What does 350-901 AUTOCOR certify?

350-901 AUTOCOR certifies that you can design, deploy and manage network automation systems on Cisco platforms, covering infrastructure as code, operations and AI in automation. Cisco states on its official AUTOCOR exam page that passing it earns the Cisco Certified Automation Specialist Core certification in its own right, and that it satisfies the core requirement for both CCNP Automation and CCIE Automation.

The technologies in scope are broad and specifically named: Cisco IOS XE, Cisco ACI, Cisco Meraki, Cisco Catalyst Center, Cisco SD-WAN, Cisco Identity Services Engine and Webex Messaging. That list matters because it means no single platform specialism carries you. A candidate who automates only Catalyst Center will meet ACI and SD-WAN questions they have never touched.

The underlying skill the exam is testing is systems design rather than scripting. Almost every objective begins with “construct”, “implement” or “diagnose”, and the scenarios describe a requirement plus a constraint rather than a syntax problem.

How is the AUTOCOR exam delivered and scored?

AUTOCOR is a 120 minute exam costing $400 USD, delivered through Pearson VUE in English and Japanese, with no prerequisite and a credential valid for three years. Cisco grades it pass or fail with results available online within 48 hours, and publishes no percentage or scaled pass mark anywhere.

Ninety to 110 questions in 120 minutes is between 65 and 80 seconds each, which is the tightest pacing of any Cisco core exam at this price point. The question count is a range rather than a fixed number, so you cannot plan around a specific total, and a long scenario item eats the budget for two short ones. Working through a 350-901 practice test under a clock is the only way to find out whether you read code fast enough for that budget.

The absence of a published pass mark is worth taking seriously. Cisco reports the outcome and nothing else, so there is no domain breakdown to learn from after a failure, and no threshold to aim at beyond being comfortably clear.

How are the four domains weighted?

AUTOCOR publishes four domains with weightings: Network Automation at 30 percent, Infrastructure as Code at 30 percent, Operations at 20 percent and AI in Automation at 20 percent. The top two are equal, and the bottom two are equal, which produces an unusually balanced paper.

On a paper of 90 to 110 questions, each 30 percent domain is worth roughly 27 to 33 questions and each 20 percent domain roughly 18 to 22. There is no small domain here. The weakest of the four still carries about a fifth of the paper.

Why does Infrastructure as Code carry as much weight as Network Automation?

Infrastructure as Code matches Network Automation at 30 percent because Cisco is testing the delivery pipeline as seriously as the automation itself. Writing a playbook is one skill; getting it reviewed, merged, validated, deployed and rolled back through a pipeline is a different one, and the syllabus spends its largest single block of detail on the second.

The Git objectives are unusually specific. Cisco names merge with squash and conflict resolution, cherry-pick, reset, checkout and revert individually, which means the exam expects you to know what each one does to history rather than to recognise the word. The pipeline objectives are equally concrete: diagnose a GitLab CE failure caused by a missing dependency, an incompatible version or a failed test, and construct a pipeline with build, prevalidation, deploy and post-validation stages.

The four ways in on the automation side

Network Automation names four distinct routes to the same outcome, and the exam asks you to pick between them. Each manages the same example configurations: VLANs, OSPF, asset management, interface settings and ACLs.

• Ansible playbooks, for agentless push based configuration management
• Terraform, for declarative state managed infrastructure
• RESTCONF against a YANG model, defined by RFC 8040, which the syllabus cites by number
• Python, for custom applications that neither framework covers

A separate objective then asks you to select between them, weighing an infrastructure as code framework against a low code or no code option against a custom application. That selection question is the one candidates prepare for least and meet most.

AI in Automation is 20 percent, and it is not theory

The AI in Automation domain has five objectives, and only two of them are descriptive. The other three ask you to build or to judge: construct an MCP server that supplies network information to an AI agent using Python FastMCP, construct a conversational agent that uses language models for network automation, and evaluate the accuracy of AI recommendations on an automation solution.

The descriptive pair is narrower than it looks. One asks for the benefits and risks of AI-assisted code development, naming data privacy, intellectual property ownership and code validation specifically. The other asks you to interpret the security risks in a given AI-based automation solution, which is a scenario question rather than a list.

Two things follow for preparation. First, the accuracy evaluation objective implies the exam expects you to treat model output as a proposal to be verified rather than an answer, which is the same discipline the change validation objective applies to pyATS. Second, and more practically, an MCP server is a small, concrete artefact. Building one is an afternoon of work and it converts an abstract domain into something you have actually done.

What happened to DEVCOR on this exam number?

350-901 previously carried DEVCOR, the core exam for CCNP DevNet, which was an application development syllabus. The number now carries AUTOCOR version 2.0, the core exam for CCNP Automation, and the subject matter has moved substantially toward network automation, pipelines and AI.

Anyone holding older study material should treat the code as unreliable and check the domain names instead. Search demand has not caught up either: people still look for DEVCOR exam topics, and what they find under that name describes a syllabus that no longer matches the exam booked against this number. Our earlier 350-901 DEVCOR study guide remains a useful record of what the previous syllabus covered, which is exactly what you need if you are working out how much of your existing preparation still counts.

Some of it does. API consumption, Python, secure coding practices and version control were all present in the old syllabus and are all present in the new one. What is genuinely new is the Terraform and Ansible material, the GitLab pipeline detail, Cisco Modeling Labs, pyATS change validation and the whole AI domain.

How does the CCNP Automation track fit together?

CCNP Automation is earned by passing the core exam plus one concentration exam, and every exam passed also earns a specialist certification on its own. AUTOCOR is the core; the concentrations Cisco publishes on its CCNP Automation page are 300-435 ENAUTO for enterprise and 300-635 DCNAUTO for data centre, each $300 USD over 90 minutes with no prerequisite and the same three year validity.

The concentration exams have moved in the same direction as the core. Cisco’s descriptions of both now name AI in Automation alongside their traditional subject matter, so the AI material is a track wide change rather than a quirk of the core exam. Our guide to 300-435 ENAUTO preparation covers the enterprise concentration in detail.

One planning note. Because AUTOCOR also satisfies the CCIE Automation core requirement and counts toward recertification, passing it does more work than a single credential suggests. If you hold other Cisco professional certifications approaching expiry, the timing of this exam is worth thinking about alongside the certification itself.

How should you prepare for AUTOCOR?

AUTOCOR rewards building over reading, because almost every objective is phrased as construct, implement or diagnose. A network engineer with scripting experience should plan eight to ten weeks; someone coming from a pure routing and switching background should plan longer and start with Python.

1. Build the same small change, adding a VLAN and an ACL, four separate times: once in Ansible, once in Terraform, once through RESTCONF against the YANG model, and once in plain Python
2. Put all four into Git and practise the named operations deliberately, squashing a merge, resolving a conflict, cherry-picking a commit and reverting one, so the difference between reset and revert is experiential
3. Construct a GitLab CE pipeline with all four stages the syllabus names, then break it on purpose with a missing dependency and a failing test so the diagnosis objective is familiar
4. Build a topology in Cisco Modeling Labs and run the pipeline against it, adding pyATS change validation as the post-validation stage
5. Work through the Operations domain next, implementing logging to syslog and to a webhook, and walking through obtaining and deploying a CA-signed TLS certificate
6. Finish with the AI domain by constructing an MCP server with Python FastMCP and a conversational agent over it, then sit timed sets until a hundred questions inside 120 minutes is routine

Step one is the highest value exercise on the list. Doing the identical change through four different mechanisms is precisely what the selection objective tests, and it is the only way to develop a genuine opinion about which approach suits which constraint.

Frequently Asked Questions

What certification does 350-901 AUTOCOR lead to?

Passing it earns the Cisco Certified Automation Specialist Core certification on its own, and it satisfies the core exam requirement for both CCNP Automation and CCIE Automation. Cisco also allows it to count toward recertification.

How many questions are on the AUTOCOR exam?

The money site’s syllabus page gives a range of 90 to 110 questions within the 120 minutes Cisco publishes. Cisco itself states the duration but not the question count, so the range is not an official figure.

What is the passing score for 350-901?

Cisco publishes none. It states that grading is pass or fail with results available online within 48 hours. The money site estimates roughly 750 to 850 on a 1000 point scale, which should be treated as a planning figure rather than a Cisco number.

How much does the AUTOCOR exam cost?

$400 USD, or the equivalent in Cisco Learning Credits. The two concentration exams in the same track, ENAUTO and DCNAUTO, are $300 USD each.

Is there a prerequisite for 350-901 AUTOCOR?

No. Cisco publishes no prerequisite for the core exam or for either concentration exam in the Automation track.

How long is the certification valid?

Three years. The exam can also be used toward recertification of other Cisco professional level credentials.

Which AUTOCOR domain carries the most marks?

Two domains tie at 30 percent each, Network Automation and Infrastructure as Code. Operations and AI in Automation follow at 20 percent apiece, so the smallest domain still carries about a fifth of the paper.

Does 350-901 really test AI?

Yes, and not only as theory. Three of the five objectives in the AI in Automation domain ask you to construct an MCP server using Python FastMCP, construct a conversational agent using language models, or evaluate the accuracy of AI recommendations.

Is AUTOCOR the same exam as DEVCOR?

No. The exam number is the same but the syllabus is not. DEVCOR was the application development core for CCNP DevNet; AUTOCOR version 2.0 is the network automation core for CCNP Automation. API work, Python, secure coding and version control carried over; Terraform, Ansible, GitLab pipelines, Cisco Modeling Labs, pyATS and the AI domain did not exist on the old syllabus.

Which languages is the exam available in?

English and Japanese, according to Cisco’s own exam page.

Conclusion

AUTOCOR is a build exam with an unusually even shape: 120 minutes, 90 to 110 questions, $400 USD, no prerequisite, three year validity, and four domains weighted 30, 30, 20 and 20 percent. Cisco grades it pass or fail and publishes no threshold, so the target is comfortable rather than borderline.

Treat the exam number with suspicion and the domain names as the truth, because 350-901 no longer means what most published material says it means. Then build: the same change through Ansible, Terraform, RESTCONF and Python, a pipeline that deploys it, a simulation that tests it, and an MCP server that lets an agent ask about it. Six of those artefacts cover most of a paper where almost every objective starts with the word construct.

What Does the 300-215 CBRFIR Exam Cover?

300-215 CBRFIR covers five weighted domains: fundamentals, forensics techniques, incident response techniques, forensics processes and incident response processes. The split runs roughly half forensics and half incident response, with the fundamentals domain supplying the shared groundwork of root cause analysis, anti-forensic tactics, encoding and obfuscation, and YARA rules.

Read the domain names together and the exam’s design becomes obvious. Cisco separates techniques from processes in both disciplines. Techniques are what you do with a tool or a log. Processes are the sequence, the decision and the documentation around it. A candidate who is fluent with Volatility and hopeless at writing an incident response playbook will lose 30 percent of the paper.

Where the Cisco products come in

The objectives name Cisco Umbrella, Cisco Secure Endpoint, Cisco Secure Network Analytics, PX Grid, Cisco XDR, Firepower and ThreatGrid. They appear as sources of evidence and as places to apply a mitigation, not as products to configure. This is not a deployment exam, and nobody is being asked to build a policy set.

One objective covers gathering evidence from virtualised environments at the major cloud vendors, which is the part of the syllabus most likely to catch out an experienced responder whose experience is entirely on premises.

What Are the 300-215 Exam Details?

300-215 CBRFIR is 55 to 65 questions in 90 minutes, priced at 300 US dollars and delivered through Pearson VUE. Cisco publishes the current revision as version 1.2 and offers the exam in English. The passing score is variable rather than fixed, sitting at roughly 750 to 850 on a 1000 point scale.

The variable cut score is worth understanding rather than worrying about. Cisco does not publish a fixed number for this exam, because the threshold moves with the form of the paper a candidate receives. Planning around the top of the published range is the safe approach, and Cisco’s own CBRFIR exam page confirms the version and the duration.

Ninety minutes across up to 65 questions leaves under 90 seconds each. Several objectives ask you to interpret a provided artefact, a code snippet or a log extract, and those take longer than a recall question, so the pace matters.

Which CBRFIR Domain Carries the Most Marks?

Incident response techniques carries 30 percent, half as much again as any other domain on the paper. Fundamentals and forensics techniques take 20 percent each, and the two process domains take 15 percent each. So a third of the exam sits in a single domain about interpreting alerts and recommending what to do next.

That 30 percent domain is also the one with the longest objective list, and its verbs are all recommendation verbs. It asks what you would recommend for a zero day exploitation, what response an intelligence artefact justifies, and which Cisco solution detects or prevents a given behaviour. Recall alone will not get you through it.

