Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A plain reference to Cisco's professional-level security certification as of October 2026: the 350-701 SCOR v2.0 core exam and its six domains, the four concentration exams, cost, career paths, DoD 8140 status, and how CCNP Security compares to CCNA, CCNP Enterprise and CCIE Security. Written for anyone deciding on the professional tier or trying to work out what the new blueprint actually covers.
CCNP Security (Cisco Certified Network Professional Security) is Cisco's professional-level certification for the engineers who secure Cisco networks: firewalls, VPNs, identity, endpoints and cloud access. It sits one tier above CCNA and one below CCIE Security.
You earn it by passing two exams. The first is the 350-701 SCOR core exam, Implementing and Operating Cisco Security Core Technologies, which tests security concepts, network security, cloud security, Secure Service Edge, endpoint protection, and network access and visibility. The second is a concentration exam of your choice from four options covering Cisco Secure Firewall, Identity Services Engine, secure cloud access and security design. There are no formal prerequisites. Every exam you pass also earns a Cisco Specialist certification, and CCNP Security itself is valid for three years.
The exam this page describes is SCOR v2.0, first available on August 27, 2026. Cisco calls it the first major revision of the blueprint since SCOR launched in February 2020. It added Secure Service Edge, AI and LLM vulnerabilities, post-quantum cryptography and Splunk, and the same changeover retired the SVPN, email security and web security concentrations. Check that any study material you buy targets v2.0, because Cisco's own SCOR practice exam for the new version isn't due until the end of 2026. The credential is vendor-specific and professional-level and issued by Cisco. Cisco lists CCNP Security on its DoD 8140 page, so check the current matrix for the work roles it covers.
Passing SCOR also counts as the qualifying exam for the CCIE Security lab, and it keeps you eligible for that eight-hour lab for three years. The same pass that starts your CCNP counts toward the expert tier. If you passed SCOR v1.1 before the cutover, it still pairs with any current concentration, as Cisco explains in its Q&A on the v2.0 transition.
Threats, AI and LLM weaknesses, cryptography and PQC, VPN types, zero trust. 20%.
Secure Firewall policy, Layer 2 defenses, AAA, VPN setup and troubleshooting. The heaviest at 25%.
Shared responsibility, CASB, Multicloud Defense, Secure Workload, eBPF, Splunk. 15%.
SSE and SASE, Cisco Secure Access internet and private access, DLP. 10%.
EPP and EDR, MDM, posture, Secure Endpoint, Email Threat Defense. 15%.
802.1X and MAB with ISE, CoA, exfiltration, XDR, Splunk, Duo. 15%.
Four things that set it apart from other security certifications at the professional level.
Plenty of security certifications test concepts. SCOR v2.0 asks you to configure, troubleshoot and interpret on the products themselves: access control and VPN policies on Cisco Secure Firewall, 802.1X and MAB on Identity Services Engine, and policies in Cisco Secure Access and Secure Endpoint. If your team runs Cisco security gear, the exam tasks look a lot like the work in your change queue.
One core exam, then a concentration that matches your work: firewalls (SNCF), identity (SISE), secure cloud access (SSCA) or security design (SDSI). Every exam you pass earns its own Cisco Specialist certification along the way, so the first pass already shows up on your record.
SCOR v2.0, live since August 27, 2026, is the first major rewrite since the exam launched in 2020. It swaps the old content security material for Secure Service Edge and adds AI and LLM threats, post-quantum cryptography, eBPF and Splunk. Cisco tells anyone who studied v1.1 material to treat v2.0 as new content.
Cisco lists CCNP Security among its certifications with mapped work roles under DoD Manual 8140.03 and the DoD Cyber Workforce Framework (DCWF). The specific work roles and proficiency levels differ between sources and shift between matrix versions, so this page does not name them.
Service members, DoD civilians and contractors in coded positions should check the current matrix for CCNP Security before relying on it. The matrices are published at the DoD Cyber Exchange.
The certification, the 350-701 SCOR core exam, and how to keep CCNP Security current, as of October 2026.
The professional tier is where many careers settle, but it is also the launch point for the expert level. Your SCOR pass already counts as the qualifying exam for the CCIE Security lab.
The expert credential for Cisco security. SCOR is the qualifying exam, so the remaining step is the eight-hour CCIE Security lab (v6.1), which costs $1,600 USD. The long-term goal for many security engineers who work on Cisco networks.
