You can see it againUnder pressure people bring back shapes and positions long after the wording has gone.
Picture superiority · Shepard 1967, Standing 1973
CISCOCisco Certified Network Professional Security
The Cisco Certified Network Professional (CCNP) Security certification validates your ability to design, implement, and operate core security technologies, including network security, cloud security, content security, endpoint protection, and secure network access. It is designed for security engineers and architects who protect enterprise networks and data. Earning this credential demonstrates advanced skills that are essential for securing modern, complex IT environments.
Exam formatMultiple choice and multiple response
Duration120 minutes
DeliveryPearson VUE
Free questions1289
Content last reviewed 30 July 2026 · Up to date
The certification
What 350-701 proves, and what it asks of you
What this certification covers, who it is written for, and what the exam itself looks like on the day.
6domains
47objectives
319concepts
US $400exam fee
What it is
What this certification is
What it validates, who it is written for, and the experience it assumes.
About this certification
The CCNP Security certification is a professional-level credential that proves your expertise in implementing and operating core security technologies. It covers a broad range of topics, from securing network infrastructure and cloud environments to protecting content, endpoints, and user access. This certification is ideal for security professionals who want to advance their careers and take on more complex security challenges.
Achieving CCNP Security requires passing the 350-701 SCOR exam, which tests your knowledge of network security, cloud security, content security, endpoint protection and detection, secure network access, visibility, and enforcements. The certification also requires passing one concentration exam, allowing you to specialize in areas such as advanced threat protection, identity and access management, or security automation. Earning this credential signals to employers that you have the skills to design and manage robust security solutions.
Who it’s for
This certification is for security engineers, network security architects, and IT professionals who are responsible for designing, implementing, and operating security solutions in enterprise environments. It is also suitable for those who want to validate their skills in core security technologies and advance to expert-level certifications. Candidates typically have several years of experience in network security and are familiar with Cisco security products and solutions. They are comfortable working with firewalls, VPNs, intrusion prevention systems, and cloud security technologies.
Recommended experience
Cisco recommends that candidates have a good understanding of network security concepts and hands-on experience with Cisco security products before attempting the SCOR exam. Hands-on experience with Cisco firewalls, VPNs, and intrusion prevention systems; Knowledge of network security concepts such as access control, threat defense, and secure access; Familiarity with cloud security and content security technologies; Understanding of endpoint protection and detection mechanisms
The syllabus
What you’ll learn
Every domain and objective Cisco measures, with the weight they carry on the exam.
The official Cisco exam outline · checked 30 July 2026 · See the source
Security Concepts
- 1.1 Explain attack threats against on-premises, hybrid, and cloud environments such as viruses, trojans, DoS/DDoS, phishing, rootkits, man-in-the middle, malware, data breaches, insecure APIs, compromised credentials, PQC, and AI
- 1.2 Describe security vulnerabilities and exploits such as software bugs, weak and/or hardcoded passwords, OWASP top ten, missing encryption ciphers, buffer overflow, path traversal, cross-site scripting/forgery, SQL injection, and identification and prioritization using CVEs and CVSS scores
- 1.3 Describe vulnerabilities in AI/LLM models such as prompt injection, system prompt leakage, vector and embedding weaknesses, and supply chain
- 1.4 Describe the controls used to protect against phishing and social engineering attacks
- 1.5 Describe cryptography security components such as hashing, encryption, PKI, SSL, TLS, QUIC, MASQUE, IPsec, NAT-T IPv4 for IPsec, preshared key, certificate-based authorization, and post-quantum cryptography
- 1.6 Describe site-to-site and remote access VPN deployment types such as virtual tunnel interfaces, standards-based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN
- 1.7 Describe security intelligence authoring, sharing, and consumption
- 1.8 Describe zero trust architecture
- 1.9 Describe defense in depth strategy such as Secure Architecture for Everyone (SAFE)
- 1.10 Interpret scripts used to call security appliances APIs in a language such as Python
Network Security
- 2.1 Describe network security solutions and deployment models that provide intrusion prevention and firewall capabilities
- 2.2 Describe security monitoring and telemetry technologies