Because the exam presents artefacts and asks for a judgement, the fastest way to find out whether your reasoning matches Cisco’s is to sit questions in the same shape. A 300-215 practice test built to the blueprint gets you there faster than re-reading the objectives.

Which Tools Does the CBRFIR Blueprint Name?

Cisco names specific tools in the objectives rather than describing tool categories. Hex editors HxD, Hiew and Hexfiend. Disassemblers and debuggers Ghidra, Radare and Evans Debugger. Deobfuscation utilities XORBruteForces, xortool and unpacker. Volatility, Sysinternals, SIFT tools and TCPdump for analysis. Wireshark and NetFlow for traffic. Plus objdump for binaries.

The verbs matter here. Most of these objectives say describe or recognise rather than perform, which tells you the exam wants informed familiarity rather than deep reverse engineering skill. Knowing that Ghidra decompiles and that Volatility works on memory images is closer to what is being asked than being able to unpack a packer under time pressure.

Two named resources are worth working with directly, because they sit inside objectives rather than beside them. The Volatility Foundation repository is the reference for the memory forensics half, and enterprise attack tactics is the framework the fileless malware objective explicitly points to.

How Much Scripting Does the Exam Expect?

One objective asks candidates to construct Python, PowerShell and Bash scripts that parse and search logs or multiple data sources, naming Cisco Umbrella, Cisco Secure Endpoint, Cisco Secure Network Analytics and PX Grid as those sources. Another asks you to determine the type of code from a provided snippet. Scripting is therefore examinable content, not an assumed background skill.

The realistic level is reading fluency plus basic construction. You need to look at a snippet and know whether it is PowerShell or Bash, understand what a parsing loop is doing, and reason about how you would pull indicators out of a log source. Nobody is compiling anything.

That said, the combination of three languages and several Cisco data sources is unusual breadth for a single objective. A responder who works entirely in one shell should spend deliberate time on the other two rather than assuming the syntax will be recognisable on sight.

What Do the Two Incident Response Domains Ask For?

Together they are 45 percent of the paper. Incident response techniques, at 30 percent, is about interpreting evidence and recommending action. Incident response processes, at 15 percent, is about the framework around that action: the goals of incident response, what belongs in a playbook, how to read a ThreatGrid report, and how threat intelligence arrives in STIX and TAXII formats.

The techniques domain reads like a shift in a SOC. Interpret SIEM, IDS and syslog alerts. Decide what to correlate based on whether the incident is host-based or network-based. Work out the attack vector and recommend a mitigation. Recommend a response to a zero day. Build a threat actor profile from intelligence artefacts.

Why the process domain is the one people skip

Playbook structure and intelligence formats feel like paperwork next to memory forensics, and they are worth 15 percent. STIX and TAXII in particular are easy marks for anyone who spends an hour on them and guaranteed losses for anyone who does not, because they are specific named formats rather than a concept you can reason your way to.

The ThreatGrid objective is similarly concrete. It asks you to evaluate the relevant components of a report, which means knowing what such a report contains rather than holding an opinion about sandboxing.

How Does 300-215 Fit Into CyberOps Professional?

CyberOps Professional requires a core exam plus one of two concentration exams. The core is 350-201 CBRCOR, Performing CyberOps Using Cisco Security Technologies. The two concentrations are 300-215 CBRFIR, this exam, and 300-220 CBRTHD, the threat hunting exam. Passing the core plus either concentration earns the certification, which Cisco says is valid for three years.

The choice between the two concentrations is a choice between two jobs rather than two difficulty levels. Forensics and incident response is reactive work: something happened, and you establish what, how, and what to do about it. Threat hunting is proactive: nothing has alerted, and you go looking anyway.

If you are weighing them up, our Cisco threat hunting exam breakdown covers the other side of that decision in the same detail. Cisco’s own CyberOps Professional page sets out the recertification options, which run on Continuing Education credits as well as on retaking exams.

How Should You Prepare for the CBRFIR Exam?

Preparation should be led by the weightings and by the unusual specificity of the objectives. With 45 percent of the paper on incident response and a named tool list to work through, the plan is closer to a checklist than to a reading course. Cisco publishes no prerequisite, though the exam assumes real security operations experience.

1. Start with incident response techniques, the 30 percent domain, and practise turning an alert into a recommended mitigation rather than only into an explanation.
2. Work through the named tool list category by category, confirming you can say what each tool is for and what its output looks like, since most objectives use describe and recognise rather than perform.
3. Spend an hour each on STIX, TAXII and YARA, because they are specific named formats where an hour of reading converts directly into marks.
4. Read snippets in Python, PowerShell and Bash until you can identify the language on sight and explain what a parsing loop is extracting.
5. Practise pulling evidence from a virtualised environment at one of the major cloud providers, which is the objective most likely to be outside an on premises responder’s experience.
6. Learn the structure of an incident response playbook and of a ThreatGrid report, since the 15 percent process domain rewards knowing their components.
7. Map a handful of real intrusions onto attack tactics and techniques so the framework is a way of thinking rather than a list you have read.
8. Sit timed practice at under 90 seconds a question, because the artefact-based items are slower than recall items and the clock is the constraint.

Anyone still building the underlying knowledge should sit the associate exam first. Our CyberOps Associate study guide covers the foundations this exam assumes you already hold.

Frequently Asked Questions

How many questions are on the 300-215 CBRFIR exam?

Between 55 and 65 questions in 90 minutes. Cisco publishes the duration on its own exam page; the question range comes from the exam syllabus, and it leaves under 90 seconds per item at the top of the range.

What is the passing score for CBRFIR?

There is no fixed cut score. The passing mark is variable, sitting at approximately 750 to 850 on a 1000 point scale, so planning around the upper end of that range is the safe approach.

How much does the 300-215 exam cost?

300 US dollars, booked through Pearson VUE. Local taxes and currency conversion apply depending on where the appointment is scheduled.

Which CBRFIR domain is worth the most?

Incident response techniques at 30 percent. Fundamentals and forensics techniques are 20 percent each, and the two process domains are 15 percent each, so a third of the paper sits in one domain.

Do you need to know Ghidra and Volatility for the exam?

Both are named in the objectives, but the verbs are describe and recognise rather than perform. You need to know what each tool does and what its output looks like, not to reverse engineer malware under exam conditions.

Is scripting tested on 300-215?

Yes. One objective asks you to construct Python, PowerShell and Bash scripts that parse and search logs across Cisco data sources, and another asks you to identify the type of code from a provided snippet.

What is the difference between 300-215 and 300-220?

They are the two CyberOps Professional concentration exams. 300-215 covers reactive forensic analysis and incident response; 300-220 covers proactive threat hunting. Either one, plus the core exam, earns the certification.

Which core exam pairs with CBRFIR?

350-201 CBRCOR, Performing CyberOps Using Cisco Security Technologies. CyberOps Professional needs that core exam plus one of the two concentration exams.

How long does CyberOps Professional stay valid?

Three years. Cisco allows renewal through Continuing Education credits or by retaking qualifying exams before the certification expires.

Does CBRFIR cover cloud forensics?

Partly. One fundamentals objective covers the issues around gathering evidence from virtualised environments at the major cloud vendors, which is often the least familiar area for responders with on premises experience.

Conclusion

An exam that names XORBruteForces and Hexfiend in its objectives is telling you something about how it will be marked. This is not a blueprint you can satisfy with general DFIR knowledge and a strong tool of your own choosing.

Work it in the order the weightings imply. Incident response techniques is 30 percent and the whole domain is about recommending an action, so practise turning evidence into a decision rather than into a description. Add the two process domains next, because playbook structure, ThreatGrid report components, STIX and TAXII are 15 percent of specific, learnable content that candidates routinely leave until last and then skip. Then work the named tool list on its own terms, remembering that the objectives mostly ask you to recognise rather than to operate. With under 90 seconds a question and several artefact-based items, timed practice is what turns familiarity into a pass.

What Are the SPCOR Exam Topics?

The SPCOR exam topics cover five areas: service provider architecture, networking, MPLS and segment routing, services, and automation and assurance. Together they describe a carrier network end to end, from the transport technologies underneath it through the routing and label plane to the services carried over it and the telemetry watching all of it.

The architecture domain sets the vocabulary for everything else. It names core architectures including Metro Ethernet, MPLS, unified MPLS, segment routing, SR traffic engineering and SRv6; transport technologies including xDSL, DWDM, DOCSIS, TDM and xPON; mobility covering packet core and RAN transport for 5G vRAN and ORAN; and the routed optical network model.

Two things sit inside architecture that candidates often expect elsewhere. Cisco network software architecture is here, meaning IOS, IOS XE and IOS XR as three distinct operating systems rather than three badges on the same thing. So is quality of service architecture, including the MPLS QoS models pipe, short pipe and uniform, the traffic engineering models, DiffServ and IntServ, trust boundaries between enterprise and provider, and the IPv6 flow label.

Control plane security also lands in architecture rather than in a security domain, covering protection techniques such as LPTS and control plane policing. That placement tells you Cisco treats it as a property of how the network is built, not as an add-on.

How Are the Five 350-501 Domains Weighted?

350-501 splits into Networking at 30 percent, MPLS and Segment Routing at 20 percent, Services at 20 percent, Architecture at 15 percent, and Automation and Assurance at 15 percent. Networking is the single largest domain, and the label plane and services domains together match it exactly.

The distribution rewards breadth. With the largest domain at 30 percent and the smallest two at 15 each, there is no single area you can protect at the expense of the rest. An engineer strong in routing but blank on automation is giving away 15 percent before the exam starts, and that is on a paper where the pass mark moves.

Rehearsing against SPCOR sample questions is the fastest way to find which of the five is thinnest, because the gap usually shows as slow answers rather than wrong ones.

What Are the 350-501 Exam Details?

350-501 runs for 120 minutes and costs 400 US dollars, delivered through Pearson VUE. The published item count is 90 to 110 questions, and the pass mark is variable rather than fixed, landing somewhere around 750 to 850 out of 1000 depending on the form you receive.

Do the arithmetic on the timing and the pressure becomes obvious. At the top of the range, 110 questions in 120 minutes is roughly 65 seconds each. That is not enough time to reason a configuration out from first principles, which means the material has to be recall-fast rather than merely understood.

The variable pass mark deserves a word. Cisco does not publish a fixed percentage, and the scoring is adjusted for the difficulty of the particular form. In practice that means you cannot calculate a target number of correct answers in advance, and aiming for the top of the published band is the only safe planning assumption.

Why Does One Exam Award Two Certifications?

Cisco restructured its programme so that core exams stand alone. Passing 350-501 awards the Cisco Certified Specialist for Service Provider Core outright, and that credential is valid for three years. It also serves as the core half of CCNP Service Provider, which you complete by adding one concentration exam of your choice.

Cisco sets this structure out on its own CCNP Service Provider page, which lists the concentration options including SPRI, SPVI and SPCNI. The choice of concentration is genuinely yours, and it is worth making it deliberately rather than picking whichever is scheduled soonest.

The practical consequence is a sequencing decision. Because the specialist credential lands the moment you pass SPCOR, you get something demonstrable on a CV without waiting for the second exam. That matters if you are certifying under a deadline, or if your employer funds one exam at a time.

It also means a failed concentration attempt does not leave you with nothing. The core certification stands on its own, so the risk profile of the track is front-loaded rather than all-or-nothing.

What Does the Networking Domain Cover at Thirty Percent?

Networking is the largest domain at 30 percent and covers the routing plane a service provider actually operates: interior gateway protocols at carrier scale, BGP as the inter-domain protocol, route policy, multicast, and the high availability and convergence behaviour that separates a provider network from an enterprise one.

Scale is the difference that catches enterprise engineers. The protocols are the ones you already know, but the questions assume a topology where a full table is normal, where route reflection is structural rather than optional, and where convergence time has a contractual meaning. Knowing how a protocol works is table stakes; knowing how it behaves at provider scale is the exam.

Why this domain decides the outcome

At 30 percent, networking is roughly a third of the paper on its own. It is also the domain the other four lean on: segment routing runs over an IGP, services ride on the routing plane, and assurance measures it. Candidates who under-prepare here tend to lose marks in three domains rather than one, which is why it is worth the largest share of study time as well as the largest share of questions.

How Much Segment Routing Is on the Exam?

MPLS and Segment Routing is a full 20 percent domain, and segment routing is named directly in the architecture domain as well, appearing as SR, SR traffic engineering and SRv6 among the core architectures. It is not an emerging topic on this syllabus. It is examined as current practice alongside classic MPLS.

The two label planes coexist in the objectives for a reason: real carrier networks are mid-migration. You are expected to reason about unified MPLS and about segment routing, and to understand why an operator would move from one to the other. The architecture that underpins it is defined by the IETF in RFC 8402, which is worth reading once properly rather than absorbing second hand.

