Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A plain reference to Cisco’s associate-level security operations certification as of October 2026. It covers the five domains of the 200-201 CCNACBR exam, the exam format and $300 fee, recertification, DoD 8140 status, how the credential got here from CyberOps Associate, and how it compares to CompTIA Security+ and CySA+.
CCNA Cybersecurity is Cisco’s associate-level certification for security operations work, earned by passing one exam: Understanding Cisco Cybersecurity Operations Fundamentals (200-201 CCNACBR).
It tests what a security operations center (SOC) analyst does all shift: reading alerts and logs, telling a true positive from a false one, pulling evidence out of a packet capture, and working an incident through the NIST handling process. Cisco aims it at entry-to-mid-level IT professionals heading for SOC analyst, network security engineer, or IT security operations roles.
If you searched for CyberOps Associate or Cisco Certified Cybersecurity Associate, this is the same credential under its newest name. It began as CCNA Cyber Ops. In 2020 Cisco folded its two exams into one, 200-201 CBROPS, and renamed it Cisco Certified CyberOps Associate. The v1.2 blueprint went live on January 21, 2025 along with the name Cisco Certified Cybersecurity Associate, and on February 3, 2026 Cisco moved it under the CCNA brand as CCNA Cybersecurity, carrying every active holder over automatically. The exam number has been 200-201 the whole time. Cisco now lists it as 200-201 CCNACBR.
It is a separate certification from the networking CCNA (200-301), with no formal prerequisites, listed under DoD 8140, and issued by Cisco. Oddly for a vendor exam, the blueprint names no Cisco products. Topics like CVSS, the Diamond Model and NIST SP 800-61 apply in any SOC, though Cisco says the certification prepares you for tools such as Secure Endpoint, Secure Firewall, Identity Services Engine and Wireshark.
Don’t confuse it with Cisco’s CCNA v2.0 change in 2027, which applies to the networking exam, 200-301. As of October 2026, v1.2 is the current version of 200-201.
CIA triad, SIEM and SOAR, CVSS, and access control models. 20%.
Monitoring data, network and web attacks, and certificates. The heaviest at 25%.
Endpoint protection, Windows and Linux, evidence, and log reading. 20%.
IDS alerts, PCAP analysis in Wireshark, and protocol headers. 20%.
NIST incident handling, profiling, and SOC metrics. 15%.
Four things that set it apart from the other entry-level security certifications.
Security+ and most other entry-level security exams aim for breadth. The 200-201 blueprint stays close to a single seat, the SOC analyst, and Cisco describes the program as testing the tactical skills SOC teams use to detect and respond to threats.
Objectives ask you to extract files from a TCP stream with Wireshark, pick out addresses, ports and payloads in a PCAP, and read basic regular expressions. Reading about packet analysis is a poor substitute for doing it, so plan real lab time.
Cisco made the v1.2 update, live since January 21, 2025, partly to recognize AI in monitoring and analysis. The blueprint now covers social engineering that uses generative AI and endpoint protection that uses predictive AI alongside rules and signatures.
Cisco lists this certification as an approved qualification under DoD Manual 8140.03 for the Cyber Defense Analyst work role (DCWF 511), part of the Cybersecurity workforce element in the DoD Cyber Workforce Framework.
That makes it relevant for service members, DoD civilians, and contractors in SOC-type positions. Check the proficiency level your position requires in the current qualification matrix on the DoD Cyber Workforce site before you rely on it.
The certification, the 200-201 CCNACBR exam, and how to keep the credential active, as of October 2026.
CCNA Cybersecurity is the associate rung of Cisco’s security operations track. From here the usual choices are deeper analysis work or a move toward security engineering.
The next level on the same track. A core exam, 350-201 CBRCOR, plus one concentration: forensics and incident response (300-215 CBRFIR) or threat hunting (300-220 CBRTHD). Each exam you pass also earns a Specialist certification.
The vendor-neutral analyst certification a level up. The CS0-004 exam goes further into vulnerability management and incident reporting, and CompTIA recommends about four years in a SOC or vulnerability analyst role.
For analysts who want to build and run the defenses rather than watch them. The 350-701 SCOR core exam plus a concentration such as Cisco firewalls (300-710 SNCF) or Identity Services Engine (300-715 SISE).
CCNA Cybersecurity usually follows networking or security fundamentals and leads into professional-level analyst, engineering, or leadership certifications.
Build the baseline
Into the SOC
Two questions to settle before you book the exam: how ready you are to start, and whether CCNA Cybersecurity is the right certification for the job you want.
You can start now.
There are no formal prerequisites for 200-201 CCNACBR. If TCP/IP, common ports, subnets, and the difference between a router and a firewall already make sense, the security material has something to attach to. Cisco says the certification assumes that kind of foundational networking and IT knowledge.
