Skip to content
CertGPS

Cisco Certified Network Professional Security

Proves hands-on skill with Cisco security products through the SCOR core exam, revised in August 2026, plus one concentration exam

AdvancedCisco

The exam

Exam cost
$700
Study time
6-9 months
Passing score
Not published by Cisco
Valid for
3 years

Before you book

  • None required
  • Two exams: SCOR 350-701 core plus one concentration (SNCF, SISE, SSCA or SDSI)

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. CompTIA Network+

    Entry

    Comes before. Builds the vendor-neutral networking base that SCOR's VPN and segmentation objectives assume

  2. Cisco Certified Network Professional Security

    You are here

  3. Certified Information Systems Security Professional

    Expert

    Next step. Adds governance, risk and architecture, which CCNP Security's product-focused exams leave out

Study guide

Last updated

CCNP Security Study Guide: SCOR v2.0, the Concentrations, and a Plan

CCNP Security shows that you can design, configure and troubleshoot security on Cisco's products, from Secure Firewall to Identity Services Engine (ISE). You earn it with two exams, the SCOR 350-701 core and one concentration, and Cisco rewrote the core this summer. SCOR v2.0 replaced v1.1 on August 27, 2026, adding artificial intelligence (AI) and large language model (LLM) risks, Secure Access, Splunk and post-quantum cryptography, and three concentration exams retired the same month, so study material written for v1.1 is now partly out of date.

Who CCNP Security suits, and who should look elsewhere

It suits a network or security engineer who already runs Cisco security products and wants the credential that matches the job: the person who writes the firewall access policies, sets up 802.1X with ISE, or troubleshoots a remote access virtual private network (VPN) on Firewall Threat Defense (FTD). Cisco sets no formal prerequisites and publishes no recommended experience, but the configure and troubleshoot objectives assume you've worked with these products in production.

If your network doesn't run Cisco, most of the hands-on objectives won't transfer, and a vendor-neutral credential will serve you better. If routing, switching and subnetting still feel uncertain, start with Network+ or Cisco's own CCNA. For security management rather than device configuration, CISSP is the usual target.

The two exams at a glance

Core: SCOR 350-701 v2.0Concentration (pick one)
ExamsImplementing and Operating Cisco Security Core TechnologiesSNCF 300-710, SISE 300-715, SSCA 300-740 or SDSI 300-745
Time120 minutes90 minutes
Price$400$300
Passing scoreNot published by CiscoNot published by Cisco
DeliveryPearson VUEPearson VUE
PrerequisitesNoneNone
Validity3 years; renew with 80 continuing education credits or by passing examsSame

SCOR is offered in English and Japanese. Each exam you pass also earns a Cisco Certified Specialist certification, and SCOR is the qualifying exam for CCIE Security as well.

What changed in August 2026

Cisco's learning blog calls SCOR v2.0 the first major revision since the exam launched in February 2020. The last day for v1.1 was August 26, 2026. Cisco has said a v1.1 pass still combines with any current concentration exam to award CCNP Security, including concentrations taken after the switch, so if you passed v1.1 you don't need to resit the core.

The concentration list is shorter. SAUTO (300-735), on security automation, retired on February 2, 2026. SVPN (300-730), SESA (300-720) for email security and SWSA (300-725) for web security retired in August 2026, and Cisco moved the VPN material into SCOR and SNCF. SCAZT kept its 300-740 code and was renamed SSCA. SDSI (300-745) is newer: a design exam that includes AI, automation and DevSecOps.

SCOR v2.0 domains and weights

  • Security Concepts: 20%
  • Network Security: 25%
  • Cloud Security: 15%
  • Secure Service Edge: 10%
  • Endpoint Protection and Detection: 15%
  • Network Access, Visibility, and Enforcement: 15%

Network Security is the largest domain and the most hands-on. Its objectives ask you to configure access control, URL filtering and intrusion prevention on Secure Firewall (FTD), build site-to-site and remote access VPNs, troubleshoot tunnels that won't come up, and work through TACACS+ and RADIUS problems.

Secure Service Edge is the new domain, covering Security Service Edge (SSE) and Secure Access Service Edge (SASE) concepts, with configuration of Cisco Secure Access for internet and private access, data loss prevention and "AI guardrails". Elsewhere, Security Concepts now asks about prompt injection, system prompt leakage and vector and embedding weaknesses in LLMs, and lists QUIC, MASQUE and post-quantum cryptography next to IPsec and PKI. Splunk appears three times, Cisco Duo has its own objective, and Cloud Security includes extended Berkeley Packet Filter (eBPF) workload security. Email security gets one objective, on Email Threat Defense.

The exam is broader than the "network" in the name suggests. You'll need to read Python that calls security appliance APIs, know the Center for Internet Security (CIS) benchmarks for FTD and IOS XE, and explain DNS tunneling and other exfiltration methods.

How to prepare

Start with the SCOR v2.0 exam topics PDF and check every study resource against it. The CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide, second edition, by Omar Santos (Cisco Press, 2023) was written for v1.1, so check its chapters against the v2.0 objectives, especially Secure Service Edge, the LLM objectives and the Splunk tasks. Cisco's own course for the exam, Implementing and Operating Cisco Security Core Technologies, received its v2.0 update in September 2026, and Cisco U. offers a guided learning path.

Hands-on time matters most in Network Security and Network Access. Build what you can in a virtual lab: FTD managed from Firewall Management Center with an access policy, URL filtering and a remote access VPN, then break the VPN and fix it from the command line. Set up ISE with 802.1X and MAC Authentication Bypass (MAB) on a switch port, and push a Change of Authorization (CoA). Send firewall and ISE logs into Splunk and write the searches you'd use in an investigation.

Choose the concentration that matches your job. Pick SNCF if you run Secure Firewall, SISE if you own network access control, SSCA if your company is moving users to Secure Access, and SDSI if you design rather than configure. Studying the concentration straight after SCOR lets you reuse your lab.

We'd plan on roughly 60% of your time for SCOR and 40% for the concentration. Within SCOR, split it by the weights but give Secure Service Edge extra time, because it's the newest domain and the 2023 Cert Guide predates it.

Renewal and next steps

The certification lasts three years. You can renew with 80 continuing education credits from Cisco-approved training and activities, by passing qualifying exams, or by moving up a level. Cisco applies continuing education credits automatically as you earn them, and each credit is valid for three years from the activity.

  • CCIE Security: your SCOR pass is its qualifying exam, so the eight-hour, $1,600 lab exam is what remains.
  • CISSP for governance and risk management, which CCNP leaves out.
  • CCSP if your work is shifting to cloud security across providers.

Our view

CCNP Security is respected where Cisco security products are installed, because it shows configuration and troubleshooting depth on those products. It's criticized for the same reason: much of what you learn is how Cisco's products are configured, which transfers poorly to other vendors. The v2.0 outline improves that balance with zero trust, SSE, LLM risks and post-quantum cryptography. At $700 for two exams, it's worth it if you run Cisco security every day or work for a Cisco partner. If you don't, put the money and the months into a vendor-neutral or cloud credential.

Sources