SRv6 is the part most likely to be unfamiliar. It replaces the MPLS label stack with IPv6 addressing, which changes how you think about the forwarding plane rather than merely swapping an encapsulation. Treating it as MPLS with different syntax is the standard mistake.

Traffic engineering ties the domain together. The QoS models named in architecture, including MAM, RDM, CBTS, PBTS and differentiated services traffic engineering, are the mechanisms by which labelled paths get the treatment they were designed for, so the two domains are best studied against each other.

What Do Services and Automation Actually Test?

Services is 20 percent and covers what the carrier sells over the network it has built: Layer 2 and Layer 3 VPNs, Ethernet services, and the quality of service treatment that makes those services contractually meaningful. Automation and Assurance is 15 percent and covers programmability and the telemetry that proves the network is behaving.

Services is where architecture stops being abstract. A VPN is a set of decisions about the label plane, the routing plane and the QoS policy, all at once, and the questions tend to present a customer requirement and ask which combination delivers it. That is a design question wearing an implementation costume.

Automation is not optional at 15 percent

Fifteen percent is roughly fifteen questions at the middle of the item range, which is more than enough to decide a pass. The domain covers model-driven programmability and the interfaces that make it possible, and the foundational protocol is defined by the IETF in RFC 6241, the NETCONF specification. Assurance sits alongside it, covering the telemetry that turns a configured network into an observed one.

Engineers from a purely CLI background find this domain the hardest, not because it is conceptually difficult but because it is unfamiliar territory. It is also the domain where a few hours of deliberate lab time converts most directly into marks.

How Should You Prepare for 350-501?

Preparation for 350-501 works best when it follows the dependency order of the domains rather than their published order. Architecture supplies the vocabulary, networking supplies the plane everything else runs on, the label plane sits on top of that, services ride the label plane, and assurance observes the whole thing.

1. Read the architecture domain first as a glossary, making sure every named transport, core architecture and QoS model means something concrete to you before moving on.
2. Give networking the largest single block of study time, working the routing protocols at provider scale rather than at enterprise scale, with route policy and convergence behaviour treated as first-class topics.
3. Take MPLS and segment routing together, building both label planes in a lab and migrating a path from one to the other so the difference is something you have done rather than read.
4. Layer services on top of that lab, configuring Layer 2 and Layer 3 VPNs over the paths you just built and applying the QoS models from the architecture domain to them.
5. Finish with automation and assurance, driving a device through a model-driven interface and streaming telemetry from it, then run a full timed rehearsal at 120 minutes.

Because the pass mark is variable and the item count reaches 110, pace matters as much as coverage. A structured plan helps here, and our SPCOR study plan lays out a phased approach for candidates working around a full-time role.

Once the core is behind you, the concentration choice is the next decision, and it shapes what the CCNP actually says about you. The Cisco service provider track overview covers how the concentration exams differ and which suits which role.

Frequently Asked Questions

What does SPCOR stand for?

Service Provider Core. The full exam name is Implementing and Operating Cisco Service Provider Network Core Technologies, and the exam code is 350-501. It is the core exam of the CCNP Service Provider track.

How many questions are on the 350-501 exam?

Between 90 and 110 questions in 120 minutes. At the top of that range you have roughly 65 seconds per question, which leaves no room to work an answer out slowly from first principles.

What is the passing score for SPCOR?

Variable rather than fixed, landing approximately between 750 and 850 out of 1000. Cisco adjusts the mark for the difficulty of the individual exam form, so you cannot calculate a target number of correct answers in advance.

How much does the 350-501 exam cost?

Four hundred US dollars, or the equivalent in Cisco Learning Credits. Booking runs through Pearson VUE in the usual way, with test centre and online proctored options available.

Which SPCOR domain carries the most marks?

Networking, at 30 percent. MPLS and Segment Routing and Services each carry 20 percent, while Architecture and Automation and Assurance carry 15 percent each.

Does passing SPCOR give you a certification on its own?

Yes. Passing 350-501 awards the Cisco Certified Specialist for Service Provider Core, which is valid for three years and stands independently of whether you go on to complete the CCNP.

What else is needed for CCNP Service Provider?

One concentration exam of your choice alongside the core. Cisco lists several options including SPRI, SPVI and SPCNI, so the concentration is where you choose what the credential says about your specialism.

Is segment routing on the SPCOR exam?

Yes, extensively. It appears in the dedicated MPLS and Segment Routing domain at 20 percent, and again in the architecture domain where SR, SR traffic engineering and SRv6 are named among the core architectures.

Does SPCOR cover automation?

Yes. Automation and Assurance is a full 15 percent domain covering model-driven programmability and telemetry, which is roughly fifteen questions at the middle of the item range and easily enough to decide a pass.

Which operating systems does the exam cover?

IOS, IOS XE and IOS XR. The architecture domain treats Cisco network software architecture as an examinable topic, so the differences between the three platforms are inside scope rather than background.

Conclusion

The SPCOR exam topics describe a carrier network from transport to telemetry, and the weighting spreads across all five domains rather than concentrating in one. Networking takes 30 percent, the label plane and services take 20 each, and architecture and automation take 15 apiece. Between 90 and 110 questions in 120 minutes, at a pass mark that moves.

Study in dependency order rather than published order, build both label planes in a lab instead of reading about them, and give automation the hours it deserves rather than the hours it feels like it deserves. Pass it and you have a specialist certification in hand before you have chosen a concentration at all.

What Does Passing 400-007 Actually Earn You?

Three things rather than one. Cisco states that passing 400-007 earns the Cisco Certified Specialist – Design Core credential in its own right, that it can be used to meet the core exam requirements for the Cisco Certified Design Expert certification, and that it can be used toward recertification goals. All three follow from the same sitting.

The specialist credential is the one most candidates do not realise they are buying. It is a standalone qualification that exists whether or not you ever attempt the practical, which means an engineer who passes the written and then changes direction still holds something demonstrable rather than a half-finished attempt at something else.

The recertification value is the quiet one

For anyone already holding a Cisco certification that needs renewing, the written exam does that job at the same time. That reframes the fee: it is not $400 spent on a gate, it is $400 spent on a specialist credential plus a recertification plus a core requirement, and the arithmetic only works out badly if you value none of the three.

Cisco’s own listing of how its credentials interlock sits in its certification catalogue, which is worth reading before booking, because the specialist tier is easy to overlook when the expert tier has the more famous name.

How Do the Five CCDE Domains Divide the Marks?

Network Design is the largest domain at 30 percent, followed by the combined control, data, management plane and operational design domain at 25. Business Strategy Design, Service Design and Security Design each carry 15 percent. The five weightings sum to 100, and the split tells you immediately that this is not a protocol exam.

Read the domain names again and notice what is missing. There is no configuration domain, no troubleshooting domain, and no protocol domain. Every one of the five is a design domain, and the word appears in all five titles. Whatever else 400-007 is, it is consistent about what it measures.

The other thing the table shows is that 45 percent of the paper sits outside pure network engineering. Business strategy, service design and security design together carry nearly half the marks, and only one of those three is a subject a senior network engineer necessarily works in every week.

What Is the CCDE Written Exam Format?

400-007 is 90 to 110 questions in 120 minutes at $400 USD, delivered through Pearson VUE in English. Cisco describes it as a two-hour multiple-choice test focused on core enterprise network architectures and technologies. The current version is CCDE v3.0, and Cisco Learning Credits can be used in place of the fee.

There is no published pass mark, and that is deliberate

The commonly quoted range of 750 to 850 out of 1000 is an approximation, not a Cisco figure. Cisco does not publish a cut score for this exam. A variable pass mark exists because the question count itself varies between 90 and 110, and because different forms of a paper are not equally difficult, so the standard is held constant by moving the score rather than the questions.

The practical consequence is that no percentage target is safe to aim at. You cannot plan to score 80 percent and assume that clears it. What you can do is remove weak domains entirely, which is the only strategy that works when the bar moves. Practising against the real question style is the fastest way to find those weak domains, and a set of CCDE sample questions will show you where the reasoning breaks down faster than reading will.

The clock is the other constraint. A hundred questions in 120 minutes is roughly 72 seconds each, and design questions are long. Expect scenarios with multiple constraints stated up front, which means reading speed and the ability to hold several requirements in mind at once are being tested alongside the design knowledge.

Why Is Network Design the Largest Domain?

Because it is the one that contains the actual job. At 30 percent, Network Design asks for resilient, scalable and secure modular networks across both traditional and software-defined architectures, considering technical constraints, operational constraints, application behaviour and needs, business requirements, implementation plans, and migration and transformation.

That single objective is written at a deliberately high level of abstraction, and the abstraction is the point. Cisco is not asking which protocol you would configure; it is asking which design satisfies six competing constraint sets at once, and what you would give up to satisfy them. That is a judgement question with defensible and indefensible answers rather than right and wrong ones.

Migration and transformation is the part people underprepare

The objective names implementation plans and migration and transformation explicitly, which means the exam cares about how you get from the network that exists to the network you designed. A design that is correct but unreachable from the current state is not a passing answer, and cutover sequencing, coexistence and rollback are legitimate examinable considerations.

Practically, this domain rewards experience over study more than any other on the paper. Someone who has run a real migration knows why the elegant design lost to the ugly one, and that instinct is difficult to acquire from a book. It is also why the credential is positioned where it is.

What Does the Control, Data and Management Plane Domain Test?

This 25 percent domain is where the concrete technology lives. It covers end-to-end IP traffic flow in a feature-rich network, data, control and management plane technologies, the choice between centralized, decentralized and hybrid control planes, automation and orchestration design, and software-defined architecture including SD-WAN, overlay, underlay and fabric.

The control plane placement question is the heart of it. Centralizing the control plane buys you consistency and a single point of policy, and costs you a dependency and a failure domain. Decentralizing does the reverse. Hybrid is the pragmatic answer that most real fabrics land on, and the exam expects you to be able to say why for a given set of constraints rather than to prefer one in general.

Automation appears as a design concern, not a scripting one

The objectives name interfacing with APIs, model-driven management, controller-based technologies, and evolution to a CI/CD framework. None of that asks you to write code. It asks whether your design can be operated by automation, which is a structural property: consistent naming, predictable topology, machine-readable state and an interface a controller can drive.

Model-driven management in particular has a specific meaning here, built on schema-defined configuration data rather than screen-scraped command line output. The protocol that established the approach is defined in RFC 6241 for NETCONF, and understanding what it changed about network operations is more useful for this exam than knowing any particular vendor’s implementation.

How Much Business Strategy Is on a Design Expert Exam?

Fifteen percent, which is roughly fifteen questions, and it is the domain most likely to be dismissed and then failed. It covers the impact of customer project management methodologies such as waterfall and agile on network design, implementation and optimization, and solutions based on business continuity and operational sustainability including RPO, ROI, CAPEX and OPEX cost analysis, and risk versus reward.

The methodology objective is more practical than it sounds. A design delivered into a waterfall programme is specified once and built to that specification; a design delivered into an agile one has to tolerate its requirements changing between increments. Those produce genuinely different architectures, and the exam asks you to notice that.

The financial vocabulary is examinable vocabulary

RPO, ROI, CAPEX and OPEX are named directly, so the exam expects you to use them correctly rather than approximately. Recovery point objective is how much data you can afford to lose, which is a different question from how long you can afford to be down. The capital versus operating expenditure distinction drives whether a design leans toward owned hardware or consumed service, and that is a design decision made on financial grounds.

This is the domain where a technically excellent candidate can genuinely lose the paper. Fifteen questions is enough to matter, the material is not difficult, and it is entirely learnable in a few evenings. Skipping it because it is not networking is the most avoidable mistake available on 400-007.

What Do Service Design and Security Design Ask For?

Together they carry 30 percent, and they approach the same network from two directions. Service Design asks how the IP network supports what runs on it: voice, video, backups, data centre replication, IoT and storage, plus cloud and hybrid solutions. Security Design asks how the network is segmented, controlled, observed and enforced.

The cloud objectives inside Service Design are the most specific in the whole syllabus. They name regulatory compliance, data governance covering sovereignty, ownership and locale, service placement, SaaS, PaaS and IaaS, and cloud connectivity including direct connect, cloud on ramp, MPLS direct connect and WAN integration. Data sovereignty in particular is a design constraint that overrides technical preference, because where data may legally reside is not negotiable by architecture.

Security Design is short and precise

Its objective names segmentation, network access control, visibility, policy enforcement, the CIA triad, and regulatory compliance where the regulation is provided. That last clause matters: the exam will give you the regulation rather than expecting you to have memorised legislation, so the skill being tested is applying a stated rule to a design rather than recalling the rule.

