Cisco's associate SOC credential has carried three names, and on 27 August 2026 the CCNP Security core exam moved to SCOR v2.0, so many study plans and job adverts now point at outdated exams. This guide sets out the current Cisco security path from the 200-201 associate exam through CCNP Security to CCIE Security: exam codes, durations, fees, what each exam covers, the August 2026 changes, validity and recertification. It is for SOC analysts, network security engineers and firewall and identity services engineers who work with Cisco products. Facts were checked on Cisco's certification and exam pages and the Cisco Learning blog on 8 November 2026.
This is an independent guide from NHI Mgmt Group, based on Cisco's public documentation as of November 2026. It is not sponsored or reviewed by Cisco. Product features change, so confirm settings against Cisco's current documentation.
Key takeaways
- The associate exam is 200-201. Understanding Cisco Cybersecurity Operations Fundamentals is a 120-minute exam costing USD 300; Cisco's exam page now says a pass earns the CCNA Cybersecurity certification, the credential previously called CyberOps Associate and later Cisco Certified Cybersecurity Associate.
- CCNP Security is two exams. The 350-701 SCOR core (USD 400, 120 minutes) plus one concentration exam (USD 300, 90 minutes each) from SNCF, SISE, SSCA or SDSI.
- SCOR v2.0 went live on 27 August 2026. Existing holders are unaffected, a SCOR v1.1 pass still counts, and the SVPN concentration was retired with its VPN content moving into SCOR and SNCF.
- CCIE Security adds an eight-hour lab. SCOR is the qualifying exam, and the CCIE Security lab exam v6.1 costs USD 1,600.
- Three-year validity, renew by exam or CE credits. CCNP and CCIE Security are valid for three years and can be renewed with Continuing Education credits or exams.
Who the certification is for
| Credential | Audience Cisco describes | Typical roles |
|---|---|---|
| CCNA Cybersecurity (200-201) | People preparing for associate-level roles, particularly on SOC teams | SOC analyst, junior incident responder, security monitoring |
| CCNP Security | Professionals who protect the networks and data organisations rely on | Network security engineer, firewall engineer, identity services engineer, secure access engineer |
| CCIE Security | Experts with complex security solutions; the lab covers end-to-end security for an enterprise dual-stack (IPv4 and IPv6) network | Senior security engineer, security architect, consulting engineer |
| Cisco Certified Specialist (Security) | One specialist certification for each security exam passed; Cisco's page lists seven | Engineers who want recognition for a single area |
A note on names: the 200-201 credential was launched as Cisco Certified CyberOps Associate. Cisco's January 2025 at-a-glance document calls it Cisco Certified Cybersecurity Associate, and the current exam page lists the exam as 200-201 CCNACBR and says a pass earns CCNA Cybersecurity. Employers may use any of the three names for the same exam.
Exam format and domains
Associate: 200-201
| Item | What Cisco publishes |
|---|---|
| Exam | 200-201 Understanding Cisco Cybersecurity Operations Fundamentals (shown as 200-201 CCNACBR; formerly CBROPS) |
| Duration | 120 minutes |
| Cost | USD 300, or Cisco Learning Credits |
| Language | English |
| Subject areas | Security concepts; security monitoring; host-based analysis; network intrusion analysis; security policies and procedures |
Domain weights are on Cisco's exam topics page for 200-201, which was not readable at the time of checking. Download the current exam topics before you start studying.
Professional: CCNP Security
| Exam | Title | Cost (USD) | Duration | Languages |
|---|---|---|---|---|
| 350-701 SCOR (core, required) | Implementing and Operating Cisco Security Core Technologies | 400 | 120 min | English, Japanese |
| 300-710 SNCF | Securing Networks with Cisco Firewalls | 300 | 90 min | English, Japanese |
| 300-715 SISE | Implementing and Configuring Cisco Identity Services Engine | 300 | 90 min | English, Japanese |
| 300-740 SSCA | Designing and Implementing Secure Cloud Access for Users and Endpoints | 300 | 90 min | English |
| 300-745 SDSI | Designing Cisco Security Infrastructure | 300 | 90 min | English, Japanese |
All exams are graded pass or fail with results online within 48 hours, and each pass earns a Cisco Certified Specialist certification. Passing SCOR alone earns Cisco Certified Specialist - Security Core.
