Automating and Programming Cisco Security Solutions (300-735 SAUTO): Candidate Decision and Study Guide
Cisco’s 300-735 SAUTO validates implementation of security-automation solutions across programming concepts, APIs, data models, protocols, firewalls, web, DNS, cloud and email security, and ISE. It was intended for candidates pursuing automation-focused Cisco security and DevNet pathways. The immediate decision is not how to book the exam: Cisco lists SAUTO as retired. Use this guide to understand the assessed skills, judge whether the blueprint supports current professional goals, and organize study or skills maintenance without relying on unavailable exam access.
Should you schedule 300-735 SAUTO now?
No. Cisco lists 300-735 SAUTO as retired and shows February 2, 2026 as its last day to test for CCNP Security. Cisco also states that retired exams are no longer available for certifying or recertifying. Candidates should therefore verify a current Cisco certification path before investing in a SAUTO test appointment.
The retirement status changes the purpose of this page. The v1.1 blueprint remains useful as a skills map for Cisco security automation, API integration, Python scripting, and policy orchestration, but it should not be treated as evidence that a live exam appointment can be booked. Review Cisco’s current certification and exam catalogue for an active replacement or another applicable requirement.
Cisco’s retirement guidance also says certifications based on retired exams remain valid until their individual expiration dates. That is different from saying the exam remains available. If you already earned a certification that used SAUTO, check its personal status and expiration information rather than assuming retirement immediately cancels it.
What was the exam’s role?
Cisco says passing SAUTO earned the Cisco Certified DevNet Specialist—Security Automation and Programmability certification and satisfied the concentration-exam requirement for CCNP Security and Cisco Certified DevNet Professional. Those outcomes explain why the exam attracted both security specialists and developers working with Cisco platforms.
The qualification purpose does not override the current retirement notice. Treat the former certification relationships as historical context when evaluating older study plans, transcripts, or job requirements. For a new certification decision, confirm the active requirement directly with Cisco before selecting an exam.
What skills did SAUTO validate?
The exam assessed the implementation of security automation solutions rather than isolated product memorization. Cisco’s blueprint names programming concepts, RESTful APIs, data models, protocols, firewalls, web, DNS, cloud and email security, and ISE. Preparation therefore needed to connect code and API behavior with operational security outcomes.
A useful interpretation is that a candidate had to move from an automation requirement to a working integration: identify the service, authenticate correctly, model the data, call the API, handle the response, and apply or retrieve security information. The blueprint’s product references make that process Cisco-specific, while the programming foundation makes it transferable across tools.
This emphasis favors candidates who can read documentation and produce or troubleshoot small automation components. A study plan based only on terminology, product feature lists, or memorized answer patterns would not address the implementation focus described by Cisco.
Who was the intended candidate?
SAUTO was a reasonable fit for a network or security professional adding programmability to an existing Cisco skill set, and for a developer who needed to automate Cisco security services. It also suited candidates combining Python, API, and infrastructure-as-code knowledge with firewall, identity, endpoint, or threat-security workflows.
The blueprint does not make a job title the deciding factor. A stronger readiness test is whether you can explain an API workflow and construct or adapt code for the named security platforms. If that is not yet familiar, build the underlying skills first rather than treating the exam label as a substitute for practical experience.
How was the blueprint weighted?
The v1.1 blueprint assigns 10% to Network Programmability Foundation, 35% to Network Security, and 30% to Advanced Threat and Endpoint Security. These published domain weights identify where the blueprint placed emphasis, but they do not provide a passing score or guarantee the exact distribution of individual questions.
Network Programmability Foundation is the smallest named percentage, yet it supports the other domains. Weakness in Python, API styles, authentication flow, or asynchronous processing can slow work across firewall, identity, endpoint, and cloud-security tasks. Study it as a working foundation, not as a section to dismiss.
Network Security carries 35% of the blueprint and includes the broadest concentration of platform-specific automation in the supplied facts. Advanced Threat and Endpoint Security carries 30% and extends the same automation discipline into cloud, endpoint, malware-analysis, and XDR services. Allocate time according to both the percentages and your starting skill level, not percentages alone.
What does Network Programmability Foundation include?
Network Programmability Foundation covers common Git operations, REST and RPC API styles, synchronous and asynchronous API-consumption patterns, Python scripts, Python virtual environments, and Ansible or Terraform for security-platform automation. These topics form the mechanics for developing, testing, versioning, and running automation.
A practical sequence is Git first, then Python and virtual environments, followed by REST and RPC request patterns. Add synchronous and asynchronous consumption after you can make a reliable basic call. Finish the foundation with Ansible or Terraform exercises that show where declarative automation fits alongside an imperative Python script.