Visibility deserves attention because it is the objective most often treated as an afterthought. A design that cannot be observed cannot be operated or defended, and placing telemetry and inspection points is a design decision made at the same time as the topology rather than bolted on afterwards.

How Do You Study for an Exam With No Fixed Pass Mark?

You study for coverage rather than for a score, because a moving bar cannot be aimed at. The sequence below works from the largest domain outward, and it is deliberately ordered: the design judgement built in the first stage is what the later stages are applied to.

1. Start with Network Design and work real scenarios where the constraints conflict, because at 30 percent it is the largest domain and the judgement it builds is what every other domain is then applied to.
2. Move to the control, data and management plane domain next, deciding centralized against decentralized against hybrid for specific constraint sets rather than learning a preferred answer.
3. Spend a deliberate evening on the business vocabulary of RPO, ROI, CAPEX and OPEX, since fifteen questions rest on terms that are quick to learn and expensive to guess at.
4. Finish with service and security design together, working through the cloud connectivity options and the segmentation, access control, visibility and enforcement set as constraints on a design you have already drawn.

Layer timed practice over the whole sequence rather than saving it. Design scenarios are long, and 72 seconds per question means the reading has to be efficient. Cisco’s official cert guide for this exam is a reasonable spine for the theory, though the measured search demand around it is overwhelmingly for pirated copies, which is worth avoiding for the obvious reasons.

For a structured walkthrough of the exam topics themselves rather than the strategy, the site’s own 400-007 exam topics resource collects the material in one place, and it pairs well with sitting practice questions early rather than at the end.

Which Roles Does the CCDE Written Exam Actually Serve?

Cisco frames 400-007 around gathering and clarifying network functional requirements, designing networks to meet them, developing implementation plans, and conveying design decisions and their rationale. That last clause is the role definition: this is a credential for people who have to explain and defend a design to somebody else.

In practice that means network architects, senior design engineers, pre-sales and solution architects, consulting engineers, and senior operations staff moving from running networks to specifying them. The common factor is that the person is accountable for a decision rather than for a configuration.

The career case is reasonable rather than dramatic. Network architect roles sit meaningfully above senior engineer positions on published network architect salary data, and a design credential is one of the clearer ways to signal the transition. It is a signal rather than a qualification for the role, and it works best on a CV that already shows design work.

Where it fits worst is the engineer who wants a harder technical exam. There are better choices for that, because 400-007 deliberately avoids configuration depth. A fuller argument for what the credential does and does not do sits in this look at the value of CCDE certification.

Frequently Asked Questions

How many questions are on the CCDE written exam?

Between 90 and 110, in 120 minutes. The range is genuine rather than an estimate, and it is one reason the passing score is variable rather than fixed.

What is the passing score for CCDE 400-007?

Cisco does not publish one. It is variable, commonly approximated at 750 to 850 out of 1000, and no percentage target is safe to plan against.

How much does the CCDE written exam cost?

Four hundred US dollars, or the equivalent in Cisco Learning Credits. It is delivered through Pearson VUE and offered in English.

Does passing 400-007 give you a certification?

Yes. It earns the Cisco Certified Specialist – Design Core credential outright, meets the core exam requirement for the full CCDE, and counts toward recertification.

Which CCDE domain is the largest?

Network Design at 30 percent, roughly 30 questions. It asks for resilient, scalable and secure modular designs across traditional and software-defined architectures under six constraint sets.

Is the CCDE written exam a configuration exam?

No. All five domains are design domains and the word appears in every title. There is no configuration domain, no troubleshooting domain and no protocol domain on the blueprint.

Does CCDE cover cloud?

Yes, inside Service Design. The objectives name data sovereignty, service placement, SaaS, PaaS and IaaS, direct connect, cloud on ramp, MPLS direct connect and WAN integration.

How much business content is on the exam?

Fifteen percent, covering waterfall and agile methodologies, business continuity, RPO, ROI, and CAPEX versus OPEX analysis. It is the domain technical candidates most often skip.

What version is the current CCDE written exam?

CCDE v3.0, as stated on Cisco’s own exam page for 400-007. That is the version a candidate books against today.

Who should take the CCDE written exam?

Network architects, senior design engineers, solution and consulting architects, and operations staff moving into design. The common factor is accountability for a decision rather than a configuration.

Conclusion

400-007 is a design exam that pays out three times: a specialist credential in its own right, the core requirement for the full CCDE, and recertification. Ninety to 110 questions, 120 minutes, $400, English, CCDE v3.0, and a variable pass mark that Cisco does not publish.

Because the bar moves, study for coverage rather than a score. Build the Network Design judgement first at 30 percent, work the control plane placement decisions second, spend one deliberate evening on the business vocabulary that fifteen questions rest on, and finish with service and security design as constraints on a design you have already drawn. The specification is on Cisco’s own 400-007 exam page, and it is worth reading before booking rather than after.

What Does the CCST Networking Credential Prove?

It proves you understand how networks operate at the level a support technician needs: the devices, the media, the protocols, and the diagnostic routine when something stops working. Cisco positions it as validating entry-level networking concepts, and the roles it points at are network support technician, entry-level help desk, and IT support specialist.

The word entry-level is doing real work in that description, but it does not mean theoretical. The syllabus asks you to attach cables from a network diagram, read the status lights on a Cisco device, run a packet capture, and interpret the output of half a dozen diagnostic commands. It is a practical credential aimed at someone who will be standing in front of the equipment.

What makes it different from a vendor-neutral entry credential

Roughly two thirds of the syllabus is vendor-neutral networking. The remaining third is specifically Cisco: device ports and status lights, privilege levels, the show command set, and cloud-managed Meraki as a device access method. That mix is deliberate, because it is what an entry-level technician in a Cisco shop actually touches.

Is CCST Networking Worth Taking Before CCNA?

Cisco itself answers this: the exam is described on its official page as a first step toward CCNA certification. CCST Networking is not a prerequisite and does not earn credit toward CCNA, but it covers the same territory at a shallower depth, so it works as a staging post for someone with no networking background.

The honest calculation is about time and confidence rather than credentials. CCNA is a substantial exam that assumes real familiarity. Someone moving into networking from a help desk role can sit CCST Networking within a few months, get a certification that hiring managers recognise, and then take CCNA from a much stronger base.

When to skip it

If you already subnet comfortably, know the difference between a layer 2 and a layer 3 switch, and have used show commands in anger, this exam will not teach you anything. Go straight to CCNA. The credential’s value is concentrated almost entirely in the career-changer case.

Cisco’s own CCST Networking exam page sets out the pathway alongside the exam logistics.

What Do the Six Exam Sections Cover?

Standards and concepts, addressing and subnet formats, endpoints and media types, infrastructure, diagnosing problems, and security. No percentage weightings are published, so all six have to be treated as equally examinable across the 40 to 50 questions on the paper.

With no weightings to steer revision, the practical calibration is question exposure, which is what the CCST Networking practice exam is for. It also gives you a feel for how deep each section actually goes, which the objective list alone does not.

How Much Subnetting Does 100-150 Expect?

Enough to read an address and say what network it belongs to. The objectives name subnet concepts, a subnet calculator, slash notation, subnet masks, and broadcast domains for IPv4, plus address types and prefix concepts for IPv6. What they do not name is designing an addressing scheme from scratch.

That distinction sets the bar usefully. You should be able to look at 192.168.10.37/26 and know the network address, the broadcast address, and the usable range. You are not being asked to plan a VLSM scheme across a campus, which is CCNA territory.

IPv6 gets less depth than IPv4

The IPv6 objective is a single line covering address types and prefix concepts, against several lines for IPv4. Learn the address types, understand what a prefix length means, and recognise the common notations. Do not sink a fortnight into IPv6 subnetting arithmetic for this exam.

NAT appears here too, listed under private against public addresses. Concept only: what NAT does, why private ranges exist, and what changes when a packet crosses that boundary.

Which Cables, Standards and Endpoints Are Named?

The syllabus is specific. Cable types are fiber, copper, and twisted pair. Connectors are coax, RJ-45, RJ-11, and fiber connector types. Wireless is 802.11 across the unlicensed 2.4GHz, 5GHz, and 6GHz bands, set against licensed cellular and against wired, with interference sources for each.

Endpoint devices are enumerated as well: Internet of Things devices, computers, mobile devices, IP phones, printers, and servers. The point of that list is that a support technician meets all of them, and each fails differently.

Five operating systems, one objective

One objective in this section asks you to demonstrate how to set up and check network connectivity on Windows, Linux, macOS, Android, and Apple iOS. That is genuinely five platforms, with their own utilities and their own places to look for wireless client settings such as SSID, authentication method, and WPA mode.

For the wireless standards themselves, the Wi-Fi Alliance’s Wi-Fi standards overview covers the band and generation vocabulary the objective assumes without going deeper than this exam needs.

What Does the Infrastructure Section Ask You to Recognise?

Physical and logical fundamentals in roughly equal measure. On the physical side: identifying the status lights on a Cisco device when an engineer tells you what to look for, using a supplied network diagram to attach the right cables, and identifying ports including console, serial, fiber, Ethernet, SFP, USB and Power over Ethernet.

The framing of the status lights objective is worth noticing. It says “when given instruction by an engineer”, which tells you exactly what role this credential is written for: the person on site, on the phone to someone remote, reporting what they can see.

Basic routing and switching

The logical half covers default gateways, the difference between layer 2 and layer 3 switches, and local against remote networks on the routing side. On the switching side it covers MAC address tables, MAC address filtering, and VLANs. These are concept questions, not configuration questions.

Rack layout and power appear alongside cabling, which again reflects the on-site technician role. Knowing which cable goes where in a small topology is a genuinely examinable skill here.

Which Diagnostic Commands and Tools Appear?

More than any other section names. Diagnostic commands are ping, ipconfig or ifconfig or ip, tracert or traceroute, and nslookup, with an explicit objective about recognising how a firewall can influence the result. Packet capture is examined through Wireshark specifically, including saving a capture to a file.

The show command list is enumerated in full: show run, show cdp neighbors, show ip interface brief, show ip route, show version, show inventory, show switch, show mac address-table, show interface, show interface x, and show interface status. Privilege levels, command help, and auto-complete sit alongside them.

Methodology counts as content

The first objective in this section is not technical at all. It covers troubleshooting methodology and help desk best practice: ticketing, accurate documentation, information gathering, policies and procedures, and prioritisation. Expect questions that describe a support scenario and ask what you do first.

How you reach the device

A separate objective covers the ways to access and collect data: RDP, SSH, telnet, VPN, terminal emulators, direct console, network management systems, cloud-managed networking through Meraki, and scripts. Knowing which one suits which situation, and which are safe over an untrusted network, is the testable part.

Because Wireshark is named by name, working through the Wireshark user guide is time well spent. So is understanding what a TCP conversation looks like on the wire, for which the current specification in IETF RFC 9293 is the primary source behind the TCP against UDP objective.

Candidates who want the common failure patterns before building a plan will find them collected in CiscoPrep’s 100-150 mistakes guide.

How Deep Does the Security Section Go?

Conceptual, with one configuration task. Three objectives: describing how firewalls filter traffic through blocked ports and protocols and deny or permit rules, describing foundational security concepts, and configuring basic wireless security. Nothing here requires a security background.

The foundational concepts objective is a vocabulary list as much as anything: confidentiality, integrity and availability; authentication, authorization and accounting; multifactor authentication; encryption, certificates and password complexity; identity stores such as Active Directory; and the common threat categories of spam, phishing, malware and denial of service.

The one hands-on item

Configuring basic wireless security is the only objective in this section that asks you to do something rather than describe it, and it pairs directly with the wireless client settings named back in the endpoints section. SSID, authentication method, and WPA mode appear in both places, which is a fair signal that they are worth knowing properly.

Readers weighing this against Cisco’s security-flavoured entry credential will find that one covered in CiscoPrep’s CCST Cybersecurity overview, which is a separate exam at the same tier.

What Is the Exam Format, and Why Does the Pass Mark Move?

Between 40 and 50 questions in 50 minutes, at $125 USD, with a variable passing score published as roughly 750 to 850 out of 1000. Both the question count and the pass mark are ranges rather than fixed numbers, which is normal for exams assembled from a pool with scaled scoring.

What a scaled score actually means for you

Scaled scoring adjusts for the difficulty of the particular set of questions you were served, so two candidates answering the same number correctly can receive different scaled scores. The practical consequence is that you cannot aim for a specific number of correct answers. Aim for competence across all six sections instead, and treat any target percentage you read as approximate.