The August 2026 update
Cisco's Learning blog post "Cisco security certification updates: your questions answered" (27 August 2026) sets out the changes:
- Dates: 26 August 2026 was the last day to test on the previous exam versions, including SVPN; 27 August 2026 was the first day for SCOR v2.0 and SSCA v2.0.
- Exam changes: SCOR v2.0 replaces v1.1; SSCA replaces SCAZT with the same number (300-740); SNCF gets a minor update and consolidated training; SVPN (300-730) retired with no direct replacement; SISE and SDSI unchanged or lightly refreshed.
- Holders: existing certifications are unaffected, and recertification does not require passing SCOR v2.0.
- Candidates part way through: a SCOR v1.1 pass still combines with any concentration exam, including ones taken after 27 August 2026. After passing one CCNP-level exam you have three years to pass the other, and CE credits do not extend that window.
- Training: SCOR v2.0 training was due in September 2026, with updated SNCF and SSCA training and a SCOR practice exam in late 2026.
Expert: CCIE Security
| Item | What Cisco publishes |
|---|---|
| Qualifying exam | 350-701 SCOR (USD 400, 120 minutes) |
| Lab exam | CCIE Security lab exam v6.1, 8 hours, USD 1,600 or Cisco Learning Credits |
| Lab scope | Designing, deploying, operating and optimising end-to-end security for an enterprise dual-stack network |
| Effect of SCOR v2.0 | None by itself; SCOR and the lab follow separate update cycles, and a valid SCOR v1.1 pass still qualifies within the eligibility window |
| Planned change | An AI-infused Design, Deploy, Operate and Optimise module is planned for the practical; timing to be announced on the Cisco Learning Network |
Prerequisites and experience
Cisco lists no formal prerequisites for SCOR, the concentration exams or the CCIE Security qualifying exam, and none are shown for 200-201. Cisco's pages checked do not give recommended years of experience. Our suggested baseline (an NHI Mgmt Group view, not a Cisco rule):
- 200-201: networking fundamentals (TCP/IP, common protocols and ports) and basic familiarity with Windows and Linux logs. See the CCNA guide for the networking foundation.
- CCNP Security: hands-on time with at least one of firewalls, Identity Services Engine, secure access or security design, matching the concentration you choose.
- CCIE Security: CCNP-level knowledge across all the concentration areas plus enough lab hours to work at speed for eight hours.
Preparation plan
A suggested sequence from NHI Mgmt Group for an engineer targeting CCNP Security. Allow four to six months alongside work.
- Month 1, choose the concentration first. Pick the concentration that matches your job: SNCF for firewall work, SISE for network access control and identity services, SSCA for secure cloud access, SDSI for design. Download the exam topics for SCOR v2.0 and that concentration.
- Months 1 to 3, SCOR v2.0. Study each SCOR topic area and lab it. Watch for the VPN content that moved into SCOR from the retired SVPN exam, and use only material built for v2.0.
- Month 3, sit SCOR. A pass earns Security Core specialist status and starts your three-year window for the concentration.
- Months 4 to 5, concentration. For SISE, build 802.1X, MAB, posture and guest policies in a lab. See the Cisco ISE Hardening Guide. For SNCF, configure firewall policy, NAT, VPN and high availability. See the Cisco ASA and Firepower Threat Defense Hardening Guide.
- Month 6, book and sit. Results arrive within 48 hours. If you plan CCIE, start lab practice soon after while SCOR remains valid as your qualifying exam.
