300-735
Automating and Programming Cisco Security Solutions (300-735 SAUTO)
Automating and Programming Cisco Security Solutions (300-735 SAUTO): Exam Guide and Retirement Check
The 300-735 SAUTO exam validated practical implementation of Cisco security automation, including Python, RESTful APIs, data models, protocols, firewalls, cloud and endpoint security, and ISE. It served candidates pursuing security automation skills and Cisco certification paths connected to DevNet and CCNP Security. The most important decision now is not how to schedule SAUTO, but whether it is still an available route: Cisco lists 300-735 SAUTO as retired, so candidates should confirm a current replacement or alternative concentration exam before investing in SAUTO-specific preparation.
Is 300-735 SAUTO still available?
Cisco lists 300-735 SAUTO as retired and shows February 2, 2026 as its last day to test for CCNP Security. Cisco also states that retired exams are no longer available for certifying or recertifying, although certifications based on retired exams remain valid until their individual expiration dates.
That status changes the practical purpose of this guide. A candidate who needs a currently obtainable certification should not plan a new SAUTO appointment or rely on old practice-test availability. Instead, verify the current Cisco certification page for the relevant pathway and identify the active exam that now satisfies the intended requirement.
The official overview records February 24, 2020 as the first date candidates could test for 300-735 SAUTO. That historical date helps identify the exam’s lifecycle, but it is not a current scheduling opportunity. The retirement notice is the controlling source for availability.
What did SAUTO validate?
SAUTO validated the implementation of security automation solutions rather than only the memorization of product terminology. Its official scope combined programming concepts, RESTful APIs, data models, protocols, firewalls, web, DNS, cloud and email security, and Cisco Identity Services Engine (ISE).
The exam was therefore aimed at a candidate who could connect automation code to security operations. Useful preparation involved understanding how an API represents resources, how authentication and responses are handled, how a script changes or retrieves security data, and how that work fits the behavior of a Cisco security platform.
This distinction matters when using old SAUTO material for skills development. A product-by-product reading of documentation is less useful than tracing a complete workflow: define the security task, identify the platform API, construct the request or script, interpret the response, and check whether the resulting policy or telemetry meets the intended outcome.
Who was the exam designed for?
SAUTO was most relevant to security, network, and DevNet practitioners who needed to automate Cisco security platforms with code, APIs, or infrastructure-automation tools. It also suited candidates working toward Cisco credentials for which SAUTO could provide a specialist or concentration result, subject to Cisco’s certification rules at the time.
Cisco stated that passing SAUTO earned the Cisco Certified DevNet Specialist—Security Automation and Programmability certification. Cisco also stated that it satisfied the concentration-exam requirement for CCNP Security and Cisco Certified DevNet Professional.
Those outcomes should be treated as historical route information for a retired exam, not as a recommendation to pursue SAUTO now. If your goal is a current certification, start with the live certification requirements rather than assuming that an old concentration exam remains accepted. If your goal is capability development, the blueprint remains a useful map of security-automation topics, but product versions and current APIs must be checked against current Cisco documentation.
How was the blueprint divided?
The v1.1 blueprint assigned 10% to Network Programmability Foundation, 35% to Network Security, and 30% to Advanced Threat and Endpoint Security. These labels must stay attached to their percentages: the figures describe separate official exam domains, not general estimates of study time or difficulty.
The three listed domain weights do not by themselves describe every possible exam activity or provide a pass-score calculation. They are best used to prioritize revision after the candidate has read the complete official topic document. A smaller domain can still expose a foundational weakness that affects performance across several tasks.
Network Programmability Foundation covered common Git operations, REST and RPC API styles, synchronous and asynchronous API-consumption patterns, Python scripts, Python virtual environments, and Ansible or Terraform for security-platform automation. This domain supplied the working language for the security-platform tasks rather than functioning as an isolated programming section.