- 2.3 Configure network infrastructure security methods (network segmentation using VLANs or SGTs; Layer 2 and port security; DHCP snooping; Dynamic ARP inspection; storm control; and defenses against MAC, ARP, VLAN hopping, STP, and DHCP rogue attacks)
- 2.4 Select management options for network security solutions (single vs. multidevice manager, in-band vs. out-of-band, on-premises vs. cloud with Cisco Security Cloud Control)
- 2.5 Describe CIS benchmarks for hardening devices such as Cisco Secure Firewall (FTD) and Cisco IOS XE
- 2.6 Troubleshoot AAA for device and network access such as TACACS+ and RADIUS
- 2.7 Configure secure network management of perimeter security and infrastructure devices such as SNMPv3, NetConf, RestConf, APIs, secure syslog, and NTP with authentication
- 2.8 Implement access control policies, AVC, URL filtering, malware protection, and intrusion prevention using Cisco Secure Firewall (FTD)
- 2.9 Configure site-to-site and remote access VPN using Cisco Secure Firewall (FTD) and Cisco Secure Client
- 2.10 Troubleshoot VPN tunnel establishment on Cisco Secure Firewall (FTD)
Cloud Security
- 3.1 Describe security responsibility within common Cloud Shared Responsibility Models
- 3.2 Select security capabilities, deployment models, cloud security frameworks, and policy management to secure the cloud
- 3.3 Select security solutions for cloud environments (public; private; hybrid; community cloud; NIST 800-145 SaaS, PaaS, and IaaS; and Cloud Access Security Broker)
- 3.4 Describe network, application, and data security in cloud environments with solutions such as Cisco Multicloud Defense and Cisco Secure Workload
- 3.5 Configure Splunk to ingest cloud logging and monitoring data from other security solutions
- 3.6 Describe application and workload security concepts including eBPF
- 3.7 Describe DevSecOps (Infrastructure as Code security, CI/CD pipeline, container orchestration, and secure software development)
Secure Service Edge
- 4.1 Describe Security Service Edge (SSE) and Secure Access Service Edge (SASE)
- 4.2 Configure Cisco Secure Access Secure Internet Access
- 4.3 Configure Cisco Secure Access Secure Private Access
- 4.4 Configure data loss prevention and AI guardrails for secure internet access
- 4.5 Interpret Cisco Secure Access Investigate scores and indicators
Endpoint Protection and Detection
- 5.1 Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) solutions
- 5.2 Describe endpoint device management and asset inventory systems such as MDM
- 5.3 Describe endpoint posture assessment solutions to ensure endpoint security
- 5.4 Describe endpoint protection and detection security with solutions such as Cisco Secure Client and Cisco Secure Malware Analytics
- 5.5 Configure endpoint antimalware protection using Cisco Secure Endpoint
- 5.6 Interpret Cisco Secure Endpoint malware detection events
- 5.7 Configure email security features with Cisco Security Email Threat Defense
Network Access, Visibility, and Enforcement
- 6.1 Describe identity management and secure network access concepts such as guest services, profiling, posture assessment, and BYOD
- 6.2 Describe device compliance and application control
- 6.3 Configure network access control mechanisms such as 802.1X and MAB with Cisco Identity Services Engine
- 6.4 Configure network access with CoA
- 6.5 Explain exfiltration techniques such as DNS tunneling, HTTPS, email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and cloud storage
- 6.6 Describe network visibility and enforcement using telemetry and native AI/ML capabilities with XDR and SIEM/SOAR platforms such as Splunk and Cisco XDR
- 6.7 Describe Cisco Duo in a zero-trust security architecture (Trust Monitor, MFA, Device Trust, health checks, Adaptive Access policies, SSO, and CII)
- 6.8 Describe managing, orchestrating, and automating security information and events with Splunk
On the day
The exam itself
Everything Cisco publishes about sitting it, and nothing we inferred.
Prerequisites
No mandatory prerequisites — this certification has no required predecessor exam or credential.
Exam code350-701
CertificationCisco Certified Network Professional Security
Exam formatMultiple choice and multiple response
Duration120 minutes
DeliveryPearson VUE
LanguagesEnglish, Japanese
PricingUS $400
Certification levelProfessional
After you pass
Where this credential goes next
The path Cisco lays out, how the credential is kept, and where to book.
Step-by-step path to Cisco Certified Network Professional Security
Credential earnedCisco Certified Network Professional Security Professional level certification Renewal and maintenance
Cisco certifications are valid for three years. You can recertify by passing a qualifying exam or earning Continuing Education (CE) credits. Stay current with the latest technologies and maintain your certification.
Learn more about renewal requirements Lifecycle status
This certification is currently active and available. Cisco maintains this certification to validate current skills and industry relevance.
Exam status: ActiveMaintained by Cisco
Exam registration
Register for the exam through Pearson VUE, Cisco’s authorized testing partner.
Schedule your examVisit the official Cisco certification page for exam policies and requirements.
