding and automation habits used elsewhere.
A candidate who already administers firewall policies may need less product orientation but still should test API-based implementation. Conversely, a Python developer may need to spend more time translating code into security-platform workflows. Use the percentages to allocate attention, not to skip a domain that feels familiar.
What should you learn in the programming foundation?
The foundation work should make you comfortable moving from a version-controlled script to a reliable API-driven task. The blueprint specifically includes Git operations, REST and RPC API styles, synchronous and asynchronous API-consumption patterns, Python scripts, Python virtual environments, and Ansible or Terraform for security-platform automation.
Start by writing small Python programs that read structured input, make a request, inspect a response, and handle an unsuccessful result without hiding it. Then place the project in a virtual environment and track changes with Git. This sequence forces you to practice the workflow surrounding automation rather than only the syntax of an isolated code fragment.
Next, compare REST and RPC conceptually. For REST-style work, focus on resources, methods, paths, headers, payloads, and response handling. For RPC-style work, focus on invoking an operation with the expected arguments and interpreting the returned data. The objective is to recognize how the interface shapes the script.
Add synchronous and asynchronous patterns after the basic request flow is clear. Ask when a task should wait for a response and when it should submit work, monitor progress, or process a later result. Avoid treating asynchronous behavior as merely a different spelling of a synchronous call; it changes control flow and error handling.
Use Ansible or Terraform only after you understand the underlying security action. An automation tool can standardize execution, but it does not replace knowledge of the object, policy, dependency, or expected state being changed.
What is a useful foundation exercise?
Create a small repository containing a Python virtual environment, a configuration file that keeps secrets out of source code, a script that calls an API, and a clear README describing the expected input and output. Add a second implementation or task using Ansible or Terraform. Review the changes with Git and explain what would happen if the request were repeated.
This exercise is a recommendation, not an official exam requirement. Its value is that it exposes common weaknesses early: hard-coded credentials, unclear data types, no response validation, accidental duplicate changes, and scripts that work only from one machine.
How should you study Network Security automation?
Treat Network Security as a sequence of policy objects and dependencies, not as a list of endpoints. The blueprint includes APIs for Secure Firewall Management Center, Secure Firewall Device Manager, ISE, pxGRID, and Cisco Secure Network Analytics Enterprise, along with the eStreamer API and firewall policy implementation tasks.
Begin with the desired security outcome. For example, decide whether the task is to create or modify an object, change a rule, apply an intrusion policy, update an access policy, or retrieve operational information. Then identify the platform that owns the object, the API that exposes it, the data required, and any ordering or validation step needed before deployment.
Practice separating discovery from change. A safe automation sequence first retrieves existing state, confirms identifiers and relationships, constructs the intended change, submits it, and verifies the result. This is a practical recommendation rather than a claim about a particular exam question. It mirrors the reasoning required when an API can alter security enforcement.
For Secure Firewall Management Center and Secure Firewall Device Manager, pay particular attention to the difference between implementing firewall objects, rules, intrusion policies, and access policies. A script that creates an object but never attaches it to the relevant policy is incomplete. A script that changes a policy without checking scope or dependencies can be operationally unsafe.
Include eStreamer in your study map as a data-consumption problem. Ask what information the integration needs, how the data will be parsed, and how the automation will respond to missing, delayed, or unexpected events. Do not confuse a telemetry stream with an administrative API simply because both are accessed programmatically.
How should I approach ISE and pxGRID?
The blueprint requires constructing a Python script for pxGRID to retrieve endpoint device type, network policy, and security telemetry information. Build practice around those three kinds of information: establish the connection, request the relevant data, parse the response, and present the result in a form another workflow could consume.
A strong exercise should also make you explain the relationship between identity context and enforcement. Device type, network policy, and telemetry are not interchangeable fields. Record what each value means, how it is represented, and how a downstream decision could use it without silently treating incomplete data as authoritative.
Keep authentication and certificate handling separate from business logic in your own practice code. This makes troubleshooting easier and reduces the risk of copying credentials into scripts. It also helps you identify whether a failure comes from connection setup, authorization, request construction, response parsing, or the security platform itself.
How should you prepare for threat and endpoint APIs?
