Many security practitioners can read an alert but cannot explain the VLAN, access list or routing decision that let the traffic through, and the Cisco Certified Network Associate (CCNA) is the most widely recognised way to close that gap. This guide covers what Cisco publishes about CCNA exam 200-301 v1.1: the six weighted domains, the 15% Security Fundamentals domain in detail, format, price, recertification and the training routes Cisco offers. It then explains how to prepare with a security lens, how CCNA compares with CompTIA Network+, and where it sits on a path into network security, SOC and cloud roles. It is written for career changers, help desk and junior network staff, and security analysts who want firmer networking foundations. Facts were checked on cisco.com and in the Cisco 200-301 v1.1 exam topics document on 8 November 2026. Cisco states that exam topics may change without notice, so confirm on the linked pages before you book.
Key takeaways
- One exam, no prerequisites. CCNA is earned by passing exam 200-301, a 120-minute exam priced at US$300, with no formal prerequisite.
- Security is 15% of the blueprint, and it is hands-on. Domain 5.0 asks you to configure and verify access control lists, port security, DHCP snooping, dynamic ARP inspection and WPA2 PSK wireless, not only to define terms.
- The rest of the exam is still defender knowledge. IP connectivity (25%), network fundamentals (20%) and network access (20%) are the material you need to trace lateral movement, read firewall logs and design segmentation.
- Automation and AI now appear in the blueprint. Domain 6.0 (10%) covers REST APIs, JSON, Ansible and Terraform, and generative and predictive AI in network operations.
- Valid for three years. Recertify by passing the current exam, passing a higher-level Cisco exam, or earning 30 continuing education (CE) credits.
Who the certification is for
Cisco describes CCNA as a certification for entry-to-mid-level IT professionals that assumes little or no prior networking knowledge. It is vendor-branded, and many lab tasks use Cisco IOS syntax, but most of the blueprint is protocol knowledge that transfers to any vendor's equipment and to cloud virtual networks.
- Good fit for career changers: people moving into security who need a structured, practical grounding in how networks behave. See the Career Change into Cyber Security Guide.
- Good fit for SOC and detection staff: analysts who triage firewall, proxy and NetFlow alerts and need to reason about subnets, NAT, routing and Layer 2 attacks. See the SOC Analyst Career Guide.
- Good fit for network and infrastructure staff: help desk and junior network engineers in organisations that run Cisco equipment, where the IOS command line skills apply directly.
- Weaker fit: application security, GRC and identity specialists who rarely touch network devices. A vendor-neutral foundation, or no network certification at all, may serve them better.
Exam format and domains
What Cisco publishes about the exam
| Item | What Cisco states | Source |
|---|---|---|
| Exam | 200-301 CCNA, Implementing and Administering Cisco Solutions, current version v1.1 | CCNA certification page; exam topics v1.1 |
| Duration | 120 minutes | CCNA certification page |
| Price | US$300, or payable with Cisco Learning Credits | CCNA certification page |
| Languages | English and Japanese (the FAQ); one section of the same page lists English only, so check when booking | CCNA certification page |
| Prerequisites | None | CCNA certification page |
| Grading | Pass or fail, results online within 48 hours | CCNA certification page |
| Retake | Wait five calendar days after the previous attempt | CCNA certification page |
| Vouchers | US$300 voucher valid 365 days from purchase; Exam Safeguard Plus at US$450 allows a second attempt within 90 days of a failed first attempt | CCNA certification page |
| Validity | Three years | CCNA certification page |
The six domains and their weightings
Cisco calls these weights general guidelines for the content likely to appear. The right-hand column is our summary of the listed topics.
| Domain | Weight | Why a defender cares |
|---|---|---|
| 1.0 Network Fundamentals | 20% | IPv4 and IPv6 addressing and subnetting, TCP and UDP, switching concepts and topology: the vocabulary of every packet capture and firewall rule |
| 2.0 Network Access | 20% | VLANs, trunks, spanning tree, EtherChannel and wireless architecture: the building blocks of segmentation and the place Layer 2 attacks start |
| 3.0 IP Connectivity | 25% | Routing tables, static routes and OSPF: how an attacker's traffic reaches a target segment, and how you prove it cannot |
| 4.0 IP Services | 10% | NAT, NTP, DHCP, DNS, SNMP, syslog and SSH: the services that produce your logs and the timestamps you correlate |
| 5.0 Security Fundamentals | 15% | Device access control, ACLs, Layer 2 protections, AAA, VPNs and wireless security (detailed below) |
| 6.0 Automation and Programmability | 10% | Controller-based networking, REST APIs, JSON, Ansible and Terraform, and AI and machine learning in network operations |
Security Fundamentals in detail
Domain 5.0 has ten objectives. Four of them use the verb "configure and verify", which in practice means lab skill, not memorisation.