View the official pageYour coach
And when you are serious, your coach Pip takes over
Your coach in the app reads what you have answered with the book closed and tells you one thing to do tonight. It will not count an answer you gave with the page open, and it will tell you when you are not ready.
See how the coach worksBefore you book
Questions people ask
How does the 350-701 SCOR exam relate to the retired CCNP Security exams?
The 350-701 SCOR exam replaced the previous CCNP Security core exams, such as 300-206 SISAS and 300-208 SISF. It consolidates the core security topics into a single exam that is also the qualifying exam for CCNP Security and CCIE Security.
Do I need to earn a lower-level Cisco certification before taking the 350-701 SCOR exam?
No, there are no mandatory prerequisites for the 350-701 SCOR exam. However, Cisco recommends that candidates have a strong understanding of network security concepts and hands-on experience with Cisco security products.
Is the 350-701 SCOR exam available online?
Yes, the 350-701 SCOR exam is offered both online and at test centers. Online exams are proctored and require a reliable internet connection and a quiet, private testing environment.
What is the retake policy for the 350-701 SCOR exam?
If you fail the exam, you must wait 5 calendar days from the day after your attempt before retaking it. There is no limit on the number of attempts, but each attempt requires a new exam fee.
Can I use Cisco Learning Credits to pay for the 350-701 SCOR exam?
Yes, Cisco Learning Credits can be redeemed for exam vouchers that can be used to pay for the 350-701 SCOR exam.
Does the 350-701 SCOR exam include any hands-on or lab-based components?
No, the 350-701 SCOR exam is a written exam that consists of multiple-choice and multiple-response questions. It does not include a hands-on lab component.
What job roles does the CCNP Security certification map to?
The CCNP Security certification is designed for security engineers, network security architects, and security operations professionals who are responsible for designing, implementing, and managing security solutions.
Can I recertify my CCNP Security by passing a different Cisco exam?
Yes, you can recertify by passing any qualifying Cisco certification exam, including a higher-level exam like CCIE Security, or by earning Continuing Education credits.
How soon will I receive my score report after taking the 350-701 SCOR exam?
You will receive a score report immediately after completing the exam. The report includes your score for each exam section and the passing score for the exam.
Information freshness · Content last reviewed on 2026-07-30 Up to date
Practice free questions 1289 questions, free, no account needed.
The curriculum
The whole exam, mapped and written
Every domain, every objective, and every concept Cisco measures — each one written out.
6domains
47objectives
319concepts
273free pages
The domains, and what sits inside them
Every objective below is a page you can open and practise now, without an account.
The official Cisco exam outline · checked 30 July 2026 · See the source
1Security Concepts308 questions
1.1 Explain attack threats against on-premises, hybrid, and cloud environments such as viruses, trojans, DoS/DDoS, phishing, rootkits, man-in-the middle, malware, data breaches, insecure APIs, compromised credentials, PQC, and AI14 concepts · 9 pagesOpen →1.2 Describe security vulnerabilities and exploits such as software bugs, weak and/or hardcoded passwords, OWASP top ten, missing encryption ciphers, buffer overflow, path traversal, cross-site scripting/forgery, SQL injection, and identification and prioritization using CVEs and CVSS scores10 concepts · 8 pagesOpen →1.3 Describe vulnerabilities in AI/LLM models such as prompt injection, system prompt leakage, vector and embedding weaknesses, and supply chain4 concepts · 6 pagesOpen →1.4 Describe the controls used to protect against phishing and social engineering attacks7 concepts · 7 pagesOpen →1.5 Describe cryptography security components such as hashing, encryption, PKI, SSL, TLS, QUIC, MASQUE, IPsec, NAT-T IPv4 for IPsec, preshared key, certificate-based authorization, and post-quantum cryptography12 concepts · 7 pagesOpen →1.6 Describe site-to-site and remote access VPN deployment types such as virtual tunnel interfaces, standards-based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN6 concepts · 6 pagesOpen →1.7 Describe security intelligence authoring, sharing, and consumption8 concepts · 5 pagesOpen →1.8 Describe zero trust architecture6 concepts · 6 pagesOpen →1.9 Describe defense in depth strategy such as Secure Architecture for Everyone (SAFE)5 concepts · 6 pagesOpen →1.10 Interpret scripts used to call security appliances APIs in a language such as Python7 concepts · 5 pagesOpen →
2Network Security259 questions