Advanced Threat and Endpoint Security requires a wider product map than firewall automation alone. The blueprint names Umbrella and Investigate APIs, the Cisco Secure Endpoint API, the Cisco Secure Malware Analytics API, and Cisco XDR solution APIs, so preparation should compare their automation purposes rather than memorize product names.
Build a matrix with four columns: product or service, information the API exposes, action the automation may perform, and evidence that the action succeeded. Populate it from the official blueprint and authorized product documentation available to you. This method helps distinguish investigation, detection, endpoint response, malware analysis, and cross-product orchestration.
For cloud security APIs such as Umbrella and Investigate, practice turning a lookup or security signal into structured output that another tool could use. For endpoint and malware-analysis APIs, focus on the difference between retrieving an observation and initiating a response. For XDR APIs, consider how signals from multiple sources are correlated or passed into a broader workflow.
Do not study these interfaces as if every API follows the same authentication, object model, or response format. The transferable skill is adapting a repeatable integration method to the specific service: inspect documentation, identify required inputs, validate the response, handle errors, and record the result.
Which hands-on environment is worth building?
The official SAUI training description includes hands-on work with Firepower Management Center, Firepower Threat Defense, ISE, pxGrid, Stealthwatch Enterprise and Cloud, Umbrella, AMP, Threat Grid, and Cisco Security Management Appliances. That list indicates the breadth of the intended practical ecosystem, but it does not promise that every learner has access to those products.
If you have an authorized lab, organize it around workflows rather than disconnected product demonstrations. A useful progression is identity and endpoint context, security telemetry, firewall policy, threat investigation, and then a small orchestration task joining information from more than one service. Document the inputs, API calls, output, and rollback or cleanup steps.
If you do not have the platforms, do not invent results from unavailable systems. Use the official topic blueprint to design pseudocode, inspect publicly authorized documentation, and practice request construction and response parsing with representative data that is clearly labeled as local test data. This develops transferable skills without claiming that a simulated result proves product proficiency.
Keep a lab notebook with the problem statement, assumptions, authentication method, request shape, response shape, error encountered, correction made, and verification step. The notebook becomes a revision tool and reveals gaps more reliably than rereading product names.
What is a practical study sequence?
A staged plan is more effective than switching between products at random. First establish Python, Git, API, and data-handling fundamentals; then move into firewall and identity workflows; next cover endpoint and cloud services; finally rehearse integrated troubleshooting and timed decision-making using only authorized study material.
Use the following sequence as a flexible roadmap rather than a promise about exam content or availability. Since SAUTO is retired, it is best used for historical preparation, skills development, or understanding work performed by teams that used the exam blueprint.
Stage one: map the blueprint and your gaps
Read the v1.1 blueprint once without attempting to memorize it. Mark each named technology or capability as strong, familiar, or unknown. Separate knowledge of security behavior from knowledge of the automation interface; being able to configure a policy manually does not automatically mean you can implement it through an API.
Choose a small number of outcomes for the first study cycle: one Python workflow, one API investigation workflow, one policy-automation workflow, and one endpoint or cloud-security workflow. This prevents broad reading from replacing demonstrable practice.
Stage two: build the programming workflow
Practice Git operations, virtual-environment setup, Python request and response handling, structured data parsing, and basic error management. Then compare synchronous and asynchronous consumption patterns and implement one of each with clearly documented assumptions.
At the end of this stage, explain your script line by line: where configuration enters, how authentication is handled, what response is expected, what failure looks like, and how a user knows the task completed. If you cannot explain those points, add testing before moving to product-specific automation.
Stage three: automate security-platform tasks
Work through firewall objects, rules, intrusion policies, and access policies as separate concepts before combining them. Add ISE and pxGRID practice, including the required endpoint device type, network policy, and security telemetry retrieval scenario described by the blueprint.
Then extend the same method to Secure Network Analytics Enterprise and the threat and endpoint services named in the blueprint. Record which operations are read-only, which change state, and which require verification by a second query or platform view.
Stage four: integrate and troubleshoot
Create workflows that begin with a security signal or identity fact and end with a documented action or report. Intentionally test invalid input, missing fields, unauthorized access, an unavailable service, and a response that is valid but not useful for the intended decision.