The vendor-neutral step toward architecture and leadership. ISC2 asks for five years of paid experience across two or more of its eight domains, and the credential moves you from configuring controls to designing and managing a whole security program.
The sideways move. Built around the 350-401 ENCOR core exam plus a concentration, it suits security engineers who also own the routing, switching and SD-WAN that their controls sit on.
CCNP Security is the middle rung of the Cisco security ladder. It builds on CCNA-level networking, branches into a concentration that matches your work, and leads to the CCIE Security lab or a broader security credential.
Build the baseline
Core plus concentration
Pick your path
Two things to settle before you commit: how ready you are to sit SCOR, and whether CCNP Security is the right credential for where your work is heading.
You can start on SCOR directly.
Cisco sets no formal prerequisites. If you already configure VLANs, routing and ACLs on Cisco gear and have spent time around firewalls, VPNs or 802.1X, you are ready to start SCOR prep now. The SCOR v2.0 exam topics on Cisco's site are the quickest way to see which of the six domains need the most work before you build a study plan.
Get to CCNA level first.
Nothing stops you from registering for SCOR, but it assumes associate-level networking and moves quickly past it. If subnetting, VLANs and routing still feel new, earning CCNA first, or at least working through its material with a lab, will make the professional exam far less painful. Security+ is a common vendor-neutral start on the security side.
CCNP Security fits engineering roles that secure Cisco networks, from the firewall team to security architecture. The concentration you choose shapes which of these it points toward.
Designs, deploys and maintains the controls that live on the network itself: firewalls, VPNs, segmentation and network access control. SCOR covers each of these at the core level, which is why this is the title CCNP Security lines up with most directly.
Builds and tunes access control, intrusion and VPN policies on Cisco Secure Firewall, then troubleshoots the traffic that stops passing after a change. The Network Security domain of SCOR and the 300-710 SNCF concentration map straight onto this work.
Runs 802.1X, MAB, guest access, posture and device profiling for wired, wireless and VPN users. The SCOR access domain sets the base, and the 300-715 SISE concentration goes deep on Cisco Identity Services Engine, the platform this role usually lives in.
Chooses the controls before anyone configures them: where firewalls and IPS sit, how identity and zero trust fit together, and how a design should change after an incident. The 300-745 SDSI concentration is Cisco's security design exam for this role.
Secures users and workloads that no longer sit behind the data center firewall, using SSE, secure internet and private access, and cloud workload protection. The new Secure Service Edge domain covers the basics, and the 300-740 SSCA concentration is built around Cisco Secure Access.
Keeps the security stack watched and tuned: endpoint detection events, XDR and Splunk correlation, and response playbooks. The endpoint and visibility domains of SCOR cover the tooling, and the role often sits between the network team and the SOC.
CCNA sits below CCNP Security as the associate tier, CCNP Enterprise is the parallel professional track for enterprise networking, and CCIE Security is the expert level above. The table lines the four up on exams, cost, renewal and DoD 8140 status.
| CCNP Security | CCNA | CCNP Enterprise | CCIE Security | |
|---|---|---|---|---|
| Issuer | Cisco | Cisco | Cisco | Cisco |
| Level | Professional | Associate | Professional | Expert |
| Focus | Network security, firewalls, identity, cloud and SSE, endpoints | Networking fundamentals on Cisco gear | Enterprise routing, switching, SD-WAN, assurance, security, automation | Expert-level security design, deployment and operations, hands-on |
| Exams | 350-701 SCOR (120 min) plus one concentration | 200-301, one exam (120 min) | 350-401 ENCOR (120 min) plus one concentration | SCOR plus an 8-hour lab |
| Core Exam Cost | $400 USD (SCOR) | ~$300 USD | $400 USD (ENCOR) | $400 SCOR, $1,600 lab |
| Prerequisites | None | None | None | SCOR pass before the lab |
| Recertification | 3 years (80 CE credits or exams) | 3 years (exam or 30 CE credits) | 3 years (exams or CE credits) | 3 years (120 CE credits or exams) |
| DoD 8140 Approved | Listed by Cisco (check matrix for roles) | Yes (Advanced, DCWF 441) | Check current matrix | Check current matrix |
| Best For | Network security engineers on Cisco platforms | Entry and junior networking roles | Mid-level and senior enterprise network engineers | Senior security engineers aiming for the expert tier |
Exam and recertification details vary by region and version. Each CCNP concentration exam costs $300 USD, and Cisco sets CCIE lab fees separately. Many engineers hold more than one of these over a career.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our nine-day Cisco CCNP Security boot camp covers the 350-701 SCOR v2.0 core exam and the 300-745 SDSI design concentration, live and instructor-led, in person or online. Hands-on labs, our own courseware, $700 in exam vouchers and a free retake are included. Veterans using Post-9/11 GI Bill benefits can take the nine-day live online CCNP Security exam preparatory course instead, which covers the six SCOR domains.