2.1 Describe network security solutions and deployment models that provide intrusion prevention and firewall capabilities5 concepts · 5 pagesOpen →2.2 Describe security monitoring and telemetry technologies12 concepts · 9 pagesOpen →2.3 Configure network infrastructure security methods (network segmentation using VLANs or SGTs; Layer 2 and port security; DHCP snooping; Dynamic ARP inspection; storm control; and defenses against MAC, ARP, VLAN hopping, STP, and DHCP rogue attacks)12 concepts · 7 pagesOpen →2.4 Select management options for network security solutions (single vs. multidevice manager, in-band vs. out-of-band, on-premises vs. cloud with Cisco Security Cloud Control)5 concepts · 5 pagesOpen →2.5 Describe CIS benchmarks for hardening devices such as Cisco Secure Firewall (FTD) and Cisco IOS XE6 concepts · 6 pagesOpen →2.6 Troubleshoot AAA for device and network access such as TACACS+ and RADIUS11 concepts · 7 pagesOpen →2.7 Configure secure network management of perimeter security and infrastructure devices such as SNMPv3, NetConf, RestConf, APIs, secure syslog, and NTP with authentication5 concepts · 4 pagesOpen →2.8 Implement access control policies, AVC, URL filtering, malware protection, and intrusion prevention using Cisco Secure Firewall (FTD)6 concepts · 4 pagesOpen →2.9 Configure site-to-site and remote access VPN using Cisco Secure Firewall (FTD) and Cisco Secure Client6 concepts · 3 pagesOpen →2.10 Troubleshoot VPN tunnel establishment on Cisco Secure Firewall (FTD)7 concepts · 5 pagesOpen →
3Cloud Security189 questions
3.1 Describe security responsibility within common Cloud Shared Responsibility Models7 concepts · 6 pagesOpen →3.2 Select security capabilities, deployment models, cloud security frameworks, and policy management to secure the cloud5 concepts · 6 pagesOpen →3.3 Select security solutions for cloud environments (public; private; hybrid; community cloud; NIST 800-145 SaaS, PaaS, and IaaS; and Cloud Access Security Broker)5 concepts · 6 pagesOpen →3.4 Describe network, application, and data security in cloud environments with solutions such as Cisco Multicloud Defense and Cisco Secure Workload9 concepts · 6 pagesOpen →3.5 Configure Splunk to ingest cloud logging and monitoring data from other security solutions5 concepts · 5 pagesOpen →3.6 Describe application and workload security concepts including eBPF4 concepts · 6 pagesOpen →3.7 Describe DevSecOps (Infrastructure as Code security, CI/CD pipeline, container orchestration, and secure software development)4 concepts · 5 pagesOpen →
4Secure Service Edge133 questions
4.1 Describe Security Service Edge (SSE) and Secure Access Service Edge (SASE)5 concepts · 5 pagesOpen →4.2 Configure Cisco Secure Access Secure Internet Access6 concepts · 6 pagesOpen →4.3 Configure Cisco Secure Access Secure Private Access6 concepts · 6 pagesOpen →4.4 Configure data loss prevention and AI guardrails for secure internet access6 concepts · 6 pagesOpen →4.5 Interpret Cisco Secure Access Investigate scores and indicators5 concepts · 6 pagesOpen →
5Endpoint Protection and Detection188 questions
5.1 Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) solutions4 concepts · 5 pagesOpen →5.2 Describe endpoint device management and asset inventory systems such as MDM4 concepts · 5 pagesOpen →5.3 Describe endpoint posture assessment solutions to ensure endpoint security6 concepts · 6 pagesOpen →5.4 Describe endpoint protection and detection security with solutions such as Cisco Secure Client and Cisco Secure Malware Analytics5 concepts · 4 pagesOpen →5.5 Configure endpoint antimalware protection using Cisco Secure Endpoint8 concepts · 6 pagesOpen →5.6 Interpret Cisco Secure Endpoint malware detection events8 concepts · 7 pagesOpen →5.7 Configure email security features with Cisco Security Email Threat Defense9 concepts · 6 pagesOpen →
6Network Access, Visibility, and Enforcement212 questions
6.1 Describe identity management and secure network access concepts such as guest services, profiling, posture assessment, and BYOD5 concepts · 6 pagesOpen →6.2 Describe device compliance and application control3 concepts · 3 pagesOpen →6.3 Configure network access control mechanisms such as 802.1X and MAB with Cisco Identity Services Engine7 concepts · 5 pagesOpen →6.4 Configure network access with CoA7 concepts · 5 pagesOpen →6.5 Explain exfiltration techniques such as DNS tunneling, HTTPS, email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and cloud storage9 concepts · 7 pagesOpen →6.6 Describe network visibility and enforcement using telemetry and native AI/ML capabilities with XDR and SIEM/SOAR platforms such as Splunk and Cisco XDR7 concepts · 7 pagesOpen →6.7 Describe Cisco Duo in a zero-trust security architecture (Trust Monitor, MFA, Device Trust, health checks, Adaptive Access policies, SSO, and CII)8 concepts · 6 pagesOpen →6.8 Describe managing, orchestrating, and automating security information and events with Splunk8 concepts · 6 pagesOpen →
Not a table of contents
Every line on this map already opens
In front of every objective the practice pages are already there, free and without an account. This is one objective, opened.