Build the base first.
Nothing stops you from booking the exam, but domain 4 asks you to read IPv4, TCP and DNS header fields in a packet capture. Without networking fundamentals that turns into memorization. Network+, or time in Cisco Packet Tracer or Cisco Modeling Labs (both suggested by Cisco), gives you the footing.
Cisco names SOC analyst, network security engineer, and IT security operations specialist as the target roles. Here is how those three, and three related jobs, use what the exam covers.
Works the alert queue in a security operations center: triaging SIEM alerts, separating false positives from real incidents, and escalating what matters. It is one of the three roles Cisco names when it describes who the certification is for.
Analyzes network and host data to find malicious activity for defense and federal teams. DCWF work role 511, which Cisco lists for this certification under DoD 8140.
Contains and investigates confirmed incidents. The exam’s NIST SP 800-61 incident handling and SP 800-86 evidence collection objectives are the day-to-day playbook here.
Builds and tunes firewalls, intrusion prevention and access control. Cisco lists it as a target role, and it pairs well with the standard CCNA when the job covers both routing and defense.
Runs the security tooling behind the SOC: endpoint agents, patch and vulnerability scans, and the log sources that feed the SIEM. Another role Cisco names for this credential.
Searches for attackers who slipped past the alerts. Usually a step up after time in the SOC, and the subject of Cisco’s CCNP Cybersecurity threat hunting exam (300-220 CBRTHD).
Security+ is the broad vendor-neutral baseline and CySA+ is CompTIA’s analyst certification one level up. CCNA Cybersecurity covers much of the same SOC ground as CySA+ without asking for a set amount of experience.
| CCNA Cybersecurity | CompTIA Security+ | CompTIA CySA+ | |
|---|---|---|---|
| Issuer | Cisco | CompTIA | CompTIA |
| Level | Associate | Foundational (vendor-neutral) | Intermediate (vendor-neutral) |
| Focus | SOC monitoring, analysis, and response | Broad core security | Threat detection and response (blue team) |
| Exam | 200-201 CCNACBR, 120 minutes | SY0-701, up to 90 questions, 90 minutes | CS0-004, up to 85 questions, 165 minutes |
| Exam Cost | $300 | $439 | $439 |
| Recommended Experience | None set (networking basics assumed) | Network+ and about 2 yrs IT | About 4 yrs, SOC or vulnerability analyst |
| Recertification | 3 years (exam or 30 CE credits) | 3 years (50 CEUs) | 3 years (60 CEUs) |
| DoD 8140 Approved | Yes (DCWF 511) | Yes (multiple roles) | Yes (10 roles) |
| Best For | SOC analysts on Cisco-heavy teams | Breaking into cybersecurity | Experienced SOC analysts and incident responders |
Security+ and CySA+ details come from the Training Camp guides for Security+ and CySA+. If the postings you want name Security+, get Security+ first. For a SOC seat on a team that runs Cisco security tools, CCNA Cybersecurity is the closer match.
Certification Matchups puts the published facts, strengths and weak spots of two certifications side by side.
Our Cisco CCNA Cybersecurity boot camp covers all five domains of the 200-201 exam in four days, live and instructor-led, in person or online. It uses Training Camp’s own courseware and includes hands-on labs, a full-length practice exam, your $300 exam voucher, and a free retake.
Packet analysis practice, DoD 8140 role mapping, and what to expect on exam day.
A practical first walk through Wireshark: the three panels, the display filters worth learning first, following streams, and what to look for in a capture. Useful groundwork for the PCAP objectives in domain 4.
A DCWF map of which certifications satisfy which DoD 8140 work roles, why proficiency level matters as much as the cert, and how to check before you spend money.
Why CySA+ is the usual next step for people heading into security operations, when SecurityX makes more sense, and how the next cert affects Security+ renewal.
Cisco calls it exam topics. How to read the verbs in each objective, use domain weights to plan study time, and turn the blueprint into a study plan.
Check-in, breaks, online proctoring rules and retake waits compared across certification bodies, including Cisco’s five-day wait after a failed written exam.
The common starting certifications for people breaking into security, what each one covers, and which to take before Security+ or Cisco’s security track.
Why an immersive, instructor-led format helps adults absorb certification material faster than scattered self-study, and what makes the learning stick.
The 200-201 CCNACBR v1.2 exam is organized into five domains, each with its own weight. Click any domain for what it covers.
The CIA triad, security deployments from agentless and agent-based protection to SIEM, SOAR and cloud security, threat intelligence and threat hunting terms, CVSS metrics, access control models, and using the 5-tuple to isolate a compromised host in a set of logs.
The largest domain. The data that tcpdump, NetFlow, next-gen and stateful firewalls, and web and email filters produce, how NAT, tunneling, TOR and encryption hide traffic, network and web application attacks, social engineering including generative AI, and certificate components.
