Cisco CCNP Security Study Guide
CCNP Security is Cisco's network-security engineering certification — the SCOR core plus one concentration, covering firewalls, identity (ISE), VPN/SSE, and from v2.0, AI-era security. Read this before anything else: 2026 is a transition year. SCOR v1.1's last test day is August 26, 2026; v2.0 launches August 27 — and three concentration exams retire outright on the same date.
Overview
Level
Professional
Vendor
Cisco
Audience
Network engineers pivoting into security engineering — people who build and run Cisco Secure Firewall, ISE/NAC, and VPN/SSE estates. Explicitly NOT a SOC analyst cert: if your target is alert triage, incident response, and threat hunting, that's Cisco's separate CCNP Cybersecurity (the renamed CyberOps Professional). Confusing these two wastes a year.
Why get CCNP Security
It's consistently cited as the highest-paying CCNP track, and the reason is scarcity of the profile: engineers who genuinely know both enterprise networking and the Cisco security stack — Secure Firewall (FTD/FMC), ISE, secure connectivity — are rare and expensive. Every exam passed earns a standalone Specialist credential along the way, and SCOR doubles as the CCIE Security qualifying exam. The honest scope note: this is a Cisco-product expert path, and its value tracks your employer's Cisco footprint. In Palo Alto or Fortinet shops it buys less; pair it with Security+ or CISSP for the vendor-neutral HR-filter layer.
Salary expectations
Typical salary range
$110,000 – $155,000 (U.S. network security engineers)
Placement trackers consistently call CCNP Security the highest-paying CCNP: ZipRecruiter-class data shows ~$150K averages for tagged roles (with the usual title-skew caveats), PayScale pegs cert-holder medians nearer $113K. The realistic band is $110–155K, with federal/cleared roles and Fortune-500 firewall+ISE work at the top. All third-party estimates — no official Cisco salary data exists.
When to get CCNP Security
After CCNA-level networking plus real exposure to firewalls, VPNs, and identity concepts — SCOR will bury pure-theory candidates. And in 2026, timing IS the strategy: if you're mid-study on v1.1 material (or targeting SESA, SWSA, or SVPN — all three retire), you must test by August 26, 2026. Starting fresh? Study straight to the v2.0/v1.2 blueprints and expect official training to lag — Cisco ships partial v2.0 training in Q3 2026, full in Q4. Both windows are legitimate choices — drifting across the boundary mid-prep is the expensive mistake.
Exam details
Exam Quick Reference
- Exam Code
- 350-701 SCOR + 1 concentration
- Vendor
- Cisco
- Level
- Professional
- Duration
- SCOR: 120 minutes · concentration: 90 minutes
- Format
- Two proctored exams at Pearson VUE (test center or OnVUE): the SCOR core (multiple-choice, drag-and-drop, performance-based; count and passing score not published) plus one concentration. Results in ~48 hours. No lab exam at CCNP level.
- Questions
- Not published by Cisco
Renewal: 3-year cycle, 80 CE credits — the unified ledger: core exam re-pass = 80 CE, concentrations = 40 each, training CE from Cisco U counts too, excess rolls over. Two concentrations across a cycle keeps you certified without re-facing SCOR.
How this certification is assembled
- Core exam — required 350-701 SCOR $400
Implementing and Operating Cisco Security Core Technologies
v1.1 last test day Aug 26, 2026; v2.0 live Aug 27 (adds AI/LLM security, Zero Trust/SSE/SASE, post-quantum crypto). Also the CCIE Security qualifying exam. Earns Specialist – Security Core.
- Concentration — choose one 300-710 SNCF $300
Securing Networks with Cisco Firewalls
The most job-relevant pick — firewall roles name it. Moves to v1.2 on Aug 27, 2026.
- Concentration — choose one 300-715 SISE $300
Implementing and Configuring Cisco Identity Services Engine
The identity/NAC lane — ISE expertise is among the most billable Cisco skills. v1.2 (ISE 3.4/3.5) from Aug 27, 2026.
- Concentration — choose one 300-740 SCAZT $300
Designing and Implementing Secure Cloud Access for Users and Endpoints
Major v2.0 rewrite Aug 27, 2026: multicloud, ZTNA, AI guardrails.
- Concentration — choose one 300-745 SDSI $300
Designing Cisco Security Infrastructure
Newest option — architecture/design plus DevSecOps focus.
- Concentrations — RETIRING 300-720 / 300-725 / 300-730 $300
SESA (email), SWSA (web), SVPN (VPN)
All three retire Aug 26, 2026 with no replacements. Only start one if you can test before that date.
Facts on this page last verified July 2026 against official Cisco sources.