Fifty minutes across 45 questions is roughly 65 seconds each, which is brisk. That favours recall over reasoning, and it is the strongest argument for drilling the enumerated lists until they are automatic rather than working them out in the room.

How Should You Prepare With No Networking Background?

Build the vocabulary first and the hands-on skills second, because roughly half the paper tests whether you recognise a term and the other half tests whether you have used a tool. Cisco’s named preparation route is the Network Technician career path, which is aimed squarely at this credential.

1. Start with the standards and concepts section and learn the two models, the network type acronyms, and the protocol list flatly, since these terms recur in every other section and nothing else makes sense without them.
2. Work subnetting next until reading an address in slash notation is automatic, because at roughly 65 seconds per question there is no time to derive a subnet boundary during the exam.
3. Install Wireshark and capture your own traffic, then save the file, because the objective names both the tool and the saving step and neither can be learned from reading about it.
4. Run every named diagnostic command on your own machine across at least two operating systems, so that ping, traceroute and nslookup output is familiar rather than theoretical when a question shows it to you.
5. Finish by drilling the eleven show commands and the security vocabulary as flashcards, since both are pure recall and both are exactly what a 65 second question budget rewards.

Cisco’s Network Technician career path covers the same ground in a structured order and is the route the exam page itself points at.

Frequently Asked Questions

How many questions are on the CCST Networking exam?

Between 40 and 50, with a 50 minute limit. That is roughly 65 seconds per question, which is brisk and rewards recall over working things out in the room.

What score do you need to pass 100-150?

There is no fixed number. The passing score is variable, published as approximately 750 to 850 out of 1000, because the exam uses scaled scoring to adjust for the difficulty of the questions served.

How much does the CCST Networking exam cost?

$125 USD, booked through Pearson VUE. Cisco’s own exam page confirms the same price, and the exam is offered in seven languages.

Is CCST Networking a prerequisite for CCNA?

No. Cisco describes it as a first step toward CCNA rather than a requirement, and it earns no credit toward that certification. It covers similar ground at a shallower depth.

Which languages is the exam available in?

Seven: English, Arabic, Chinese, Spanish, French, Japanese and Portuguese. That is unusually broad language coverage for an entry-level certification.

Does the exam really test Wireshark?

Yes. One objective names it directly and asks you to perform a packet capture and save it to a file, including understanding the purpose of a packet analyser and how to open a saved capture.

How much subnetting is required?

Enough to read addresses and prefixes confidently: subnet concepts, slash notation, subnet masks and broadcast domains for IPv4, plus address types and prefix concepts for IPv6. Designing an addressing scheme is not examined.

Which show commands are on the syllabus?

Eleven are named individually, including show run, show cdp neighbors, show ip interface brief, show ip route, show version, show inventory, show mac address-table and show interface status, plus privilege levels and command help.

Are section weightings published?

No. Six sections are listed with no percentages attached, so no section can safely be treated as low value. Even coverage is the only defensible strategy.

What roles does this certification target?

Network support technician, entry-level help desk technician, and IT support specialist. The objectives reflect that: attaching cables from a diagram, reading device status lights, and following help desk practice all appear.

Conclusion

CCST Networking is a genuine on-ramp rather than a token badge. It covers six sections with no published weightings, scales its pass mark rather than fixing it, and expects you to have actually run a packet capture and read a routing table rather than merely to have read about them.

Prepare it as vocabulary plus hands-on practice, in that order, and drill the enumerated lists until recall is instant, because 65 seconds a question does not leave room for derivation. Check the current objectives and question style on the money site before booking, then take CCNA from a much stronger position afterwards.

What Is the CCNP Wireless Certification Now?

CCNP Wireless is Cisco’s professional-level wireless track, and its mandatory core exam is 350-101 WLCOR. The exam covers seven domains: RF fundamentals, 802.11 technology fundamentals, wireless network implementation, wireless network operation, client connectivity configuration, wireless monitoring and management, and automation and AI. It runs 120 minutes and costs $400.

“Implementing and Operating Cisco Wireless Core Technologies (350-101 WLCOR) is a 120-minute exam that tests a candidate’s knowledge of implementing core wireless technologies including radio frequency fundamentals, 802.11 technology fundamentals, client connectivity, wireless monitoring and management, automation and AI.”

Notice what that sentence puts first and last. Radio frequency fundamentals opens it, automation and AI closes it, and everything between is operational. That ordering is a fair summary of the syllabus, and the last item is the one that surprises people returning to the track.

What Happened to CCNA Wireless and the Old Track?

CCNA Wireless no longer exists as a separate certification, and neither does the old multi-exam CCNP Wireless. Cisco retired both in its 2020 certification overhaul, folding wireless fundamentals into CCNA and leaving the professional wireless track dormant. It returned on 19 March 2026, rebuilt around 350-101 as a single core exam.

This matters more than a naming change. Under the old structure a professional wireless credential meant a core exam plus a concentration exam, chosen from design, implementation, troubleshooting or security. The rebuilt track puts the core content into one paper and adds automation content that the old syllabus never carried.

If you last studied Cisco wireless before 2020, treat almost everything you remember about the track structure as out of date and most of what you remember about the technology as still useful. RF propagation has not changed. What has changed is the controller platform, the management plane and the expectation that you can talk to both through an API.

Where Do the WLCOR Marks Actually Sit?

The seven WLCOR domains are weighted 15, 10, 10, 20, 20, 15 and 10 percent. Wireless Network Operation and Client Connectivity Configuration tie for the largest at 20 percent each, which puts 40 percent of the paper in those two alone. RF Fundamentals follows at 15 percent, level with Wireless Monitoring and Management.

Read the table by theme rather than by row and a different shape appears. Operating and connecting take 40 percent. The two theory domains, RF and 802.11, take 25 percent between them. Monitoring takes 15. Implementation and automation take 20 between them. This is an operations exam with a theory foundation, not a theory exam with an operations chapter.

Why Are Operations and Client Connectivity Worth 40 Percent Together?

Because they cover the two things a wireless engineer does every day: standing the infrastructure up and keeping clients attached to it. Domain 4 covers initial setup, access point discovery and join, AP modes, WLAN client access and client management policies across multiple platforms. Domain 5 covers authentication mechanisms, WLAN authentication on the controller, client operating system connectivity, roaming and guest networking.

Discovery and join is the classic failure point

An access point that will not join a controller is the most common wireless support ticket in existence, and the sequence it follows is deterministic. Knowing that sequence, and knowing which AP mode changes it, is exactly the kind of material a 20 percent domain will test more than once.

Client connectivity is where the platform diversity bites

Domain 5’s phrase “client OS connectivity” is doing quiet work. Windows, macOS, iOS, Android and embedded clients all negotiate association and roaming slightly differently, and a controller configuration that suits one can degrade another. Roaming in particular is where theory and practice diverge sharply.

Guest networking closes the domain and is usually the least practised area, because in most organisations it was configured once and never revisited. Cisco’s wireless LAN controller platform is the reference point for both domains, since almost every objective in them is expressed as something you configure on the controller.

How Much RF Theory Does 350-101 Really Require?

Twenty-five percent, split as 15 percent RF Fundamentals and 10 percent 802.11 Technology Fundamentals. RF Fundamentals covers radio wave propagation, signal measurements including RSSI, transmit power and receive sensitivity, interference and noise, RF mathematics, and antenna characteristics. It is a quarter of the paper, so it cannot be skimmed, but it is not the majority either.

RF mathematics is the sub-topic that decides how much preparation this needs. If decibel arithmetic, link budgets and the relationship between transmit power and receive sensitivity are already comfortable, Domain 1 is largely revision. If they are not, budget real time, because the calculations recur inside the monitoring and implementation domains as well.

802.11 fundamentals is smaller but broader

Domain 2 packs seven distinct sub-topics into 10 percent: Wi-Fi governance, usable channels and power, modulation techniques, channel width, MIMO and MU-MIMO and MLO, wireless topologies, and frame types. That is a lot of surface area for a small weighting, which usually means shallow questions across many areas rather than deep ones in a few.

The governance sub-topic names its sources explicitly: regulatory bodies, IEEE and the Wi-Fi Alliance. The IEEE 802.11 standard defines the protocol behaviour the domain tests, while the Wi-Fi Alliance handles certification and the generation naming that engineers actually use in conversation. Knowing which body does which is a small, cheap mark.

What Does Wireless Network Implementation Cover?

Domain 3 is 10 percent and has three sub-topics: Cisco wireless architectures covering fabric, mesh, local and cloud deployments; physical infrastructure; and the management connections between access points, controllers and dashboards. It is the domain that decides which shape of deployment you are looking at before any of the operational domains apply.

The four named architectures are the examinable core. Fabric-based wireless integrates the WLAN into an SD-Access fabric. Mesh extends coverage where cabling cannot reach. Local mode is the conventional controller-based deployment. Cloud management moves the control plane off site entirely. Each has different implications for traffic paths, failure behaviour and where configuration lives.

Physical infrastructure is the least glamorous sub-topic and the one that quietly determines whether a deployment works. Power budgets, cable runs and mounting all constrain what the design can do, and questions here tend to be practical rather than conceptual.

Why Is There an Automation and AI Domain at All?

Because Cisco’s wireless management plane has moved and the syllabus follows it. Domain 7 is 10 percent and covers Python basics, NETCONF and YANG, wireless APIs, AI analytics and operations in Catalyst Center, and AI-RRM. None of this appeared in the old professional wireless track, and it is the single biggest difference between the credential that retired and the one that returned.

The scope is deliberately shallow. Python basics means reading a script and understanding what it does, not writing production code. NETCONF and YANG mean understanding how a device is modelled and configured programmatically, not implementing a client. Wireless APIs mean knowing what can be queried and changed, not memorising endpoints.

AI-RRM is the sub-topic worth understanding properly

Radio resource management has existed for years, deciding channel and power assignments automatically. The AI variant learns from historical patterns rather than reacting to instantaneous conditions, which changes when and why it makes a change. That behavioural difference is more examinable than any interface detail, because it is what an engineer has to explain when a channel plan shifts overnight.

For anyone whose wireless experience is entirely command-line, this domain is the one that will feel foreign. Ten percent is enough to matter and small enough not to panic about.

What Does 350-101 Cost and What Does Passing Earn You?

350-101 costs $400, or Cisco Learning Credits, and runs 120 minutes with roughly 90 to 110 questions. Passing it earns three things: the Cisco Certified Specialist Wireless Core certification outright, the core exam requirement for CCNP Wireless, and the core exam requirement for CCIE Wireless. It also counts toward recertification.

That value proposition is unusually good, and it is the strongest practical argument for the exam. Most vendor core exams satisfy one requirement. This one satisfies a standalone specialist certification, two track requirements and a recertification obligation from a single sitting.

On timing, 120 minutes across up to 110 questions gives roughly 65 seconds per question, which is tighter than it sounds once a scenario runs to three paragraphs. Cisco does not publish a fixed pass mark, so plan against the upper end of the scaled range. Full details are on Cisco’s own WLCOR exam page.

Who Should Take WLCOR?

It fits wireless engineers and network engineers with real WLAN responsibility, and it fits them whether or not they intend to finish CCNP Wireless. Because passing earns a specialist certification in its own right, the exam has value as a standalone credential rather than only as a stepping stone. Cisco states no prerequisite certification.

Three groups get the most from it. Engineers who held the old CCNA Wireless or the retired professional track and want a current credential. Enterprise network engineers whose remit has widened to include the WLAN. And people already working toward CCIE Wireless, for whom this is the mandatory written core anyway.

The group it does not suit is anyone whose wireless exposure is limited to installing consumer access points. Two of the seven domains assume controller-based operations experience, and no amount of reading fills that in convincingly.

If you are weighing this against the wider enterprise track, the site’s Cisco enterprise certification archive covers how the professional-level exams relate to each other, and the WLSI exam strategies guide covers adjacent wireless implementation material.

How Should You Prepare for a 120 Minute Core Exam?

Prepare in weighting order and finish on timing. The two 20 percent domains carry 40 percent between them and are also the ones that reward hands-on time most, so they go first. The theory domains follow. Automation goes late, because ten percent of shallow content does not need an early start and does need recent memory.