Do not study Git as a list of commands detached from code. Use a small repository with a README, environment instructions, a configuration template, and a script that handles a response. This creates practice in the exact habits needed to maintain automation safely, without claiming that a particular repository layout is an exam requirement.
What does Network Security include?
Network Security covers the Cisco Secure Firewall Management Center eStreamer API and APIs for Cisco Secure Firewall Management Center, Cisco Secure Firewall Device Manager, ISE, pxGRID, and Cisco Secure Network Analytics Enterprise. The blueprint also includes implementing firewall objects, rules, intrusion policies, and access policies through Cisco Secure Firewall Management Center and Secure Firewall Device Manager APIs.
Study this domain as a set of complete workflows rather than disconnected endpoints. For each service, identify the resource being read or changed, the request and response structure, the authentication or session process described in current documentation, and the operational effect of the change. Keep read-only retrieval separate from configuration changes in your practice.
Policy automation deserves particular attention because an API call can be syntactically correct while producing an unsafe or incomplete policy. Practice validating required fields, checking the returned status, recording the resulting identifier, and confirming the intended object or rule before moving to the next operation. These are preparation recommendations, not additional Cisco blueprint requirements.
What does Advanced Threat and Endpoint Security include?
Advanced Threat and Endpoint Security covers Cisco Cloud Security APIs such as Umbrella and Investigate, the Cisco Secure Endpoint API, Cisco Secure Malware Analytics API, and Cisco XDR solution APIs. The common challenge is integrating security evidence and actions across services whose data models and response behavior may differ.
Build a comparison sheet for each API you study: purpose, key resource types, authentication approach from the current product documentation, response format, error behavior, and a safe read-only use case. This forces you to distinguish an endpoint that retrieves telemetry from one that changes policy or initiates an action.
Cisco’s SAUI training page lists hands-on work with Firepower Management Center, Firepower Threat Defense, ISE, pxGrid, Stealthwatch Enterprise and Cloud, Umbrella, AMP, Threat Grid, and Cisco Security Management Appliances. Use that list to broaden lab familiarity, while using the blueprint—not the course product list alone—to decide what receives priority.
What should you learn first?
Start with a diagnostic, not a full product tour. Test whether you can create an isolated Python environment, use Git, describe REST and RPC differences, make a documented API request, interpret structured data, and explain synchronous versus asynchronous consumption. Then map each weakness to a blueprint domain and choose labs that produce evidence of improvement.
A useful diagnostic exercise is a harmless read operation against a permitted lab or documented mock service. Write down the request inputs, authentication dependency, response fields, error path, and next action. If you cannot explain one of those steps, record it as a study gap instead of copying a working snippet without understanding it.
Next, separate platform knowledge into three layers: common automation mechanics, Cisco security service behavior, and operational safeguards. The first layer is reusable; the second requires product-specific reading; the third helps you avoid changing live policy while learning. This layered approach is more efficient than alternating randomly among product names.
How should a beginner sequence the domains?
A beginner should establish Python, Git, virtual-environment, and API fundamentals before attempting multi-service security workflows. After that, move into firewall and identity integrations, then endpoint, cloud, malware-analysis, and XDR APIs. Return to infrastructure-as-code after the API work so Ansible or Terraform practice has a concrete security use case.
Do not wait until the end to write code. Each study block should produce a small artifact: a request wrapper, a response parser, a policy-object model, a pxGRID retrieval script, or an automation playbook. Keep the artifacts disposable and isolated; their purpose is to expose reasoning gaps, not to become production software.
If you already automate in Python, reverse the emphasis. Begin with the platform APIs and policy workflows, then use the foundation topics to close specific gaps in authentication, asynchronous behavior, Git hygiene, or infrastructure-as-code. The blueprint rewards breadth across implementation concepts, so advanced coding alone is not a complete preparation strategy.
What should an experienced security engineer change?
An experienced firewall or identity engineer should resist assuming that configuration expertise automatically transfers to API automation. Confirm that you can represent objects and policies in the API’s data model, handle identifiers and dependencies, and verify changes programmatically. Your likely gap is the interface between operational intent and code execution.
An experienced developer should make the opposite check. Product vocabulary is not enough: understand what a firewall object, intrusion policy, access policy, endpoint record, or identity telemetry means operationally. Build workflows that explain why a call is made and what a security operator would verify afterward.
In either case, use targeted remediation. Do not repeat familiar labs merely because they are comfortable. Mark each blueprint topic as explain, implement, troubleshoot, or not yet practiced, then spend the next session on the weakest category with a concrete output.
How can you practice the Cisco-specific workflows?
Use authorized lab systems, current Cisco documentation, and the product access available to you. Practice one service at a time before composing workflows. The goal is to understand request construction, returned data, dependencies, and safe verification—not to imitate undisclosed exam content or rely on copied question banks.