Skills covered
Network Security & Firewalls (25%)
- Cisco Secure Firewall (FTD/FMC) deployment and policy
- Intrusion prevention concepts and tuning
- Segmentation strategy and enforcement
- NetFlow/telemetry for security visibility
- The firewall engineering that SNCF then certifies at depth
Identity, Access & Enforcement (15%)
- ISE concepts: 802.1X, MAB, posture, profiling
- AAA architecture across the enterprise
- TrustSec and software-defined segmentation
- Guest access and BYOD workflows
- The identity layer modern zero-trust designs stand on
Cloud Security & SSE (25% in v2.0)
- Zero Trust and SASE/SSE architecture — first-class in v2.0
- Cloud security fundamentals across IaaS/SaaS
- Umbrella/Secure Access concepts
- AI/LLM security vulnerabilities — new v2.0 territory
- Post-quantum cryptography awareness — yes, it's on the blueprint now
Endpoint & Content Security (15–20%)
- Endpoint detection concepts and Cisco Secure Endpoint
- Email and web security principles (surviving SESA/SWSA's retirement in the core)
- Malware analysis fundamentals
- eBPF-based workload protection — new in v2.0
- VPN technologies: site-to-site and remote access
Step-by-step study path
This sequence reflects what consistently works. Follow it in order—don't skip ahead.
- 1
Pick your side of August 26, 2026 — first, before anything
The single most important decision: test v1.1 by Aug 26 (mature study materials, but a deadline), or start clean on v2.0 from Aug 27 (current content — AI security, SSE, PQC — but official training arrives in waves, Q3–Q4 2026). Mid-study drift across that boundary is the expensive mistake. If SESA/SWSA/SVPN was your concentration plan, the deadline is absolute — they retire with no replacements.
- 2
Confirm this is your track — not CCNP Cybersecurity
Thirty seconds that saves a year: CCNP Security = build and run the security infrastructure (firewalls, ISE, VPN/SSE). CCNP Cybersecurity (renamed CyberOps Professional) = SOC operations, forensics, threat hunting. Different careers, different exams. If your target is analyst work, stop here and switch guides.
- 3
Choose the concentration by your job market
SNCF (firewalls) has the most postings behind it; SISE (ISE/identity) is the most billable specialty; SCAZT covers the cloud/ZTNA direction the industry is moving; SDSI suits architecture-leaning engineers. Pick before starting SCOR so your lab time compounds.
- 4
Lab on DevNet sandboxes — the stack is unaffordable otherwise
Nobody home-labs FMC, ISE, and the content stack legally on a budget. Cisco's free DevNet sandboxes carry reservable ISE and Secure Firewall instances — the realistic hands-on route. Add dcloud.cisco.com guided demos with a free account, and Katherine McNamara's free ISE labs at network-node.com (the unofficial SISE bible — verify version coverage against ISE 3.4/3.5 for v1.2).
- 5
Build the SCOR spine from the OCG plus blueprint deltas
Omar Santos's SCOR Official Cert Guide is the standard text — but it targets v1.1, and no v2.0 edition exists at the changeover. If you're on the v2.0 side, study the book for the durable 70% and fill AI-security, SSE/SASE, and post-quantum topics straight from the blueprint and Cisco U content as it lands.
- 6
Calibrate with Boson before burning $400
Boson's SCOR ExSim is the most exam-realistic practice available and the best predictor of readiness. Consistent mid-80s = book it. Version-check the bank against your chosen blueprint side.
- 7
Sit SCOR, bank two doors at once
Passing earns Specialist – Security Core immediately and qualifies you for the CCIE Security lab. 120 minutes, results in ~48 hours.
- 8
Close out the concentration while the core is fresh
90 minutes, $300. SNCF and SISE reward the sandbox hours you already logged; SDSI leans design-brain over lab-brain. Passing completes CCNP Security and banks 40 CE toward the next cycle.
- 9
Add the vendor-neutral layer for HR
The blunt market truth: many security-manager and government postings filter on Security+ or CISSP regardless of how deep your Cisco skills run. CCNP Security proves you can build it; pair it with the neutral credential that gets the resume opened. Our Security+ and CISSP guides cover both.
- 10
Keep current the cheap way
80 CE per 3 years: one concentration re-pass (40) plus free Cisco U 'Rev Up' promos usually covers it. Watch for time-boxed free official courses too — Cisco periodically gives away full concentration prep worth 40+ CE.
Ready for a structured course?
A top-rated course covers every CCNP Security exam domain in order. See the paid resources section below for options and pricing.
View course options →Free resources
The authoritative v2.0 blueprint; the v1.1 blueprint stays posted until the Aug 26, 2026 sunset. Your side-of-the-boundary decision starts here.
Every date that matters: Aug 26 last-day-to-test for v1.1 and the three retiring exams, Aug 27 v2.0 launch, and the training release schedule.
Free reservable instances of the exact products on the blueprint — the realistic way to lab this stack without enterprise gear.
The community's unofficial SISE bible — long-running free ISE lab guides. Verify coverage against ISE 3.4/3.5 for the v1.2 exam.
Free study groups and official Q&A — including transition-focused events as the v2.0 cutover approaches.