1. Start with Wireless Network Operation, working access point discovery and join until the sequence is automatic, then AP modes, WLAN client access and client management policies, because this domain and the next carry 40 percent between them.
2. Move straight to Client Connectivity Configuration while the same controller is still in front of you, covering authentication mechanisms, roaming behaviour and guest networking on more than one client operating system.
3. Take RF Fundamentals next, and be honest about RF mathematics, since decibel arithmetic and link budgets reappear inside the monitoring and implementation domains rather than staying in their own section.
4. Cover Wireless Monitoring and Management immediately after RF, because troubleshooting questions assume the signal measurements you have just revised.
5. Work 802.11 Technology Fundamentals as a breadth exercise rather than a depth one, touching all seven sub-topics from governance through frame types instead of going deep on modulation.
6. Add Wireless Network Implementation as a short block, concentrating on the four named architectures of fabric, mesh, local and cloud and what each one changes about traffic paths.
7. Finish with Automation and AI, keeping it shallow and recent, focusing on what Python, NETCONF, YANG and AI-RRM do rather than on writing anything from scratch.
8. Sit at least two full timed papers at 110 questions in 120 minutes, capping any single scenario at two minutes so one long question cannot take the ending away from you.

One practical note on materials. The track is only five months old, so a great deal of the wireless study material online was written for the pre-2020 syllabus and contains no automation content at all. Check the publication date on anything you use, and treat a resource that never mentions Catalyst Center or AI-RRM as incomplete for this exam. A run through a realistic WLCOR practice exam is the quickest way to find out whether your pacing holds at 65 seconds a question.

Frequently Asked Questions

How many questions are on the 350-101 WLCOR exam?

Roughly 90 to 110 questions in 120 minutes. At the upper end that is about 65 seconds per question, which is tight once a scenario runs to several paragraphs, so pacing practice matters.

What does passing 350-101 earn you?

Three things at once. The Cisco Certified Specialist Wireless Core certification outright, the core exam requirement for CCNP Wireless, and the core exam requirement for CCIE Wireless. It also counts toward recertification.

How much does the WLCOR exam cost?

$400 USD, or you can use Cisco Learning Credits. The exam is delivered through Pearson VUE and is available in English and Japanese only.

Is there a prerequisite for CCNP Wireless?

Cisco states no prerequisite certification for 350-101. In practice the exam assumes controller-based WLAN operations experience, because two domains worth 40 percent together are built on it.

Which WLCOR domain is worth the most?

Two domains tie at 20 percent: Wireless Network Operation and Client Connectivity Configuration. Between them they carry 40 percent of the paper, so they deserve the first and largest share of study time.

Does CCNA Wireless still exist?

No. Cisco retired it in the 2020 certification overhaul and folded wireless fundamentals into CCNA. Professional-level wireless returned separately in March 2026 with 350-101 as its core exam.

How much programming does the automation domain need?

Very little. The domain is 10 percent and asks for Python basics, NETCONF and YANG concepts and awareness of wireless APIs. You need to read and understand rather than write production code.

What is AI-RRM?

Radio resource management driven by learned historical patterns rather than instantaneous conditions. It changes when and why channel and power assignments shift, which is the behavioural difference the exam is most likely to test.

How much RF mathematics is on the exam?

RF mathematics is one sub-topic inside the 15 percent RF Fundamentals domain, but decibel arithmetic and link budgets also underpin questions in the monitoring and implementation domains, so its real reach is wider than 15 percent.

Is older Cisco wireless study material still usable?

Partly. The RF and 802.11 material ages well. Anything describing the track structure, the controller platform or management tooling from before 2020 is out of date, and none of it covers the automation domain.

Conclusion

The single most useful fact about the relaunched track is how much one exam now carries. Pass 350-101 and you hold a specialist certification outright, you have satisfied the core requirement for both CCNP Wireless and CCIE Wireless, and you have covered recertification. Prepare in weighting order: the two 20 percent operational domains first, because 40 percent of the paper and most of the hands-on difficulty live there, then the RF and monitoring block, then a shallow late pass over automation and AI. Check the date on every study resource you pick up, since anything written for the old track is missing an entire domain. Then time yourself properly before you book.

What Is the 350-601 DCCOR Exam?

The 350-601 DCCOR exam is Cisco’s data centre core exam, running 120 minutes with 90 to 110 questions and costing $400 USD through Pearson VUE. Passing it earns the Cisco Certified Specialist – Data Center Core credential outright, and the same pass satisfies the core requirement for both CCNP Data Center and CCIE Data Center.

That triple role is unusual and worth understanding before you book. One exam, three outcomes: a standalone specialist credential, the core half of a professional certification, and the written qualification for an expert track. It also counts toward recertification, so it has value even to engineers who already hold the professional credential.

Version and language

Cisco lists the exam as DCCOR v1.1 on its own current exam page, and offers it in English and Japanese. Cisco introduced minor updates to the CCNP Data Center certification and its specialist certifications in May 2025, so any study resource that predates that should be checked against the current objectives rather than trusted outright. The fee can also be settled with Cisco Learning Credits rather than a card payment, which matters when an employer is funding the attempt.

The full objective set is published on the official DCCOR exam page, and registration runs through Pearson VUE for Cisco.

What Is on the DCCOR Blueprint?

DCCOR splits across five domains, and no domain is small. The lightest two carry 15% each, which on a 100 question paper still means roughly fifteen questions apiece. There is no domain you can safely write off, and that is the single biggest planning difference between this exam and most professional-level papers. Cisco builds its service provider track on the same three-outcome model, which the SPCOR core exam topics sets out in detail.

The weightings below are where a study plan is actually built. Note that the pass mark is variable rather than a fixed percentage, so a strong showing in one domain does not reliably rescue a weak one.

The complete objective list sits on the 350-601 exam syllabus, and it is worth reading in full before committing to a schedule.

Why Does Compute Carry as Much Weight as Network?

Compute carries 25% of DCCOR, exactly matching the network domain, because a Cisco data centre is a converged system rather than a network with servers attached. UCS is not peripheral equipment in this exam. Service profiles, pools and templates are examined at the same depth as routing protocols, and candidates who treat compute as revision material fail on a quarter of the paper.

The domain covers both rack servers and blade chassis, and the examinable work is configuration abstraction: how a service profile decouples identity from hardware, how pools supply MAC addresses, WWNs and UUIDs, and how templates keep hundreds of servers consistent. UCS-X in Intersight Managed Mode extends the same thinking into a cloud-managed control plane.

Where network engineers struggle

• Treating a service profile as a config file rather than as a movable server identity.
• Underestimating SAN connectivity inside the compute domain, which overlaps with the storage domain and is tested from both sides.
• Skipping firmware impact, since the exam asks which updates on B-Series and C-Series servers are disruptive.
• Ignoring backup and restore, which appears as compute configuration management rather than as a separate topic.

What Does the Network Domain Cover Beyond Routing?

The network domain is 25% of DCCOR and reaches well past traditional routing. It does include OSPFv2, OSPFv3, MP-BGP, PIM and first-hop redundancy, but the distinguishing content is overlay and fabric: VXLAN EVPN, ACI fabric setup, access policies and virtual machine manager integration, plus the packet-flow reasoning that ties them together.

VXLAN EVPN is the piece enterprise engineers most often meet for the first time here. Building a layer two segment across a routed underlay changes how you think about flooding, learning and failure domains, and the exam expects you to reason about unicast, multicast and broadcast behaviour inside that model rather than recite a configuration.

The overlay encapsulation itself is specified in IETF RFC 7348, and reading the header format once makes the troubleshooting questions considerably easier.

Operations content inside the network domain

The domain also carries the operational half of the job: configuration management, infrastructure monitoring with NetFlow and SPAN, streaming telemetry, and the capabilities of Nexus Dashboard. Cisco has folded AI-assisted monitoring into this material, so the questions ask what a platform surfaces and why, not just how to enable a feature.

Cloud service and deployment models appear here too, referenced to a specific standards document rather than to a vendor definition.

“Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”

That definition is the one the syllabus points at, and the NIST cloud definition is short enough to read in ten minutes.

How Deep Does the Storage Network Domain Go?

Storage network is 20% of DCCOR and goes deeper into Fibre Channel than most candidates expect. Switch fabric initialisation, port channels, FCID assignment, Cisco Fabric Services, zoning, the name server, device aliases, NPV and NPIV, and VSANs are all named objectives, and they are tested as operational knowledge rather than as terminology.

Fibre Channel behaves nothing like Ethernet, and that is the point of the domain. The fabric assigns addresses, the name server distributes them, and zoning decides who may talk to whom. An engineer who understands why a fabric login sequence matters will answer these questions comfortably; one who has only memorised the command syntax will not.

The IP storage half

NFS and iSCSI appear as concept-level objectives rather than configuration ones, which is a reasonable reflection of how mixed most real data centres now are. You need to be able to say where each fits and what it costs you, not build one from scratch.

Monitoring appears again here, with SPAN and Nexus Dashboard applied to the storage fabric. That repetition across three domains is deliberate: Cisco is testing whether you can apply one operational toolkit across network, compute and storage rather than learning three separate ones.

What Did the Automation and AI Domain Add?

Automation and artificial intelligence is 15% of DCCOR and is the domain that has changed most. It now spans on-box automation, external orchestration and a genuinely new requirement: describing the high-performance network technologies that make AI workloads viable inside data centre infrastructure.

The on-box half is familiar Cisco territory. Embedded Event Manager, the Scheduler, Bash Shell and Guest Shell on NX-OS, on-box Python, and the NX-API REST interface with JSON and XML encodings all appear as implementation objectives, meaning you should be able to use them rather than describe them.

The orchestration half

The evaluation objectives name a specific toolset: Ansible, Python, POAP, Nexus Dashboard, PowerShell, Terraform CLI and Intersight. The verb is evaluate rather than implement, so the exam wants you to pick the right tool for a scenario. Knowing that the Ansible project is agentless and idempotent, for example, is what makes a scenario question answerable.

The AI infrastructure objective is the newest material of all, and it is descriptive rather than hands-on. What matters is understanding why AI training traffic stresses a fabric differently from ordinary east-west traffic, and which fabric characteristics address that. The Cisco data centre AI article covers where that thinking leads next.

Which Security Topics Appear Across All Three Layers?

Security is 15% of DCCOR and is deliberately spread across network, compute and storage rather than isolated in one place. Authentication, authorisation and accounting with role-based access control appears in all three, which is the domain’s organising idea: the same access model applied consistently across a converged stack.

On the network side the objectives name ACI contracts and microsegmentation, first-hop security features, keychain authentication and MACsec. Contracts are the conceptual centre here, because ACI inverts the usual model: nothing communicates until a contract permits it, which is the opposite default from a traditional VLAN.

Compute and storage security

Compute security is narrower, covering AAA and RBAC within UCS management. Storage adds port security and fabric binding on top of AAA and RBAC, which are the mechanisms that stop an unauthorised device or switch from joining a Fibre Channel fabric.

Because the domain is thin in each individual place but present everywhere, the efficient way to study it is alongside each of the other domains rather than as a block at the end.

Does DCCOR Lead to CCNP or CCIE Data Center?

Both, and to a third credential as well. Passing 350-601 earns Cisco Certified Specialist – Data Center Core immediately. It also serves as the core exam for CCNP Data Center, which is completed by adding one concentration exam, and as the written qualification for CCIE Data Center, which is completed by passing the lab.

That structure changes how the exam should be approached. If your goal is CCNP, DCCOR is half the work and the concentration exam should be chosen for your actual job. If your goal is CCIE, DCCOR is the entry ticket to a much longer road, and the depth you build now pays off later rather than being enough on its own.

Choosing what comes next

The concentration options cover data centre design, infrastructure troubleshooting, ACI implementation and automation. A useful rule is to pick the concentration covering the work you do least well rather than the one covering what you already do daily, since the core exam has already validated the shared ground. A detailed look at the core exam’s own topics sits in this 350-601 exam topics breakdown.

How Should You Sequence a DCCOR Study Plan?

A DCCOR plan should start with the domain you know least, not the one you know best, because the exam’s pass mark is variable and no domain is small enough to sacrifice. Three to five months is realistic for a working engineer. The sequence below front-loads the unfamiliar half.

1. Audit yourself honestly against the five domains first, because an enterprise engineer usually finds compute and storage network unfamiliar while a storage specialist finds the overlay material harder, and the plan should start wherever the gap is widest.
2. Spend the first block on compute, learning how a service profile decouples server identity from hardware and how pools and templates keep a fleet consistent, since this is 25% of the paper and the least transferable from enterprise work.
3. Move to storage network next and learn Fibre Channel as its own model rather than as Ethernet with different names, focusing on fabric initialisation, zoning and the name server.
4. Take the network domain third, concentrating on VXLAN EVPN and ACI rather than on the routing protocols you already know, and reason through unicast, multicast and broadcast behaviour in an overlay.
5. Cover automation by actually running the tools, using on-box Python and the NX-API against a sandbox rather than reading about them, and be ready to justify choosing one orchestration tool over another.
6. Fold security into each domain as you finish it rather than saving it for the end, since AAA and RBAC recur in all three layers and are far easier to remember in context.
7. Finish with full timed papers at 120 minutes, reviewing every wrong answer against the objective it came from so weak domains surface before exam day rather than during it.