For firewall work, model a small sequence: create or identify an object, create or update a rule or policy component, inspect the response, and verify the resulting configuration through an approved read operation. Include intrusion policies and access policies because the blueprint explicitly names them, while keeping the lab isolated from production traffic.
For ISE and pxGRID work, focus on data retrieval and event-oriented thinking. The blueprint requires constructing a Python script for pxGRID to retrieve endpoint device type, network policy, and security telemetry information. Break that requirement into authentication, subscription or retrieval logic as documented, response parsing, and clear output.
For cloud, endpoint, malware-analysis, and XDR work, prioritize the API purpose and data flow. Ask what evidence is retrieved, how it is represented, and what downstream security decision it supports. Avoid inventing a universal workflow across products; each service must be learned from its current official documentation and permitted lab behavior.
What should a good lab record contain?
A good lab record captures the objective, prerequisites, endpoint or service involved, input data, expected response, observed response, error encountered, and verification step. It should also state whether the operation was read-only or changed configuration. This record turns an isolated command into a reusable troubleshooting reference.
Keep secrets out of the repository. Use environment variables or an approved secret-management method, provide a non-secret configuration example, and document the permissions needed. Add input validation and useful error messages before attempting larger workflows.
Review the record after each lab and explain the workflow without looking at the code. If you can run a script but cannot describe its data flow, the exercise has not yet produced dependable understanding.
How should you use Cisco’s official training and blueprint?
Use the v1.1 exam-topics document as the controlling scope reference for historical SAUTO preparation, and use Cisco’s SAUI training information as a clue to the intended hands-on breadth. The training page says the course prepares candidates for 300-735 SAUTO v1.1 and names multiple Cisco security platforms used in its practical work.
Read the blueprint before selecting learning material. Extract every domain and action, then turn action words such as construct, implement, retrieve, and consume into lab objectives. A video or course module is useful only when it helps you perform or explain one of those objectives.
Product documentation can change independently of an old exam blueprint. For current practice, consult the relevant Cisco documentation and confirm that commands, endpoints, authentication methods, and product names still apply to the version in your lab. Do not assume that an old training artifact is a current operational reference.
Which materials should you reject?
Reject any resource that promises leaked questions, guaranteed passing, or a shortcut based on memorization. Such material does not establish implementation ability and may expose you to inaccurate or unauthorized content. Use the official blueprint to identify skills, then validate those skills through documentation-based exercises.
Be cautious with snippets that omit authentication, error handling, permissions, or cleanup. A short example can be useful for learning syntax, but it is not a complete automation design. Rebuild it in an isolated environment and document what it changes before treating it as study evidence.
Avoid collecting many overlapping courses without completing labs. One accurate explanation followed by a working, reviewed exercise is more valuable than a large folder of untested notes.
What is known about exam delivery?
The supplied Cisco blueprint states that the 300-735 SAUTO exam duration was 90 minutes. The supplied official sources do not establish a current delivery method, question count, language list, price, passing score, or active registration process. Because Cisco lists the exam as retired, do not infer present scheduling or delivery details from older third-party listings.
The official exam overview lists February 24, 2020 as the first date candidates could test for 300-735 SAUTO. That historical date helps identify the exam record but does not indicate current availability. Pair it with Cisco’s retirement page when evaluating older study or certification references.
Do not build a study timetable around an assumed question count or passing threshold. Neither is supported by the supplied facts. For any active Cisco exam you choose instead, obtain delivery and registration details from that exam’s current official page.
What does retirement mean for a previous holder?
Retirement primarily affects future certification and recertification use of the exam. Cisco states that retired exams are no longer available for certifying or recertifying, while certifications based on them remain valid until their individual expiration dates. Check the certification record rather than relying on the exam’s former role.
If an employer or training record names SAUTO, preserve the exam version and the certification outcome accurately. Do not present a retired exam as a currently obtainable credential. When a role requires a current certification, ask the employer which active Cisco requirement they accept and verify it in Cisco’s catalogue.
What mistakes waste the most preparation time?
The most damaging mistake is preparing as though SAUTO were still schedulable. Confirm retirement first. The next is treating the blueprint percentages as a complete syllabus while ignoring the foundation needed to implement API workflows. Finally, avoid confusing a successful API response with a correctly secured or operationally verified change.
Another common error is studying product names without tracing data flow. A candidate may recognize Umbrella, ISE, pxGRID, or Secure Firewall terminology yet struggle to identify the input, response, identifier, permission, or verification step in a script. Convert every product topic into a workflow question.