1.1 Explain attack threats against on-premises, hybrid, and cloud environments such as viruses, trojans, DoS/DDoS, phishing, rootkits, man-in-the middle, malware, data breaches, insecure APIs, compromised credentials, PQC, and AI9 pagesOpen →
Free in front of it
45 questions on this objective, five to a page. Every range above is a real page, open now, with no account.
Reading the map is not the same as knowing the ground
The curriculum tells you what is on the exam. Proving you know it is a different job — and it is the one the closed-book run does.
Free questions
1289 questions. No account, no card.
The whole bank is open. 5 questions to a page, every answer explained, and a discussion thread on each one.
1289questions
273pages
47objectives
Freealways
Browse by domain
Every objective, and every page range, is a link — so you can pick up exactly where you left off.
1Security Concepts308 questions
2Network Security259 questions
3Cloud Security189 questions
4Secure Service Edge133 questions
5Endpoint Protection and Detection188 questions
6Network Access, Visibility, and Enforcement212 questions
What a practice page gives you
1Five to a page
Short enough to finish, long enough to matter.
2Every answer explained
Not only which one is right — why the others are wrong.
3A discussion on each
Ask, answer, and vote. Every question has its own thread.
A question, and the idea behind it
Every question comes from a concept
These are not trivia. Each one is written against a concept in the book, so when you get one wrong there is somewhere to go and find out why.
The visual book
See it once. Carry it into the exam.
The pages shown here come from our AI-900 book — an example of how each concept is written in plain language and, where the idea needs one, drawn as a full page you can take in at a glance.
319concepts
1289free questions
Why a picture, and not another paragraph
Three reasons, and each one is a real finding rather than a slogan.
You can see it againThe whole idea at onceWhere it starts, what happens in the middle, what comes out, and the mistake to avoid.
Multimedia principle · MayerThe look-alikes sit togetherThe pairs the exam tests are drawn side by side, so the difference is seen, not told.
Dual coding · PaivioWhat one page is made of
You are never asked to read a poster here — only to see how one is built. After that, every other page is legible at a glance.
1A numbered strip on top
The idea as a sequence, followed with a finger before a word is read.
2Panels for the parts
What it is, how the machine learns it, when it is the right tool.
3The trap, framed
The distinction the exam tests, given its own box instead of buried in prose.
4One line at the bottom
The sentence to carry into the exam room.
Open book, on purpose
Answer it with the picture beside you
This is the part that teaches. The illustration and the written explanation stay where they are while you work, so a scenario stops being a memory test and becomes something you can simply look at.
It teaches · it does not count
A smartphone uses AI to unlock when the owner looks at the camera. Which AI capability is being used?
AImage classification
BFacial recognition
COptical character recognition
DObject detection
Look at the five steps. Detect finds a face, align straightens it, encode turns it into numbers, search compares it with a stored face, and decide answers one question: is this the same person? Classification would only say “a face”. Detection would only draw a box. Neither decides whose.
Then the page shuts, and it starts counting
The same questions come back with the book closed — that run is the one that counts. After it, your coach picks one thing for tonight, sized to the time you have, and brings pages back before you lose them.
Testing effect · Roediger & Karpicke 2006 · spacing effect · Cepeda et al. 2006
Official resources
Straight from Cisco
Where the exam is defined, scheduled and scored.
3official links
319concepts mapped
The source
Cisco’s own pages
We link to them rather than repeat them, so nothing here goes stale behind them.
Checked against the source
Every objective on the official Cisco outline already has questions here
We build from the official skills outline, not from a summary of it — 47 objectives, 319 concepts written under them, and free questions against every one. When Cisco changes the outline, this page changes with it.
47objectives on the outline→319concepts written→1289free questions
An official page tells you what will be asked. It cannot tell you what you will get right.
That is the only question worth answering the night before, and no link answers it. You answer it by taking the questions with the book closed, and seeing what comes back.