Network Security covered the Cisco Secure Firewall Management Center eStreamer API and APIs for Cisco Secure Firewall Management Center, Cisco Secure Firewall Device Manager, ISE, pxGRID, and Cisco Secure Network Analytics Enterprise. The blueprint specifically included implementing firewall objects, rules, intrusion policies, and access policies through Cisco Secure Firewall Management Center and Secure Firewall Device Manager APIs.
Advanced Threat and Endpoint Security covered Cisco Cloud Security APIs such as Umbrella and Investigate, the Cisco Secure Endpoint API, Cisco Secure Malware Analytics API, and Cisco XDR solution APIs. Its emphasis required candidates to think beyond firewall configuration and work with cloud, endpoint, malware-analysis, and XDR data or controls.
Which technical skills deserve the most attention?
A strong SAUTO study plan connected programming fundamentals to security outcomes. Do not study Python, REST, Git, firewalls, ISE, and cloud security as unrelated subjects; practise the handoff between them. The useful question is what an automated workflow must request, change, verify, and report.
For programming foundations, practise reading and modifying small Python scripts, creating and using a Python virtual environment, handling structured data, and separating configuration from code. Review common Git operations so that you can track a script, inspect a change, and restore an earlier version. These are practical habits, not substitutes for learning the relevant Cisco APIs.
For API work, distinguish REST from RPC styles and synchronous from asynchronous consumption. A synchronous workflow may wait for a direct response, while an asynchronous workflow may submit work and later retrieve status or results. Preparation should focus on recognizing the pattern and selecting the appropriate handling logic, not on memorizing generic labels.
For automation tooling, understand where Ansible or Terraform can fit into security-platform automation. Be able to explain what should be represented as managed configuration, what should be supplied as variables, and how an automation run can be checked for the desired state. Avoid treating a tool’s presence as proof that the underlying API behavior is understood.
For security operations, map each action to its platform and object type. A firewall object, access policy, intrusion policy, ISE endpoint attribute, pxGRID exchange, and security-analytics event are different resources with different purposes. A study note that names the platform, endpoint or interface, input data, expected response, and validation step is more useful than a page of disconnected commands.
How should you study the Network Security domain?
Start Network Security with a workflow diagram, then fill in the API details. The diagram should show the security objective, the Cisco platform involved, the data or policy object being manipulated, the automation client, and the verification result. This approach reduces the common mistake of learning endpoint names without understanding operational intent.
Use the blueprint’s platform list to create separate study cards for Cisco Secure Firewall Management Center, Cisco Secure Firewall Device Manager, ISE, pxGRID, and Cisco Secure Network Analytics Enterprise. For each card, record the role of the platform, the kind of information or policy it exposes, the authentication or access assumptions documented by Cisco, and the expected result of a successful automation step.
Firewall preparation should include the lifecycle of objects, rules, intrusion policies, and access policies. Practise reasoning about dependencies: a policy may refer to objects, and a change may need to be validated in the correct management system. When reviewing an example, ask what would happen if an object were missing, a rule were ordered incorrectly, or the returned status did not confirm the intended change.
The blueprint’s pxGRID requirement deserves focused practice. It required constructing a Python script for pxGRID to retrieve endpoint device type, network policy, and security telemetry information. A useful exercise is to design the script in stages: establish the client configuration, request the relevant information, parse the returned data, handle an unsuccessful response, and present the three required information categories clearly. Do not rely on memorized code fragments without understanding the data flow.
Cisco’s SAUI training description included hands-on work with Firepower Management Center, Firepower Threat Defense, ISE, pxGrid, Stealthwatch Enterprise and Cloud, Umbrella, AMP, Threat Grid, and Cisco Security Management Appliances. That list can guide a lab inventory or reading plan, but it should not be treated as proof that every current product interface behaves like the historical course environment.
How should you study Advanced Threat and Endpoint Security?