Paid resources
The resources below are the most commonly recommended for the 350-701 SCOR + 1 concentration exam. Prices reflect typical pricing—discounts run frequently.
| Provider | Type | Price | Best for | Link |
|---|---|---|---|---|
| Cisco Press – SCOR 350-701 Official Cert Guide, 2nd Ed. (Omar Santos) | Book | ~$50–$70 | The standard spine text — with the transition warning: it targets v1.1, and no v2.0 edition exists at the changeover; supplement AI/SSE/PQC topics from the blueprint | |
| Boson ExSim-Max for SCOR 350-701 | Practice Exams | ~$99 | The most exam-realistic practice in the Cisco space — the best predictor before spending $400 on an attempt | |
| CBT Nuggets – CCNP Security | Video Course | ~$59/month | Video-first learners — solid SCOR and SISE coverage with virtual labs and quizzes | |
| Cisco U. (Essentials / All Access) | Official Training | ~$1,800/yr Essentials · ~$6,000/yr All Access (list — verify current pricing) | Employer-funded prep — All Access subscribers get early v2.0 SCOR/SNCF/SCAZT training in Q3 2026 before the full Q4 release, and completions earn CE credits |
Cisco Press – SCOR 350-701 Official Cert Guide, 2nd Ed. (Omar Santos)
Book · ~$50–$70
The standard spine text — with the transition warning: it targets v1.1, and no v2.0 edition exists at the changeover; supplement AI/SSE/PQC topics from the blueprint
Still worth owning on the v2.0 side — the durable 70% doesn't change.
Boson ExSim-Max for SCOR 350-701
Practice Exams · ~$99
The most exam-realistic practice in the Cisco space — the best predictor before spending $400 on an attempt
Plain reference link, no commission. Version-check against your blueprint side.
CBT Nuggets – CCNP Security
Video Course · ~$59/month
Video-first learners — solid SCOR and SISE coverage with virtual labs and quizzes
Plain reference link.
Cisco U. (Essentials / All Access)
Official Training · ~$1,800/yr Essentials · ~$6,000/yr All Access (list — verify current pricing)
Employer-funded prep — All Access subscribers get early v2.0 SCOR/SNCF/SCAZT training in Q3 2026 before the full Q4 release, and completions earn CE credits
Rational with employer money or Cisco Learning Credits; overkill self-funded versus book + Boson + sandboxes.
Affiliate links (buttons) may earn us a commission at no extra cost to you. Plain text links are unaffiliated references and earn us nothing. Affiliate disclosure →
Vouchers & exam cost
$700 minimum. Check whether your employer holds Cisco Learning Credits before paying cash — security teams at Cisco shops usually do. And re-check the calendar against the Aug 26/27, 2026 version boundary before booking anything.
Frequently asked questions
What's this August 2026 deadline everyone mentions?
Cisco's biggest security-track transition in years: SCOR v1.1, SNCF v1.1, SISE v1.1, and SCAZT v1.0 all have a last test date of August 26, 2026, with v2.0/v1.2 versions launching August 27 — and three concentrations (SESA email, SWSA web, SVPN) retire outright that day with no replacements. Decide which side of the boundary you're on before you start studying, not mid-way.
CCNP Security or CCNP Cybersecurity — aren't they the same thing?
No, and the naming genuinely trips people. CCNP Security (SCOR + concentration) is security ENGINEERING: you build and operate firewalls, ISE, VPN/SSE. CCNP Cybersecurity — the renamed CyberOps Professional (CBRCOR core + forensics or threat-hunting concentration) — is security OPERATIONS: SOC work, incident response, hunting. Pick by which chair you want: builder or defender-analyst.
Which concentration should I pick?
SNCF (firewalls) for the most job postings; SISE (ISE/identity) for the most billable specialty; SCAZT for the ZTNA/cloud direction; SDSI for design-leaning engineers. Do not start SESA, SWSA, or SVPN unless you can test before August 26, 2026 — they retire with no successors.
Is CCNP Security worth it outside Cisco shops?
Less — be honest with yourself here. This is a Cisco-product expert path; its market value tracks your employer's (or target employers') Cisco security footprint. In Palo Alto or Fortinet estates, it buys goodwill but not mastery-fit. Vendor-neutral trajectory (CISO-track, architecture)? CISSP plus this or instead of this. Pure Cisco shop? Few certs pay better.
What does SCOR v2.0 actually add?
The 2026 threat landscape, essentially: AI/LLM security vulnerabilities, Zero Trust and SSE/SASE as first-class architecture, Splunk telemetry, eBPF workload protection, and post-quantum cryptography awareness. It's a genuinely more current exam — the trade-off is that official training lands in waves (partial Q3, full Q4 2026) and third-party material will lag into 2027.
Does SCOR count toward CCIE Security?
Yes — SCOR is simultaneously the CCNP Security core and the CCIE Security qualifying exam. Pass it and you're eligible to book the 8-hour lab. Same efficient pattern as the Enterprise track: the professional cert's core is the expert cert's entry ticket.
How do I keep it current without re-taking SCOR?
80 CE credits per 3-year cycle, and concentrations pay 40 each — so one additional concentration per cycle plus modest Cisco U coursework keeps you certified indefinitely. Watch for Cisco's periodic free official courses; they've given away full concentration prep worth 40+ CE before.
Ready to study?
Start with the free resources above, then add a top-rated course and practice exams when you're ready to test yourself.