| Objective | Cisco wording (summarised) | Threat it addresses | Control mapping |
|---|---|---|---|
| 5.1 | Key security concepts: threats, vulnerabilities, exploits, mitigation | General risk vocabulary | CSF 2.0 ID.RA |
| 5.2 | Security programme elements: user awareness, training, physical access control | Social engineering, physical tampering | NIST 800-53 AT-2, PE-3 |
| 5.3 | Configure and verify device access control using local passwords | Unauthorised device administration | NIST 800-53 AC-3, IA-5 |
| 5.4 | Password policy elements and alternatives: MFA, certificates, biometrics | Brute Force (ATT&CK T1110) | NIST 800-53 IA-2, IA-5 |
| 5.5 | IPsec remote access and site-to-site VPNs | Abuse of External Remote Services (T1133), eavesdropping | NIST 800-53 AC-17, SC-8 |
| 5.6 | Configure and verify access control lists | Unrestricted lateral movement | NIST 800-53 SC-7, AC-3 |
| 5.7 | Configure and verify DHCP snooping, dynamic ARP inspection, port security | DHCP Spoofing (T1557.003), ARP Cache Poisoning (T1557.002) | NIST 800-53 SC-7, CM-6 |
| 5.8 | Compare authentication, authorisation and accounting (AAA) | Shared device credentials, missing audit trail | NIST 800-53 IA-2, AU-2 |
| 5.9 | Wireless security protocols: WPA, WPA2, WPA3 | Weak wireless encryption | NIST 800-53 AC-18 |
| 5.10 | Configure and verify a WLAN in the GUI using WPA2 PSK | Misconfigured wireless networks | NIST 800-53 AC-18 |
The threat and control columns are NHI Mgmt Group's mapping, not Cisco's. They show how CCNA content lines up with CSF 2.0 PR.IR-01 (networks protected from unauthorised logical access) and PR.AA-01 (identities and credentials managed). For the depth beyond CCNA, see the DHCP Security Guide and the 802.1X and EAP-TLS Enterprise Wi-Fi Guide.
Prerequisites and experience
Cisco sets no formal prerequisite and no minimum years of experience. What it does recommend is hands-on practice with routers and switches, using Cisco Packet Tracer or Cisco Modeling Labs. Candidates who have only read about subnetting and access lists tend to struggle with the configure-and-verify objectives.
- Useful before you start: binary arithmetic for subnetting, comfort on a command line, and a basic picture of the OSI and TCP/IP models.
- Helpful but optional: a vendor-neutral foundation such as CompTIA Network+. See the CompTIA Network+ Certification Guide.
- Practical environment: a laptop that can run Packet Tracer covers most of the blueprint; Cisco Modeling Labs or second-hand equipment adds realism for spanning tree, OSPF and wireless.
CCNA or Network+?
| Question | Lean towards CCNA | Lean towards Network+ |
|---|---|---|
| Does your employer run Cisco equipment? | Yes, IOS skills apply on day one | Mixed or no on-premises network |
| Do you need hands-on configuration skill? | Yes, the exam tests configuration and verification | Concepts and troubleshooting are enough |
| Are you aiming at network security or Cisco security tracks? | Yes, it is the natural first Cisco step | Less directly |
| Is the goal a vendor-neutral baseline for a security role? | Works, with some Cisco-specific detail | Yes, vendor-neutral by design |
Preparation plan
Most candidates prepare over three to six months alongside work; the plan below assumes about eight to ten hours a week. Cisco's own options are the Implementing and Administering Cisco Solutions course and CCNA learning path in Cisco U., free Cisco Networking Academy courses, instructor-led classes through Cisco Learning Locator and authorised Learning Partners, and CCNA Prep On Demand, which Cisco describes as 50 or more hours of resources.
- Weeks 1 to 3, fundamentals: download the v1.1 exam topics PDF and use it as your checklist. Master subnetting until a /27 or /29 takes seconds, then IPv6 addressing, TCP and UDP behaviour and Ethernet switching.
- Weeks 4 to 6, network access: build VLANs, trunks and inter-VLAN routing in Packet Tracer. Break spanning tree on purpose and watch it reconverge. Configure EtherChannel.
- Weeks 7 to 9, IP connectivity and services: read routing tables, configure static routes and single-area OSPF, then NAT, DHCP, NTP, syslog and SSH. Send device logs to a syslog server so you see what a SOC sees.
- Weeks 10 to 12, security fundamentals: write standard and extended ACLs and test them from both sides. Configure port security, DHCP snooping and dynamic ARP inspection, then attempt a rogue DHCP server in the lab and confirm it is blocked. Set up local and AAA-style device login, and a WPA2 PSK WLAN.