Treat this domain as an integration problem: cloud, endpoint, malware-analysis, and XDR APIs produce security information that automation can retrieve, enrich, or use in a response workflow. Preparation should make you comfortable identifying the source of an event, choosing the relevant API family, and determining what the returned data means before taking action.
Organize notes around Cisco Cloud Security APIs such as Umbrella and Investigate, the Cisco Secure Endpoint API, the Cisco Secure Malware Analytics API, and Cisco XDR solution APIs. For each area, distinguish investigation data from enforcement or response actions. A script that successfully retrieves an event has not necessarily completed the security workflow.
Practise handling structured responses and incomplete results. Your exercises should include selecting fields, checking whether the response represents one item or a collection, dealing with an error or empty result, and recording enough context for an operator to understand what happened. These habits transfer better than memorizing product-specific snippets from an old course.
Connect endpoint and cloud topics to the foundation domain. Use Python to retrieve data, use Git to maintain the script, and consider whether Ansible or Terraform is appropriate for the configuration portion. The purpose of the exercise is to make the boundary between code, API, and security platform explicit.
What practical study sequence works best?
A four-stage sequence is more efficient than moving randomly through product names: establish programming and API foundations, build one complete firewall or identity workflow, extend the pattern to endpoint and cloud services, and then review the blueprint for gaps. Since SAUTO is retired, use this sequence for transferable skills or historical understanding rather than exam scheduling.
Stage one should cover Git, Python scripts, virtual environments, REST and RPC styles, synchronous and asynchronous patterns, and structured data handling. Build a small script that reads configuration safely, sends a request, checks the result, and produces a useful output. Keep the script under version control and make a deliberate change so that the Git workflow is part of the exercise.
Stage two should focus on Network Security. Select a documented Cisco security API or interface and trace a complete object, policy, or telemetry workflow. Write down prerequisites, request inputs, response handling, and verification. Add an ISE or pxGRID exercise so that your preparation includes identity and telemetry interactions rather than only firewall policy.
Stage three should move to Advanced Threat and Endpoint Security. Compare the shape and purpose of data from cloud security, endpoint, malware-analysis, and XDR services. The objective is not to force every platform into the same script, but to recognize which parts of the automation pattern are reusable and which are product-specific.
Stage four should be a gap review. Read every topic in the v1.1 blueprint and classify it as can explain, can implement, or need to study. Give priority to items in the latter category, but do not ignore foundational gaps simply because Network Programmability Foundation carried 10% of the blueprint; that percentage names the official domain and does not measure how much other work depends on it.
What should a realistic practice lab contain?
A useful lab does not need to imitate a live exam. It should reproduce the reasoning an automation engineer uses: authenticate safely, call the right interface, process structured data, make a controlled change or retrieve evidence, and verify the result. Use only authorized Cisco environments, current documentation, and non-production targets.
Begin with a read-only task where possible. Retrieve a documented security object or telemetry record, inspect the response, and write a concise report. Then add validation for missing data, unsuccessful responses, and unexpected fields. This teaches defensive scripting without risking an unintended policy change.
Next, create a controlled policy workflow involving the objects, rules, intrusion policies, or access policies named in the blueprint. Document dependencies before running the automation. Afterward, verify the resulting configuration through the appropriate Cisco management interface or API instead of assuming that a successful HTTP response proves the desired state.
Add a pxGRID exercise that retrieves endpoint device type, network policy, and security telemetry information. Keep the script modular: configuration, connection, request, parsing, and output should be separable. This makes it easier to identify whether a failure comes from credentials, transport, authorization, response parsing, or the logic that interprets the data.
Finish by adapting the same structure to a cloud, endpoint, malware-analysis, or XDR API. Compare the authentication model, response shape, pagination or job behavior where documented, and the evidence needed to confirm success. These comparisons are practical recommendations, not claims about unpublished exam tasks.
Which mistakes reduce preparation quality?