Do not make production changes to learn policy automation. Use a lab, approved tenant, or mock environment with controlled data. Keep configuration exports and cleanup steps, and have a rollback plan for any permitted change.
Do not overfit to one programming style. The blueprint includes REST and RPC API styles, synchronous and asynchronous patterns, Python, virtual environments, and Ansible or Terraform. Practice recognizing when a workflow is request-response and when it requires handling delayed results or state changes.
How do you know a topic is ready?
A topic is ready when you can explain its purpose, complete a small authorized implementation, interpret a normal response, identify a likely failure, and verify the result. Reading a page or watching a demonstration is preparation input, not readiness evidence.
Use a three-part review for each lab: explain it aloud without notes, rebuild it from a clean environment, and troubleshoot one intentionally introduced error. The error can be a malformed field, missing variable, or invalid identifier in a safe test system. Record the correction and the principle behind it.
For a retired exam, this readiness test has a professional purpose beyond test performance. It shows whether the blueprint has helped you build maintainable security-automation capability rather than merely recognize exam terminology.
What is a practical four-phase roadmap?
A practical roadmap has four phases: confirm the certification decision, establish the programming foundation, build Cisco security workflows, and perform an evidence-based review. Because SAUTO is retired, phase one is mandatory. The remaining phases are appropriate for skills development or for understanding the historical blueprint while you verify a current path.
Phase one should take only as long as needed to check Cisco’s retirement information, the current certification catalogue, and any employer requirement. Decide whether you are studying for transferable automation skills, documenting a previous credential, or preparing for a different active exam. Do not proceed under an unverified assumption.
Phase two covers Git, Python scripts, virtual environments, REST and RPC styles, synchronous and asynchronous consumption, and Ansible or Terraform. Produce small, repeatable exercises and keep notes on authentication, structured data, error handling, and testing.
Phase three covers the named Network Security and Advanced Threat and Endpoint Security workflows. Give special attention to Secure Firewall Management Center, Secure Firewall Device Manager, ISE, pxGRID, Secure Network Analytics Enterprise, Umbrella and Investigate, Secure Endpoint, Secure Malware Analytics, and XDR APIs. Use only authorized systems and current documentation.
Phase four is a gap review, not a binge of new material. Revisit the blueprint, map every action to a completed artifact, rebuild the weakest workflows, and remove unsupported assumptions about exam logistics. If your objective is a current certification, transfer the same method to the verified active exam’s official blueprint.
What should the final review checklist contain?
Your final checklist should show evidence for each foundation skill and each security workflow you intend to retain. Include a Python script that you understand, a Git history or repository exercise, an API request and response analysis, a policy-automation lab, a pxGRID retrieval exercise, and notes on cloud, endpoint, malware-analysis, and XDR API use.
Also check operational discipline: secrets are protected, permissions are understood, errors are visible, responses are validated, changes are verified, and cleanup is documented. These practices are recommendations for reliable preparation and automation; they should not be mistaken for undisclosed exam scoring criteria.
Finish by writing a short decision statement: continue skills practice, document an existing certification, or follow a current Cisco exam path. That statement prevents an old SAUTO page from silently becoming an inaccurate scheduling plan.
What should you do next?
First, open Cisco’s retirement notice and confirm that the exam is unavailable for new certifying or recertifying use. Second, identify the active Cisco certification or role requirement that now matters to you. Third, download or review the SAUTO v1.1 blueprint only if its automation topics serve your skills plan, and begin with a diagnostic script rather than memorized material.
If you already hold a certification associated with SAUTO, check its individual expiration status. If you are studying the technology, create a small authorized lab and work through Git, Python, API consumption, and one Cisco security workflow. Keep the result as evidence of capability and use current product documentation for implementation details.
The most defensible use of this historical guide is to make a precise choice: do not schedule a retired exam, do not rely on unsupported delivery claims, and do use the published skills to plan practical Cisco security-automation development or to prepare for a verified current requirement.
Conclusion
300-735 SAUTO defined a valuable combination of Cisco security knowledge and automation implementation, but Cisco now lists it as retired. Its blueprint can still help organize learning around Python, APIs, policy automation, identity, endpoint, cloud, and threat-security integrations. Treat retirement and certification status as the first decision, use official Cisco material for scope, and measure progress through authorized, working exercises rather than question memorization or unverified scheduling information.
Related exams
- 300-835 exam — Automating Cisco Collaboration Solutions (CLAUTO)
- Securing Networks with Cisco Firepower (300-710 SNCF)
- Implementing and Configuring Cisco Identity Services Engine (SISE) v4.0 (300-715 SISE)
- 300-910 exam — Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)
- Securing Email with Cisco Email Security Appliance (300-720 SESA)
- Securing the Web with Cisco Web Security Appliance (300-725 SWSA)