Review failures by category instead of repeatedly changing code at random. A connection problem, authentication problem, incorrect resource path, schema problem, policy dependency, and verification problem require different fixes. This diagnostic discipline is more valuable than copying a successful request without understanding it.
Stage five: make the scheduling decision
For an active exam, this stage would include checking the official exam page, confirming the current blueprint version, and booking only after the availability and requirements were verified. For SAUTO specifically, Cisco’s retirement notice means the candidate should stop looking for a new SAUTO appointment and investigate the current certification route instead.
Preserve the technical work if it remains relevant to your role. The retirement of an exam does not mean that API integration, Python automation, policy orchestration, or security telemetry skills have no operational value. It means the exam cannot be treated as the current certification vehicle.
How should you use the official course and blueprint?
The SAUI training page says the course prepares candidates for the 300-735 SAUTO v1.1 exam and describes hands-on work across the Cisco security products named there. Use the course description to identify practical themes, but use the official exam-topics document to control scope and terminology.
Read the blueprint as a checklist of capabilities. For every item, write one sentence explaining the security purpose, one small implementation task, and one verification method. If a topic names an API, identify the data or action involved; if it names a programming pattern, write a small example that demonstrates the control flow.
Do not assume that taking a course alone establishes readiness. Training can provide structure and demonstrations, while readiness depends on whether you can reproduce the reasoning and troubleshoot the workflow. Conversely, do not assume that a third-party question bank accurately represents a retired exam or its historical version.
What mistakes should candidates avoid?
The most damaging mistakes are treating a retired exam as schedulable, studying product names without workflows, and confusing a successful API request with a complete automation solution. Verify status first, then make study choices that match the actual objective—historical preparation, skills development, or a current certification replacement.
Relying on memorized questions is another poor strategy. It does not build the ability to choose an interface, construct data, manage authentication, interpret a response, or protect a security policy from unintended changes. No collection of remembered questions can substitute for authorized documentation and hands-on reasoning.
Avoid studying only the largest-looking product. The blueprint spans firewall, identity, telemetry, cloud, endpoint, malware-analysis, and XDR APIs. A narrow lab can create false confidence because the same request pattern may not transfer directly to another service.
Do not skip verification and failure handling. A script that returns a response is not necessarily a script that achieved the desired policy state. Check the resulting object or telemetry, distinguish warnings from success, and document what should happen when the platform rejects the request.
Finally, do not treat the official course’s product list as proof that every candidate must own or access every platform. Access varies. Use authorized environments, avoid unsupported claims about product behavior, and label simulated data clearly.
What should you do next?
Start with the retirement notice and current Cisco certification information, not an old booking page. If your goal is a current credential, identify the active exam or certification that now matches your role. If your goal is technical capability, use the SAUTO v1.1 blueprint as a structured backlog for Python, APIs, identity, firewall policy, telemetry, endpoint, and cloud-security automation.
A practical next-action checklist is: verify the certification path; download and read the official blueprint; mark your gaps; create a small Git-based Python project; practice one read workflow and one controlled policy workflow; add pxGRID retrieval for endpoint device type, network policy, and security telemetry; then document verification and failure handling.
Keep the source documents associated with your notes, especially when a topic or product changes over time. Exam retirement and platform evolution make old assumptions risky. The most durable preparation outcome is not a memorized exam label; it is the ability to design, implement, test, and explain a security automation workflow responsibly.
Conclusion
300-735 SAUTO provided a focused map of Cisco security automation skills, but Cisco now lists the exam as retired and identifies February 2, 2026 as its last day to test for CCNP Security. Do not plan a new SAUTO appointment. Instead, verify the current certification route for your objective, or use the v1.1 domains as a practical learning sequence: programming foundations, network security, identity and telemetry, and advanced threat and endpoint automation. That approach preserves the technical value of the blueprint without presenting an unavailable exam as an active target.
Related exams
- 300-835 exam — Automating Cisco Collaboration Solutions (CLAUTO)
- Securing Networks with Cisco Firepower (300-710 SNCF)
- Implementing and Configuring Cisco Identity Services Engine (SISE) v4.0 (300-715 SISE)
- 300-910 exam — Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)
- Securing Email with Cisco Email Security Appliance (300-720 SESA)
- Securing the Web with Cisco Web Security Appliance (300-725 SWSA)