Associate Cisco · Exam 200-201 · formerly CyberOps Associate

Cisco CCNA Cybersecurity 200-201 Study Guide

Understanding Cisco Cybersecurity Operations Fundamentals (200-201 CCNACBR) v1.2 earns the CCNA Cybersecurity certification — the credential formerly known as CyberOps Associate. It is a 120-minute exam covering security concepts, security monitoring, host-based analysis, network intrusion analysis, and security policies and procedures. It costs $300 USD, is offered in English only, and is aimed squarely at the work of a security operations centre rather than at security theory.

Overview

Level

Associate

Vendor

Cisco

Audience

Aspiring and working SOC analysts, especially in organisations running Cisco security tooling, and network people moving toward defensive security. It assumes networking fluency — you need to read a packet capture and understand what normal traffic looks like before abnormal traffic means anything — so CCNA or Network+ level knowledge first makes it far more manageable.

Why get CCNA Cybersecurity

CCNA Cybersecurity proves you can do the day-one work of a SOC tier-1 analyst: read logs, spot intrusions, analyze network and host data, and follow an incident-response process. It is one of the few associate-level certifications built specifically around security operations rather than general security theory, which maps directly to real SOC job tasks. Employers hiring for SOC and blue-team roles treat it as evidence that a candidate understands monitoring tooling, attacker techniques, and the analyst workflow—not just terminology. It also pairs naturally with CompTIA Security+ (a broad security baseline) and CCNA (a networking foundation), forming a strong entry-level cybersecurity resume.

Salary expectations

Typical salary range

$60,000 – $110,000

Entry-level SOC tier-1 analyst roles typically start around $55K–$75K depending on location and clearance. With 2–3 years of monitoring and incident-response experience, SOC analyst and security analyst roles commonly reach $90K–$110K, and senior/blue-team specialists go higher. Government and federal-contractor SOC roles often add strong benefits and clearance premiums on top of base salary.

When to get CCNA Cybersecurity

Take it when you want a monitoring-and-analysis credential rather than a broad security one, and when you have enough networking behind you to reason about traffic. The honest comparison is with CompTIA CySA+: CySA+ is vendor-neutral, DoD 8140 approved and more widely recognised by name, while this exam maps more directly onto Cisco tooling and is the entry point to Cisco's cybersecurity track. If your employer is a Cisco shop, this one; if you are shopping your resume around, CySA+ travels further. Security+ first is the usual order either way.

Exam details

Exam Quick Reference

Exam Code
200-201
Vendor
Cisco
Level
Associate
Duration
120 minutes
Format
Multiple-choice and multiple-response questions, 120 minutes, English only. Cisco does not publish the question count or the passing score, so any specific figure you see elsewhere is an estimate.
Questions
Cisco does not publish the question count
Official exam page Verify current pricing

Renewal: Valid for 3 years. Renew by passing another Cisco exam, earning Continuing Education credits through the Cisco CE program, or achieving a higher-level Cisco certification before expiration.

Facts on this page last verified September 24, 2026 against official Cisco sources.

Skills covered

Security Concepts (20%)

  • The CIA triad and core security principles
  • Common attack types, the cyber kill chain, and MITRE ATT&CK
  • Defense-in-depth and security deployment models
  • Risk, vulnerabilities, exploits, and threat actors
  • Access control models and security terminology

Security Monitoring (25%)

  • Network data types: full packet capture, session/NetFlow, and transaction data
  • Reading and interpreting logs from common sources
  • Detecting attacks in network traffic (DNS, web, and email-based)
  • Impact of encryption, NAT, and tunneling on visibility
  • Common artifacts used to identify malicious activity

Host-Based Analysis (20%)

  • Endpoint components: processes, the registry, and file systems
  • Endpoint logs and host-based intrusion detection
  • Interpreting malware analysis reports
  • Identifying indicators of compromise on a host
  • Windows and Linux host investigation basics

Network Intrusion Analysis (20%)

  • Interpreting IDS/IPS and firewall events
  • Analyzing packet captures with Wireshark and tcpdump
  • Mapping events to protocol headers and PDUs
  • Extracting files and artifacts from captured traffic
  • Distinguishing true positives, false positives, and benign traffic

Security Policies and Procedures (15%)

  • The incident response process (NIST SP 800-61)
  • SOC metrics, runbooks, and the analyst workflow
  • Evidence handling and chain of custody
  • The VERIS framework and incident categorization
  • Network and server profiling concepts

Step-by-step study path

This sequence reflects what consistently works for SOC-bound candidates. Follow it in order—don't skip ahead.

  1. 1

    Download the official 200-201 exam topics

    Get the official CCNACBR (200-201) exam topics from the Cisco Learning Network. The five domains and their weightings are your study roadmap—review them before buying any course so you study what the exam actually tests.

  2. 2

    Shore up networking fundamentals

    The Security Monitoring and Network Intrusion Analysis domains together are 45% of the exam, and both assume you can read TCP/IP, ports, and protocol behavior. If networking is new to you, spend time here first—CCNA or Network+ material is more than enough background.

  3. 3

    Work through a primary video course

    Choose one comprehensive 200-201 video course and complete it end to end rather than jumping between several. A full CyberOps Associate course on Udemy covers all five domains with worked examples. See the paid resources section for options.