Where CCNP Security sits for DoD 8140, the zero trust and AI security topics SCOR v2.0 now tests, and how to read certification salary numbers.
A work-role-by-work-role map of the DoD 8140 qualification matrix for the cybersecurity and IT workforce elements, including where CCNP Security shows up for Advanced-level network roles and why your work role code matters more than any single cert.
Which certifications actually show up in DoD and federal contract requirements, how DoD 8140 replaced the old 8570 categories, and where Cisco CCNP Security fits for network security architecture roles.
A plain explanation of the zero trust model, where no user or device is trusted by default. SCOR v2.0 now tests zero trust architecture directly, along with Cisco Duo's place in it.
The ten risks OWASP lists for AI agents that plan, remember and call tools. Useful background now that SCOR v2.0 tests AI and LLM vulnerabilities such as prompt injection and supply chain weaknesses.
The strongest moves out of general IT and how to make them without starting over, including why network engineers who already hold Cisco credentials tend to reach security roles fastest through CySA+ or CCNP Security.
Why certification salary surveys run higher than federal wage data, and how to read the numbers when you are weighing a professional-level credential such as CCNP or CCIE.
Check-in, ID rules, breaks, online proctoring and retake waits compared across vendors, including Cisco's five-calendar-day wait after a failed written exam.
The 350-701 SCOR v2.0 exam is organized into six domains, each carrying its own weight. Click any domain for what it tests. Your concentration exam has its own separate blueprint.
The threat and cryptography groundwork. It covers attacks against on-premises, hybrid and cloud environments, software vulnerabilities ranked with CVE and CVSS scores, and the new v2.0 material on AI and LLM weaknesses such as prompt injection and system prompt leakage. PKI, TLS, QUIC, IPsec and post-quantum cryptography sit here too, along with VPN types from DMVPN to GETVPN, zero trust, the Cisco SAFE model, and reading Python scripts that call security appliance APIs.
The heaviest domain in v2.0. Firewall and intrusion prevention deployment models, Layer 2 defenses such as DHCP snooping and Dynamic ARP Inspection, CIS hardening benchmarks, and AAA troubleshooting with TACACS+ and RADIUS. Most of the hands-on work lands here: access control, URL filtering, malware and intrusion policies on Cisco Secure Firewall (FTD), plus configuring and troubleshooting site-to-site and remote access VPNs with Cisco Secure Client.
Who secures what under the cloud shared responsibility model, how to pick controls for public, private and hybrid clouds and for SaaS, PaaS and IaaS, and where a cloud access security broker fits. Cisco Multicloud Defense and Secure Workload, eBPF-based workload security, DevSecOps pipelines, and configuring Splunk to ingest cloud logs round it out.
New in v2.0, in the slot the old Content Security domain used to hold. You explain SSE and SASE, configure Secure Internet Access and Secure Private Access in Cisco Secure Access, set data loss prevention and AI guardrail policies, and read the scores and indicators in Secure Access Investigate.
EPP and EDR, device management with MDM and asset inventory, and endpoint posture assessment. On the Cisco side you configure antimalware protection in Cisco Secure Endpoint, interpret its malware detection events, and work with Cisco Secure Client, Secure Malware Analytics and Email Threat Defense.
Identity-based access: guest services, profiling, posture and BYOD, then configuring 802.1X, MAB and Change of Authorization with Cisco Identity Services Engine. It also covers exfiltration techniques from DNS tunneling to cloud storage, visibility through Cisco XDR and Splunk, and Cisco Duo in a zero trust design (MFA, device trust and adaptive access).
Domains and weights reflect the Cisco 350-701 SCOR v2.0 exam topics, first tested August 27, 2026. Cisco updates the blueprint on a periodic cycle and publishes the full topic list free on the SCOR exam page.
The questions candidates ask most often when researching the Cisco Certified Network Professional Security certification.
CCNP Security is Cisco's professional-level certification for network security. You earn it by passing two exams: the 350-701 SCOR core exam, which covers security concepts, network security, cloud security, Secure Service Edge, endpoint protection, and network access and visibility, plus one concentration exam of your choice from a list of four.