Endpoint protection that uses rules, signatures and predictive AI, Windows and Linux operating system components, attribution and evidence types, reading OS, SIEM and SOAR logs to identify an event, and interpreting sandbox reports for hashes and URLs.
Mapping events to IDS/IPS, firewall, proxy and NetFlow sources, true and false positives and negatives, deep packet inspection versus stateful filtering, protocol header fields, extracting files from a PCAP in Wireshark, and basic regular expressions.
Asset, configuration, patch and vulnerability management, the NIST SP 800-61 incident handling process, NIST SP 800-86 evidence collection, network and server profiling, protected data such as PII and PHI, the Cyber Kill Chain and Diamond Model, and SOC metrics like time to detect.
Domains and weights come from Cisco’s 200-201 CCNACBR v1.2 exam topics (July 2025). Cisco notes that other related topics may appear on any given delivery of the exam.
Questions people ask when researching Cisco’s CCNA Cybersecurity certification, including the old CyberOps name.
CCNA Cybersecurity is Cisco’s associate-level certification for security operations work, earned by passing one exam, Understanding Cisco Cybersecurity Operations Fundamentals (200-201 CCNACBR). It covers security concepts, security monitoring, host-based analysis, network intrusion analysis, and security policies and procedures.
Yes. It is the same credential under a newer name. Cisco Certified CyberOps Associate became Cisco Certified Cybersecurity Associate on January 21, 2025, and that became CCNA Cybersecurity on February 3, 2026. The exam number stayed 200-201 throughout, and Cisco moved active holders to the new name automatically.
No. CCNA Cybersecurity is a separate certification with its own exam and no formal prerequisites. Cisco does assume foundational networking and IT knowledge, so get comfortable with TCP/IP, common ports and basic routing before you start.
Cisco lists the 200-201 CCNACBR exam at $300 USD as of October 2026, paid directly or with Cisco Learning Credits. Cisco also sells an Exam Safeguard Plus option for $450 that adds a second attempt within 90 days if you don’t pass the first time. Some boot camps include the voucher, so check before you buy one separately.
The 200-201 exam runs 120 minutes, is offered in English, and is graded pass/fail, with results online within 48 hours. Cisco does not publish the number of questions. You can sit it at a Pearson VUE test center or online with a remote proctor.
Cisco doesn’t publish one. Its exam policy says passing scores are subject to change and may vary from exam to exam without notice. You get a pass or fail result plus a score report broken out by exam section.
The five 200-201 CCNACBR v1.2 domains are Security Concepts (20%), Security Monitoring (25%), Host-Based Analysis (20%), Network Intrusion Analysis (20%), and Security Policies and Procedures (15%). Security Monitoring carries the most weight.
It is valid for three years. To recertify, pass the current 200-201 CCNACBR exam or any higher-level Cisco certification exam, or earn 30 Continuing Education credits through Cisco training, webinars or approved courses before the three years are up.
Yes. Cisco lists the certification as a DoD 8140 qualification for the Cyber Defense Analyst work role (DCWF 511) in the Cybersecurity workforce element. Confirm the proficiency level your position needs in the current DoD qualification matrix. See the full DoD 8140 work role paths.
The certification lines up with SOC analyst, cyber defense analyst, incident responder, network security engineer, IT security operations specialist, and junior threat hunter roles. Cisco itself names SOC analyst, network security engineer and IT security operations specialist as the audience.
Security+ is vendor-neutral and broader, covering architecture, security program management and operations at a baseline level. CCNA Cybersecurity is narrower and goes further into SOC work such as log analysis, packet captures and incident handling. Take Security+ if the postings you want ask for it by name, and CCNA Cybersecurity if you are aiming at a SOC analyst seat.
Cisco’s next step on the same track is CCNP Cybersecurity: the 350-201 CBRCOR core exam plus a concentration in forensics and incident response (300-215 CBRFIR) or threat hunting (300-220 CBRTHD). Outside Cisco’s track, CompTIA CySA+ is the vendor-neutral analyst step up, and CCNP Security suits analysts moving toward engineering.
It depends mostly on your networking background. If you already work with logs, firewalls or packet captures, much of the blueprint will feel familiar. If you are new to IT, build networking fundamentals first. Training Camp’s boot camp covers all five domains in four days, with labs and a full-length practice exam to find weak spots before test day.
For people targeting SOC and security operations roles, yes. Since February 2026 it carries the CCNA name, which Cisco says adds credibility and a clearer career path. It is also listed for DoD 8140 Cyber Defense Analyst positions, and the v1.2 blueprint added AI-related topics. It does less for you if you need a broad vendor-neutral baseline like Security+ or already have years of SOC experience.
Tell us where you are with the certification, funding, or SOC training for your team, and we’ll help you map out the next step.