  4. 4

    Read the official cert guide

    The Cisco Press CyberOps Associate Official Cert Guide by Omar Santos is the only Cisco-approved self-study book. Use it alongside your video course to reinforce the host-based and intrusion-analysis topics that need more depth than video alone.

  5. 5

    Get hands-on with SOC tools

    This exam rewards practical analyst skills. Practice with Wireshark on sample captures, explore logs in a tool like Security Onion, and work through TryHackMe's SOC Level 1 path. Hands-on reps make the monitoring and intrusion-analysis questions far easier.

  6. 6

    Practice reading logs and packet captures

    Drill the core analyst task: given a log entry or packet capture, decide whether it is malicious, benign, or a false positive—and why. Many exam questions are scenario-based and test exactly this judgment, not memorization.

  7. 7

    Take timed practice exams

    Once you have covered all five domains, work through practice exams under timed conditions. Aim to score consistently above 85% before booking. Review every wrong answer until you understand the underlying concept, not just the correct option.

  8. 8

    Schedule and sit the exam

    Register through Pearson VUE and take the 120-minute exam at a test center or online proctored. Book about two weeks out to set a firm deadline. Arrive rested—scenario questions reward clear thinking over cramming.

Starting step 3?

A full CyberOps Associate course on Udemy covers all five 200-201 domains. See the paid resources section below for options and pricing.

View course options →

Free resources

Official Documentation Cisco 200-201 CCNACBR Exam Topics (Official)

The official exam blueprint with all five domains and their weightings. This is your study roadmap—start here.
Community Cisco Learning Network – CyberOps Community

Official study groups, discussion forums, and free study materials for the CCNACBR exam. Search before posting—most common questions are already answered.
Hands-on Labs TryHackMe – SOC Level 1 Learning Path

Browser-based blue-team labs covering log analysis, SIEM, network and endpoint investigation. The free rooms map directly to 200-201 monitoring and intrusion-analysis skills.
Video Course MyDFIR – SOC Analyst Series (YouTube)

Free, practical SOC-analyst content on detection, log analysis, and incident response—useful for building the hands-on intuition the exam tests.
Community r/cybersecurity on Reddit

Active community with SOC career advice and recent exam-experience reports. Useful for understanding what tier-1 SOC work actually looks like.

Vouchers & exam cost

Buy 200-201 CyberOps Exam Voucher – Cisco Official

The 200-201 exam is $300 USD at standard pricing, or payable with Cisco Learning Credits, and is scheduled through Pearson VUE. Verify current pricing on the official Cisco exam page before purchasing.

Frequently asked questions

Is CCNA Cybersecurity the same as CyberOps Associate?

Yes. As part of Cisco's 2026 certification rebrand, the Cisco Certified CyberOps Associate was renamed CCNA Cybersecurity. The exam code (200-201) and content are essentially the same—only the name changed. You will still see both names used interchangeably for a while.

Is CCNA Cybersecurity good for beginners?

Yes, for people targeting security operations. There are no formal prerequisites. It is genuinely entry-level for the SOC analyst path, but it assumes some comfort with networking (TCP/IP, ports, protocols). Complete beginners should spend a few weeks on networking basics first.

How hard is the 200-201 exam?

It is a real associate-level exam. The questions are scenario-based and test analyst judgment—reading logs and packet captures and deciding what is malicious—rather than pure memorization. Most candidates find the monitoring and intrusion-analysis domains the toughest because they require hands-on practice.

How long does it take to study for CCNA Cybersecurity?

Most candidates spend 2 to 4 months part-time. Those with existing networking or security experience (for example, after Security+) may be ready in 6 to 8 weeks. Hands-on practice with tools like Wireshark and TryHackMe matters as much as video completion.

Do I need CCNA or networking knowledge first?

Not formally, but it helps a lot. Nearly half the exam involves analyzing network traffic and intrusions, which is far easier if you already understand IP addressing, ports, and protocols. CCNA or CompTIA Network+ material is more than enough background—you do not need to pass them first.

CCNA Cybersecurity or CompTIA Security+ — which should I get first?

Security+ is broader and is the more common hiring baseline, so many people start there. CCNA Cybersecurity is more focused on hands-on SOC operations. They complement each other well: Security+ for the broad fundamentals, CCNA Cybersecurity to prove you can do real monitoring and analysis work.

What certification comes after CCNA Cybersecurity?

The natural Cisco progression is CCNP Cybersecurity (formerly CyberOps Professional). Many SOC analysts also branch out to vendor-neutral certs like CompTIA CySA+ for threat detection, or pursue blue-team/DFIR credentials as they specialize.

Does CCNA Cybersecurity expire?

Yes. Like all Cisco associate certifications, it is valid for three years. Renew it by passing another Cisco exam, earning Continuing Education credits through the Cisco CE program, or achieving a higher-level Cisco certification before it expires.

Jobs where CCNA Cybersecurity shows up

One role in our Career Navigator list CCNA Cybersecurity as worth having. Each page covers what the job involves day to day, its honest downside, and the typical pay.

Not sure which of these fits you? Take the free Navigator assessment →

More Cisco certifications

The full Cisco roadmap →

Ready to study?

Start with the free Cisco exam topics and TryHackMe's SOC Level 1 path, then add the Udemy course and Omar Santos' official cert guide for full coverage.

Udemy View recommended course
Explore more Cisco certs