- Weeks 13 to 14, automation: read JSON, call a REST API with a tool such as curl or Postman against a lab controller or sandbox, and read (not necessarily write) simple Ansible and Terraform files. Note how API credentials are stored.
- Weeks 15 to 16, review: timed practice under 120 minutes, revisit weak domains weighted by percentage, and book the exam. Remember the five-day wait before a retake, or buy Exam Safeguard Plus if a second attempt is likely.
Security lens while studying: for every protocol, ask how it is attacked, what a log entry would look like and which setting prevents it. That habit turns CCNA study into detection engineering practice. The Firewall Rule Review Checklist is a good exercise once you can read ACLs.
Cost, renewal and continuing education
| Cost item | Amount stated by Cisco |
|---|---|
| Exam 200-301 (or voucher) | US$300 |
| Exam Safeguard Plus (exam plus a second attempt within 90 days) | US$450 |
| Cisco Networking Academy courses | Free |
| Recertification by CE credits | 30 CE credits within three years |
Local taxes and training costs vary, and Cisco prices can change, so check the certification page at booking. The certification is valid for three years. Cisco lists three ways to recertify inside that period:
- Re-sit: pass the current 200-301 CCNA exam.
- Step up: pass a higher-level Cisco certification exam, which is how many holders renew while moving to professional level.
- CE credits: earn 30 continuing education credits by attending Cisco training or webinars or completing approved courses.
Track your expiry date from day one and plan your renewal route a year ahead: CE credits accumulate slowly if you leave them to the last months.
Where it fits on the career path
CCNA is a foundation, not a security credential in its own right. Its value for security careers is that it makes later material easier: firewall policy, network detection and response, segmentation projects and cloud virtual network design all assume the knowledge CCNA tests.
| Next step | Why after CCNA | Related guide |
|---|---|---|
| Network security engineering | Firewall and NAC work builds directly on ACLs, VLANs and routing | Firewall Management Guide |
| SOC analyst and detection engineering | Network evidence makes alert triage faster and more accurate | Detection Engineer Career Guide |
| Cloud security | Subnets, routing and security groups are the same ideas in software | Cloud Security Engineer Career Guide |
| Cisco professional and expert security tracks | Cisco's security certifications page lists CCNP Security and CCIE Security and, as checked on 8 November 2026, announces upcoming changes to both, so confirm current requirements; passing a higher-level Cisco exam also renews CCNA | Cisco ASA and Firepower Threat Defense Hardening Guide |
| Broad security management | Network knowledge underpins the security architecture domains of senior credentials | CISSP Certification Guide |
Where identity fits
Two CCNA topics touch identity directly. Objective 5.8 (AAA) is the start of centralised, accountable device administration in place of shared local passwords, which is where network access control and RADIUS or TACACS+ servers come in; see the Cisco ISE Hardening Guide. Objective 6.5 (REST API authentication types) and 6.6 (Ansible and Terraform) introduce the machine credentials that automation tools hold: API tokens, SSH keys and service accounts with rights over every device. Treat them as non-human identities with owners, rotation and least privilege; see the Ansible and AWX Security Guide.
Common mistakes candidates make
- Studying from video only: the configure-and-verify objectives punish candidates who have not typed the commands. Lab every security objective.
- Using an outdated blueprint: v1.1 added topics such as AI and machine learning in network operations and Terraform. Work from the current exam topics PDF.
- Underweighting IP connectivity: at 25% it is the largest domain, and routing errors cascade into ACL and NAT questions.
- Treating security as memorisation: knowing that DHCP snooping exists is not the same as knowing which ports to trust.
- Forgetting the renewal clock: three years passes quickly, and an expired CCNA means re-sitting the exam.
Practitioner checklist
- Download the 200-301 v1.1 exam topics document and confirm it is still current before you start.
- Install Cisco Packet Tracer (or obtain lab access) before buying any course.
- Confirm the exam language you need when booking, as the Cisco page is inconsistent.
- Lab every objective in domain 5.0, including a blocked rogue DHCP server and an ACL tested from both sides.
- Practise subnetting daily until it is automatic.
- Decide between a single US$300 attempt and Exam Safeguard Plus at US$450 based on your readiness.
- Record your certification date and plan renewal: re-sit, higher-level exam or 30 CE credits.
- Pick your next step (network security, SOC, cloud or a Cisco professional track) before you finish, so your study builds towards it.
Standards and references
- Cisco: CCNA certification
- Cisco: CCNA Exam v1.1 (200-301) exam topics
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: Adversary-in-the-Middle (T1557)
- MITRE ATT&CK: Brute Force (T1110)
Related NHI Mgmt Group resources: CompTIA Network+ Certification Guide, Cybersecurity Careers Guide, Cisco IOS XE Hardening Guide, Network Access Control (NAC) Guide.