Treat lab credentials as production habits: give each integration (for example ISE to directory, firewall to management centre, API automation) its own service account with only the rights it needs, and rotate those secrets. See the API Key Management Guide.
Cost, renewal and continuing education
| Item | Published detail |
|---|---|
| 200-201 exam | USD 300 |
| SCOR core exam | USD 400 |
| Each concentration exam | USD 300 |
| CCIE Security lab exam v6.1 | USD 1,600 |
| CCNP Security total (exams only) | USD 700 (SCOR plus one concentration) |
| CCIE Security total (exams only) | USD 2,000 (SCOR plus lab) |
| Validity | Three years for CCNP Security and CCIE Security |
| Recertification | Continuing Education credits, exams, or a combination; each CCNP-level exam counts towards recertification; the 200-201 exam can also be used towards recertification goals |
| Payment | Exams can be paid with Cisco Learning Credits |
Fees were checked on 8 November 2026 and exclude local taxes. Cisco publishes the exact number of CE credits needed for each level in its recertification policy; confirm the current figure on Cisco's recertification page before planning. Training courses and lab rental add to the exam-only totals.
Where it fits on the career path
- SOC route: CCNA Cybersecurity (200-201), then a SOC or incident response role. See the SOC Analyst Career Guide and the Blue Team Certifications Guide.
- Network security route: CCNA, then CCNP Security with SNCF or SDSI. See the Network Security Engineer Career Guide.
- Identity and access route: CCNP Security with SISE suits network access control and identity services engineers. See the Cisco ISE Hardening Guide.
- Expert route: CCIE Security for senior engineers and architects who design and operate end-to-end security on Cisco platforms.
- Breadth: pair a Cisco credential with a vendor-neutral one to show wider security knowledge. See the Cybersecurity Certifications Guide.
Where identity fits
The SISE concentration is identity work at the network edge: 802.1X, certificates, endpoint profiling and policy for users and devices. Many of the endpoints it governs are non-human: printers, IoT devices, servers and the service accounts ISE itself uses to query directories. Engineers who treat device certificates and integration accounts as identities with owners and lifetimes build better access policy. See the NHI Authentication Guide.
Common preparation mistakes
- Studying the retired version: using SCOR v1.1 or SVPN material after 27 August 2026, when VPN topics moved into SCOR v2.0 and SNCF.
- Letting the window lapse: passing SCOR and then leaving the concentration for more than three years, which CE credits do not extend.
- Choosing a concentration by reputation: picking a concentration unrelated to your daily work, which makes lab practice harder and the credential less useful to your employer.
- Missing the name change: searching job adverts or training catalogues for only one name of the 200-201 credential and missing roles that ask for it under another.
- Underestimating the lab: treating the eight-hour CCIE Security lab as a longer written exam rather than a test of speed across design, deployment and operations.
Practitioner checklist
- Check that your study material targets SCOR v2.0, not v1.1, unless you are finishing a v1.1 path.
- Choose the concentration that matches your role before starting SCOR.
- Download the current exam topics for 200-201, SCOR and your concentration.
- Record your first CCNP-level pass date: the second exam must follow within three years.
- Use least-privilege service accounts and scoped API credentials in your lab.
- Track your three-year expiry and plan CE credits or exams well before it.
- Confirm fees and CE credit requirements on Cisco's pages on the day you plan.
- If you aim for CCIE, plan the lab while your SCOR pass is within its eligibility window.
Standards and references
- Cisco: Security certifications
- Cisco: CCNP Security
- Cisco: CCIE Security
- Cisco: 200-201 Understanding Cisco Cybersecurity Operations Fundamentals
- Cisco: Cisco Certified Cybersecurity Associate at a glance
- Cisco Blogs: Cisco security certification updates, your questions answered
Related NHI Mgmt Group resources: Network Security Engineer Career Guide, CCNA, Cisco ISE Hardening Guide, Certification Renewal and CPE Requirements Guide.