The most damaging mistake is preparing as though SAUTO were still schedulable. Check the retirement notice first. If certification is the goal, redirect the plan to a current Cisco requirement; if automation skill is the goal, use the blueprint as a historical skills framework and validate every product detail against current sources.
Another mistake is memorizing endpoint paths without learning the resource model. An API request is only useful when you know what object it addresses, what inputs it needs, what permissions apply, and how to verify the effect. Write explanations beside code so that each request has an operational purpose.
Avoid studying percentages as if they were a pass-score formula. The official facts identify 10% for Network Programmability Foundation, 35% for Network Security, and 30% for Advanced Threat and Endpoint Security. They do not provide a passing score or authorize a conclusion that one domain can be safely ignored.
Do not confuse a course topic list with a guarantee about current platform behavior. Cisco’s SAUI training included hands-on work across several Cisco security products, while the v1.1 blueprint names particular API and automation capabilities. Use both sources to plan practice, then consult current product documentation before implementing anything.
Finally, do not use exam dumps or leaked-question claims as a substitute for competence. They cannot establish that a candidate can write a pxGRID script, reason about policy dependencies, or troubleshoot an API workflow, and using unauthorized material undermines reliable preparation.
What were the historical delivery details?
The official v1.1 blueprint lists a 90-minute duration for the 300-735 SAUTO exam. Because Cisco lists the exam as retired, this is a historical exam attribute rather than a scheduling instruction or evidence that an appointment can still be booked.
The official exam overview lists February 24, 2020 as the first date candidates could test for 300-735 SAUTO. The retirement page lists February 2, 2026 as the last day to test for CCNP Security. These dates explain the exam’s published lifecycle; they should not be repurposed as current availability claims.
The supplied official sources do not establish a current delivery method, testing language, question count, passing score, price, or active appointment process for SAUTO. Those details should therefore not be inferred from third-party listings or old preparation pages. Candidates choosing a current Cisco exam should obtain its delivery information from the current official exam page.
What should you do next?
First, decide whether your objective is a current credential or transferable security-automation capability. For a current credential, stop SAUTO-specific scheduling research and identify the active Cisco pathway that matches your target. For capability development, retain the blueprint’s programming, API, firewall, identity, cloud, endpoint, and telemetry themes while replacing retired product instructions with current documentation.
Next, audit your skills against the three named domains. Mark whether you can explain and implement Git and Python workflows, REST and RPC consumption, synchronous and asynchronous patterns, firewall and identity automation, pxGRID retrieval, and cloud, endpoint, malware-analysis, or XDR API use. A short script or documented lab result is stronger evidence than a topic marked as read.
Then choose one controlled end-to-end project. A suitable project could retrieve security telemetry, interpret it, and produce an operator-readable result; another could manage a documented policy object in an authorized lab and verify the resulting state. Include error handling, version control, and a brief explanation of why each API action is necessary.
Finally, recheck Cisco’s official certification and retirement information before committing time or money. Retired-exam material can still help explain the skills SAUTO represented, but only a current official requirement can tell you which exam or credential is available for your present objective.
Conclusion
300-735 SAUTO represented a practical security-automation skill set built around Python, APIs, Cisco security platforms, identity, telemetry, endpoint services, and cloud security. It is not a current scheduling route: Cisco lists it as retired and identifies February 2, 2026 as its last day to test for CCNP Security. Use the official blueprint to assess or develop transferable capability, then choose a current Cisco certification requirement before planning an exam appointment.
Related exams
- 300-835 exam — Automating Cisco Collaboration Solutions (CLAUTO)
- Securing Networks with Cisco Firepower (300-710 SNCF)
- Implementing and Configuring Cisco Identity Services Engine (SISE) v4.0 (300-715 SISE)
- 300-910 exam — Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)
- Securing Email with Cisco Email Security Appliance (300-720 SESA)
- Securing the Web with Cisco Web Security Appliance (300-725 SWSA)