Frequently Asked Questions

How many questions are on the 350-601 DCCOR exam?

DCCOR carries 90 to 110 questions in 120 minutes. The count varies between forms, so plan for roughly 70 seconds per question if you want time left to review anything you flagged.

How much does the DCCOR exam cost?

The fee is $400 USD. Cisco also accepts Cisco Learning Credits for the exam, which is often the simpler route when an employer is funding the attempt rather than reimbursing it.

What is the passing score for 350-601?

The pass mark is variable, sitting at roughly 750 to 850 out of 1000 depending on the form. Because it is not a fixed percentage, writing off a whole domain is far riskier than it looks.

Which DCCOR domain carries the most weight?

Network and compute tie at 25% each, followed by storage network at 20%. Automation and artificial intelligence and security each carry 15%, so no domain is small enough to ignore safely.

Does DCCOR count toward CCIE Data Center?

Yes. The same pass satisfies the core requirement for CCNP Data Center and serves as the written qualification for CCIE Data Center, and it earns Cisco Certified Specialist – Data Center Core in its own right.

Is DCCOR harder for enterprise network engineers?

Usually, because compute and storage network together are 45% of the paper and neither maps onto enterprise routing and switching work. Engineers from a storage or server background often find the overlay content harder instead.

What automation tools does the exam name?

The objectives name EEM, the Scheduler, Bash and Guest Shell, on-box Python, the NX-API REST interface, Ansible, POAP, Nexus Dashboard, PowerShell, Terraform CLI and Intersight. Most are evaluated by fit rather than by syntax.

What languages is the exam offered in?

English and Japanese. Both deliver the same blueprint under the same 120 minute limit, and registration for either runs through Pearson VUE.

How long does DCCOR preparation take?

Three to five months is realistic for a working engineer studying part time. The variable is how much of the compute and storage material is genuinely new, since that half drives most of the timeline.

Does passing DCCOR renew existing certifications?

Yes, the exam can be used toward recertification. That makes it worth considering even for engineers who already hold the professional credential and simply need to keep it current.

Conclusion

DCCOR is not a networking exam with extras bolted on. Compute matches network at 25%, storage network adds another 20%, and the automation domain now reaches into AI infrastructure. The blueprint is telling you plainly that Cisco treats the data centre as one converged system and expects you to do the same.

The practical route through it is to start where your gap is widest rather than where you are comfortable, learn Fibre Channel on its own terms, treat VXLAN EVPN and ACI as the network content that actually differentiates this exam, and run the automation tools instead of reading about them. Fold security in as you go. Working through the published objectives domain by domain is the fastest way to find out which quarter of the paper you have been quietly avoiding.

What Does the Cisco 300-220 CBRTHD Exam Actually Cover?

The Cisco 300-220 CBRTHD exam measures your ability to conduct proactive threat hunting and defend enterprise environments using Cisco security technologies. It is a 90-minute concentration exam within the CCNP Cybersecurity track, covering threat hunting fundamentals, threat modeling, actor attribution, hunting techniques, hunting processes, and hunting outcomes. Passing 300-220 proves you can find adversaries that automated tools miss.

Because it is a professional-level concentration exam, the CBRTHD assumes you already understand security monitoring basics and can read logs, telemetry, and packet data fluently. The questions favor applied judgment over memorization, asking you to interpret evidence and choose the right next hunting action. Here are the core exam specifications confirmed for the 300-220 CBRTHD. Its sibling concentration picks up where the hunt ends, and the Cisco forensics exam covers that ground.

You schedule the exam through Pearson VUE registration, either at a test center or as an online-proctored session. The variable passing score reflects Cisco scaled scoring, so treat the 750-850 range as a target rather than a fixed line.

How Are the Six 300-220 Threat Hunting Domains Weighted?

The 300-220 CBRTHD blueprint splits into six weighted domains that move from theory to hands-on execution. Four domains carry 20% each, and two carry 10% each, so no single area dominates. Understanding these weightings tells you exactly where to concentrate study time, because the fundamentals, attribution, techniques, and processes domains together make up 80% of your score.

The balance is deliberate. The two 20% technique-and-process domains reward candidates who have actually run hunts, while the two 20% fundamentals-and-attribution domains reward those who understand the theory behind adversary behavior. If you can work through a full set of 300-220 practice questions and explain why each answer is correct, you are hitting the balance the blueprint expects.

What Threat Hunting Fundamentals Does CBRTHD Test?

The Threat Hunting Fundamentals domain is worth 20% of the 300-220 CBRTHD exam and grounds every other topic. It expects you to apply the Threat Hunting Maturity Model, reason about the Pyramid of Pain, interpret threat intelligence reports, and judge where automation helps or hurts a security operations center. These fundamentals decide whether your hunts are structured or guesswork.

The Maturity Model and Pyramid of Pain

Cisco expects you to map an organization to the Threat Hunting Maturity Model and connect that placement to the Pyramid of Pain. The pyramid ranks indicators by how much disruption denying them causes an attacker, from trivial hash values at the bottom to tactics, techniques, and procedures at the top. Hunting higher on the pyramid inflicts more pain and forces adversaries to rebuild their playbooks.

Reading Intelligence and Judging Automation

You also need to interpret a threat intelligence report and draw conclusions about whether you face a known advanced persistent threat, a commodity human-driven actor, or a commodity machine-driven campaign. The domain further asks you to weigh the advantages and disadvantages of automation, including artificial intelligence and machine learning, in SOC operation, and to recognize the limiting factors of detection tools for malware behavior and propagation.

“Threat hunting is a focused and iterative approach to searching out, identifying, and understanding adversaries internal to the defender’s networks.”

How Does the 300-220 Exam Approach Threat Modeling and Attribution?

Threat Modeling Techniques carries 10% of the 300-220 exam and Threat Actor Attribution Techniques carries 20%, and together they teach you to predict and identify adversary behavior. The CBRTHD exam wants you to select a modeling approach for a scenario, prioritize attacks, and pin observed activity to a specific actor using logs and artifacts. Frameworks do the heavy lifting here.

Modeling Threats With Established Frameworks

The exam names specific standards you must know: the MITRE ATT&CK framework for mapping tactics and techniques, the MITRE CAPEC catalog for attack pattern prioritization, plus TaHiTI and PASTA methodologies. You use ATT&CK to model tactics, techniques, and procedures or detect changes in them, and you use the Cyber Kill Chain and CAPEC model to rank the priority level of attacks.

Attributing Activity to a Threat Actor

Attribution asks you to determine attack tactics, techniques, and procedures from logs and interpret the behavior of a given threat actor. A recurring exam skill is distinguishing an authorized penetration test from a genuine attack based on delivery method, payload, tactic, or timeline. You also identify usable artifacts for detecting advanced persistent threat actors across every level of the Pyramid of Pain.

• Structured versus unstructured hunting and when each fits
• Threat intelligence handling: gathering, cataloging, utilizing, and removing
• Priority scoring with the Cyber Kill Chain and MITRE ATT&CK

Which Hands-On Threat Hunting Techniques Appear on the CBRTHD Exam?

Threat Hunting Techniques is a 20% domain and the most hands-on part of the 300-220 CBRTHD exam. It spans scripting, endpoint and network analysis, cloud-native hunting, and memory forensics. This is where the exam confirms you can move beyond dashboards and actually pull threats out of raw telemetry, code, and system memory using the right tool for each artifact.

Scripting, Endpoint, and Network Hunting

You are expected to use scripting languages such as Python and PowerShell to augment detection and analytics. The domain covers finding undetected threats in endpoint artifacts, tracing command-and-control communications to and from infected hosts, and selecting suspicious activity from session and protocol data. You also determine the stage of infection within C2 communications by reading traffic data.

Memory-Resident Attacks and Code Analysis

Memory-resident attacks get direct attention. The exam references analysis with memory-specific tools such as Volatility memory forensics, and it asks you to select weaknesses in code using tools like PE Checker, Burp Suite, and Semgrep. Additional skills include performing a cloud-native threat hunt, constructing a detection signature, and describing analysis for the applications and operating systems used by IoT devices.

1. Augment analytics with Python and PowerShell scripting
2. Perform cloud-native and endpoint-based hunts
3. Analyze memory-resident attacks with Volatility
4. Build detection signatures from observed behavior

How Do You Defend and Report After a Hunt?

The Threat Hunting Processes domain (20%) and the Threat Hunting Outcomes domain (10%) close the loop on the 300-220 CBRTHD exam by turning findings into defense. Once you locate a threat, the exam expects you to reverse engineer it, recommend remediation, and communicate results that drive real change. Hunting has no value if the outcome does not harden the environment.

Building Defensive Processes

The processes domain covers identifying memory-resident attacks, determining compromises through reverse engineering, and finding known and unknown gaps in detection such as vulnerabilities and configuration errors. You construct a runbook or playbook for a detectable scenario, recommend tools, detection, and deception techniques, and propose remediation strategies and security countermeasures based on the results of a threat assessment.

Communicating Hunt Outcomes

The outcomes domain focuses on impact. You describe how multiproduct integration improves data visibility and speeds analysis, diagnose analytical gaps using hunting methodologies, and recommend a mitigation strategy to block C2 traffic. Critically, you use presentation resources to convey findings and direct environmental change, and you recommend how a hunt team advances to the next Threat Hunting Maturity Model phase.

Who Should Take the Cisco 300-220 CBRTHD Exam?

The Cisco 300-220 CBRTHD exam suits security professionals who already work in detection and response and want to specialize in proactive hunting. It fits SOC analysts, incident responders, threat intelligence analysts, and security engineers ready to move from reactive alerting to hypothesis-driven investigation. The exam rewards practical experience over classroom theory, so hands-on time matters most.

Candidates typically hold associate-level knowledge before attempting the concentration. If you have not yet built that base, the CyberOps Associate foundation covers the security monitoring, host-based analysis, and network intrusion concepts that CBRTHD assumes you already understand. Strong scripting ability and comfort with log analysis platforms are practical prerequisites the blueprint expects.

How Should You Prepare for the Cisco Threat Hunting Exam?

Preparing for the Cisco threat hunting exam works best when you pair blueprint study with real hunting practice. Because the 300-220 CBRTHD rewards applied judgment, passive reading is not enough. Build a plan that mirrors the six domains, spend the most time on the four 20% areas, and rehearse with realistic scenarios until interpreting evidence becomes second nature.

A Domain-Driven Study Plan

1. Map every objective in the official blueprint to a study resource so you never study blind.
2. Set up a lab where you can run Python and PowerShell hunts against sample telemetry.
3. Practice memory analysis with Volatility and pattern mapping with the ATT&CK matrix.
4. Write a sample runbook and a findings report to rehearse the outcomes domain.
5. Take timed practice tests and review every wrong answer until you understand the reasoning.

Practice the Way You Will Be Tested

The CBRTHD exam presents scenario questions, so rehearse decision-making rather than recall. Work through hunting scenarios that force you to choose a modeling approach, prioritize an attack, or pick the correct memory tool. Track your accuracy by domain, then loop back to weak areas. Consistent scenario practice is the single strongest predictor of a first-attempt pass.

What Career Paths Open After Passing 300-220?

Passing the 300-220 CBRTHD exam and earning the CCNP Cybersecurity certification signals that you can hunt, defend, and report at a senior level. Threat hunting is one of the most in-demand security specialties, and employers pay a premium for analysts who reduce dwell time by finding adversaries early. The credential strengthens roles across the modern security operations center.

Typical destinations include threat hunter, senior SOC analyst, incident response lead, threat intelligence analyst, and detection engineer. Many professionals pair hunting skills with broader defensive design by studying the Cisco security core concepts, which complement hunting with network security architecture and enforcement. Together, these skills position you for security architect and team-lead tracks.

Frequently Asked Questions About the 300-220 Exam

Is the 300-220 CBRTHD an associate or professional exam?

The 300-220 CBRTHD is a professional-level concentration exam within the Cisco CCNP Cybersecurity certification, previously called CyberOps Professional. It assumes you already hold associate-level security monitoring knowledge and can analyze logs, telemetry, and network traffic without guidance.

How many questions are on the Cisco 300-220 exam?

The exam contains 55 to 65 questions delivered over 90 minutes. The questions emphasize applied scenarios, so managing your time and reading evidence carefully matters as much as knowing the theory.

What is the passing score for the CBRTHD exam?

Cisco uses a variable scaled score, typically in the 750-850 out of 1000 range. Because scoring is scaled per exam form, aim to master every domain rather than target a single fixed number.

How much does the 300-220 exam cost?