No. Cisco sets no formal prerequisites, so you don't need to hold CCNA first. In practice SCOR assumes you already understand CCNA-level networking, including VLANs, routing and IP services, so most candidates either hold CCNA or work at that level before they start.
As of October 2026, the 350-701 SCOR core exam costs $400 USD and each concentration exam costs $300 USD, so the two exams come to $700 USD before tax. Cisco Learning Credits can pay for either one. Pricing can vary by region, and boot camps often bundle the vouchers, so check what's included before paying separately.
SCOR runs 120 minutes and is offered in English and Japanese, in person at a test center or online, booked through Pearson VUE. Cisco doesn't publish a question count. Many v2.0 objectives use verbs such as configure, troubleshoot and interpret, so expect scenario questions built around tasks on Cisco Secure Firewall, Identity Services Engine, Secure Access and Secure Endpoint.
Cisco doesn't publish a passing score for 350-701 SCOR in advance. When you finish, your score report shows a score for each exam section along with the passing score for that exam. If you fail, Cisco makes you wait five calendar days before you can retake it.
The six SCOR v2.0 domains are Security Concepts (20%), Network Security (25%), Cloud Security (15%), Secure Service Edge (10%), Endpoint Protection and Detection (15%), and Network Access, Visibility, and Enforcement (15%). Network Security, which covers Cisco Secure Firewall policy and VPNs, carries the most weight.
SCOR v2.0 became the live exam on August 27, 2026, and the last day to test on v1.1 was August 26, 2026. Cisco calls it the first major revision since SCOR launched in February 2020. The Content Security domain is gone and a new Secure Service Edge domain takes its place, Network Security is now the heaviest domain at 25%, and new topics include AI and LLM vulnerabilities, post-quantum cryptography, zero trust architecture, eBPF, Splunk and Cisco Duo.
Pick the one closest to your job. The four options are 300-710 SNCF (Cisco Secure Firewall and Firewall Management Center), 300-715 SISE (Cisco Identity Services Engine), 300-740 SSCA (secure cloud access with SSE and Cisco Secure Access, formerly called SCAZT), and 300-745 SDSI (security infrastructure design). Each one runs 90 minutes, costs $300 USD, and earns its own Cisco Specialist certification. SDSI is the odd one out, a design exam rather than a product configuration exam, so it suits architects more than the engineers who run the consoles.
Cisco retired 300-730 SVPN, and its last test day was August 26, 2026. There is no direct replacement concentration. VPN topics moved into SCOR, which still tests VPN types and Secure Firewall VPN configuration, and into SNCF. The email and web security appliance concentrations (300-720 SESA and 300-725 SWSA) had their last test day on the same date.
Yes. Cisco says a v1.1 pass still combines with any current Security concentration exam to earn CCNP Security, even if you sit the concentration on or after August 27, 2026. Whichever exam you pass first, you have three years from that date to pass the other one, and Continuing Education credits do not extend that window.
CCNP Security is valid for three years. To recertify you can earn 80 Cisco Continuing Education credits, pass qualifying Cisco exams, or move up to the next certification level, all before your expiration date. A new exam version such as SCOR v2.0 does not force you to retest. Cisco's recertification page lists the current options.
Cisco lists CCNP Security on its DoD 8140 page among the certifications with mapped DCWF work roles. The specific work roles and proficiency levels differ between sources and change between matrix versions, so check the current DoD 8140 qualification matrix for CCNP Security before relying on it for a coded position. See the full DoD 8140 work role paths.
CCNP Security supports roles such as network security engineer, firewall engineer, identity and access engineer, security architect, cloud security engineer and security operations engineer. The concentration you choose shapes which of these it points toward.
Yes. Passing 350-701 SCOR also satisfies the qualifying exam requirement for the CCIE Security lab, an eight-hour hands-on exam that costs $1,600 USD. The pass keeps you eligible for the lab for three years, and Cisco says a valid v1.1 pass still qualifies you inside that window.
For engineers who run security on Cisco networks, yes. It proves hands-on skill on Cisco Secure Firewall, Identity Services Engine and Secure Access, and the v2.0 rewrite brought in the SSE, zero trust and AI security content that current roles deal with. It's less useful if your organization runs little Cisco security gear, where a vendor-neutral credential may carry further.
If you are weighing the certification, choosing a concentration, working out funding, or planning training for a team, tell us where you are and we'll help you map out the right path.