The 300-220 CBRTHD exam costs $300 USD, excluding local taxes. You register and schedule it through Pearson VUE, either at an authorized test center or as an online-proctored session.

Which frameworks does the 300-220 exam test?

The blueprint explicitly references MITRE ATT&CK, MITRE CAPEC, TaHiTI, PASTA, and the Cyber Kill Chain. You use these frameworks to model threats, prioritize attacks, and structure your hunting hypotheses.

Do I need programming skills for the CBRTHD exam?

Yes, scripting is a tested skill. The Threat Hunting Techniques domain expects you to use Python and PowerShell to augment detection and analytics, so hands-on scripting practice is strongly recommended.

How long should I study for the 300-220 exam?

Most candidates with detection and response experience prepare for two to three months. Time varies with your scripting fluency, familiarity with ATT&CK, and access to a lab for practicing memory and endpoint hunts.

Does the 300-220 exam cover cloud threat hunting?

Yes. The Threat Hunting Techniques domain requires you to perform a cloud-native threat hunt, alongside endpoint artifact analysis, C2 communication tracing, and memory-resident attack investigation.

What tools appear on the CBRTHD exam?

The blueprint names Volatility for memory analysis and PE Checker, Burp Suite, and Semgrep for code-level weakness analysis. You should understand what each tool inspects and when to reach for it during a hunt.

Conclusion

The Cisco 300-220 CBRTHD exam is a proving ground for security professionals who want to hunt threats instead of waiting for them. Across its six domains, the exam validates that you can model adversaries, attribute their activity, run technical hunts through memory and telemetry, and turn every finding into a stronger defense. Focus your study on the four 20% domains, practice with realistic scenarios, and rehearse both the hunting and the reporting side of the job. If you are ready to specialize in one of cybersecurity’s most valued skills, map the blueprint, build a lab, and start hunting today. Your first-attempt pass starts with disciplined, scenario-driven practice.

What Does the Cisco 200-201 CBROPS Exam Cover?

Cisco 200-201, “Understanding Cisco Cybersecurity Operations Fundamentals,” is a 120-minute exam of roughly 95 to 105 questions costing $300 USD, delivered through Pearson VUE. It covers five weighted domains: Security Concepts (20%), Security Monitoring (25%), Host-Based Analysis (20%), Network Intrusion Analysis (20%), and Security Policies and Procedures (15%).

A note on the name: CBROPS is now CCNACBR

If you are meeting two names for the same exam, that is expected and neither is a mistake. The exam code has not changed and is still 200-201, but it is now published with the suffix CCNACBR, and the credential it awards is named Cisco Certified Cybersecurity Associate rather than CyberOps Associate. The objectives, the five domains and their weightings are unchanged, so anything written about CBROPS still applies. This guide keeps the older term in places because that is still how a great deal of the available study material is labelled.

How Is the Exam Scored?

Cisco does not publish a fixed passing score. Results are scaled on a 1000-point scale, with the threshold generally falling in the 750 to 850 range and the exact cut varying with form difficulty. You cannot compute a target mark, so the practical goal is to be comfortably above the line across every domain rather than strong in some and weak in others.

Domain Weightings at a Glance

Read the weightings before you open a single chapter. Security Monitoring is the largest domain, and the three analysis domains together account for 65 percent of the exam. This is a monitoring and analysis exam far more than a policy exam, and study time should follow that shape.

Who Should Take the CyberOps Associate Certification?

The CyberOps Associate is designed for aspiring and early-career security analysts headed for a security operations centre. It suits help desk and network staff pivoting into security, computer science graduates targeting a first defensive role, and IT generalists who want a structured, vendor-backed introduction to blue-team work rather than penetration testing. The professional tier above it includes the CBRFIR incident response exam, which moves from noticing an incident to investigating one.

What Background Helps

There are no formal prerequisites, but the exam assumes comfort with networking basics. Candidates who understand the TCP/IP stack, common ports, and how a packet traverses a network find the intrusion-analysis domain far more approachable, because those questions ask you to read protocol headers and packet captures rather than recite definitions.

Where It Sits Against Other Cisco Exams

CBROPS is the defensive counterpart to the routing-focused associate track. If you are still deciding between the two entry points, the 200-201 versus 200-301 comparison maps where each one leads. For a broader view of the operations mindset the exam rewards, the CyberOps gateway overview is a useful starting point.

Security Concepts: What Foundations Does the 20% Domain Test?

Security Concepts covers the vocabulary the rest of the exam is built on: the CIA triad, security deployment models, threat intelligence, risk assessment, access control models, CVSS scoring, and the challenges of data visibility. At 20 percent it is foundational, and gaps here quietly cost marks across every analysis domain.

The Terms You Must Own

Several concepts appear repeatedly and are worth committing to memory rather than recognition:

• CIA triad – confidentiality, integrity, and availability, and which one a given attack violates
• Access control models – discretionary, mandatory, role-based, and attribute-based, and how they differ
• Threat, vulnerability, and risk – distinct terms the exam expects you to separate cleanly
• Run book versus playbook – the difference between automated and analyst-driven response steps

Why CVSS Matters Here

The Common Vulnerability Scoring System appears explicitly, and you should understand what its base metrics represent rather than memorise a formula. Knowing why attack vector and privileges required push a score up helps you reason about prioritisation, which is exactly what the exam is testing. The scoring system is maintained by FIRST’s CVSS specification, the authoritative reference for its metric groups.

“We focus primarily on nation-state threat actors, with China and Russia being the two biggest focuses of our work.”

Why Is Security Monitoring the Largest Domain?

Security Monitoring is the heaviest domain at 25 percent because it is the actual job. It covers attack surfaces, the data that security technologies produce, common network and web application attacks, social engineering, endpoint threats, and how encryption changes what a monitoring tool can see. This is the domain that decides most exam outcomes.

Know Your Data Sources

The exam repeatedly asks which technology produces which evidence. Full packet capture, session data, transaction data, alert data, and statistical data each answer different questions, and you should be able to match a monitoring need to the right source. A question describing an investigation will often hinge on knowing that NetFlow shows conversations while a full capture shows content.

Understand What Encryption Hides

Encryption is a recurring theme because it complicates monitoring. TLS protects payloads from inspection, which pushes analysts toward metadata, certificate details, and behavioural signals instead of content. Understanding this trade-off is more valuable than memorising any single protocol, because the exam frames it as a visibility problem an analyst has to work around.

“You can’t out-react an adversary who is already inside and deliberately staying quiet.”

What Does Host-Based Analysis Require?

Host-Based Analysis covers endpoint security technologies, the components of an operating system, attribution during an investigation, types of evidence, and the interpretation of malware analysis output. At 20 percent it moves the focus from the wire to the endpoint, where much of the decisive forensic evidence actually lives.

Operating System Internals

You need working familiarity with both Windows and Linux internals: processes, the registry versus configuration files, logs and where they live, and how a compromised host behaves differently from a healthy one. Questions often show a log excerpt or process list and ask what it indicates, so recognition of normal versus abnormal matters more than command syntax.

Evidence and Attribution

The domain treats evidence formally. Know the difference between best evidence, corroborating evidence, and indirect evidence, and understand chain of custody well enough to explain why mishandled evidence loses value. Attribution questions ask you to reason from artefacts toward a plausible actor without overreaching beyond what the data supports.

How Does Network Intrusion Analysis Work on the Exam?

Network Intrusion Analysis is where theory meets the packet. Worth 20 percent, it examines mapping events to source technologies, detection accuracy metrics, deep packet inspection, PCAP analysis, protocol header interpretation, and identifying malicious artefacts from captured traffic. It rewards candidates who have actually opened a capture in a protocol analyser.

False Positives and Detection Metrics

Detection accuracy is tested directly. Be fluent in true positive, true negative, false positive, and false negative, and understand why a noisy signature generating false positives erodes analyst trust as surely as a missed detection erodes security. The exam frames these as operational trade-offs, not abstract statistics.

Reading Traffic

Practical packet skills carry real weight here. You should be able to read the headers of common protocols, follow a TCP stream, and spot the fingerprints of typical attacks in a capture. Time spent in a protocol analyser inspecting real traffic converts directly into marks, because the questions present evidence and ask for an interpretation rather than a definition.

What Incident Response Knowledge Do Security Policies Test?

Security Policies and Procedures is the smallest domain at 15 percent, but it ties the others together. It covers management concepts, the elements of an incident response plan, the NIST incident handling framework, network and server profiling, classification of protected data, and the metrics a SOC uses to measure itself.

The Incident Response Lifecycle

The NIST incident response lifecycle is core material. Know its phases in order and what happens in each, because questions describe a scenario and ask which phase it belongs to. The framework is defined in NIST Special Publication 800-61, which is worth reading for the phase definitions even though the exam paraphrases them.

Profiling and Protected Data

Two smaller topics reliably appear. Network and server profiling establishes a baseline so that deviation becomes detectable, which connects directly back to the monitoring domain. Protected data classification asks you to recognise categories such as PII, PHI, and intellectual property, and to understand why each carries different handling obligations.

What SOC Roles Does CBROPS Prepare You For?

CBROPS maps most directly to Tier 1 SOC analyst, security operations analyst, and incident response support roles. It is the credential that signals you can triage alerts, escalate correctly, and contribute on a monitoring team from day one, which is exactly what employers hiring for entry-level blue-team positions look for.

The Career Path Beyond the Associate

The certification is a genuine on-ramp rather than an endpoint. Analysts who start here typically progress toward threat hunting, digital forensics, or incident response specialisation, and many pair the operational grounding with a professional-level security credential later. The associate validates that you can do the work; the specialisations decide which direction the work takes.

Recertification

The CyberOps Associate is valid for three years. It can be renewed by passing an eligible exam or by earning continuing education credits through Cisco’s recertification programme, so treat it as an ongoing commitment rather than a one-time hurdle. Exams are scheduled through Pearson VUE’s Cisco programme, at a test centre or online with a proctor.

How Should You Structure a CBROPS Study Plan?

Eight to ten weeks at eight to ten hours per week suits most candidates with some networking background, and closer to fourteen weeks for those new to security. Allocate study time in proportion to the domain weightings, and spend a meaningful share of every week analysing real logs and captures rather than only reading.

A Ten-Week Sequence

1. Weeks one to two – security concepts. Lock down the vocabulary: CIA triad, access control models, CVSS, and the threat-vulnerability-risk distinction. Everything downstream leans on these terms.
2. Weeks three to five – security monitoring. The largest domain deserves the most time. Study data sources, common attacks, and how encryption limits visibility, and start reading real alert data.
3. Weeks six to seven – host-based analysis. Work through Windows and Linux internals, evidence types, and malware analysis output. Practise reading logs from both operating systems.
4. Week eight – network intrusion analysis. Live in a protocol analyser. Follow streams, read headers, and interpret captures until it is second nature.
5. Weeks nine to ten – policies and review. Cover the NIST lifecycle and profiling, then move to timed full-length practice under exam conditions.

The Habit That Separates Passes From Retakes

Analyse real data, not just study guides. A candidate who has spent hours inside packet captures and log files reads exam scenarios fluently, because the questions are drawn from exactly that kind of evidence. Reading about a false positive is not the same as recognising one in a stream of alerts, and the exam tests the second skill. Working through a scenario-based CBROPS practice exam under timed conditions is the fastest way to find out whether that fluency has arrived.

The official blueprint and objective list are published on the Cisco CyberOps Associate page, and it is worth reading verbatim rather than through a third-party summary so that no objective is missed.

Frequently Asked Questions

Is 200-201 CCNACBR the same exam as 200-201 CBROPS?

Yes. It is one exam with one code, 200-201, published under a newer name. The suffix moved from CBROPS to CCNACBR and the credential is now called Cisco Certified Cybersecurity Associate instead of CyberOps Associate. The domains, their weightings and the objectives are the same, so study material written for CBROPS remains valid.

How many questions are on the Cisco 200-201 exam?

The exam contains roughly 95 to 105 questions in 120 minutes. The exact count varies by form, which leaves a little over a minute per question on average, though scenario items with packet captures take longer.

What is the passing score for CBROPS?

Cisco does not publish a fixed passing score. Results are scaled on a 1000-point scale, with the threshold generally falling between 750 and 850 depending on form difficulty. Prepare to be comfortably above the line rather than targeting a specific number.

How much does the 200-201 exam cost?

The exam fee is $300 USD plus applicable taxes, booked through Pearson VUE. Pricing varies by region, and Cisco periodically offers discounted vouchers through training partners and community programmes.

Are there prerequisites for the CyberOps Associate?

There are no formal prerequisites. Cisco recommends a working understanding of networking fundamentals and basic familiarity with Windows and Linux, but many candidates pass through structured self-study without prior security experience.

Which domain carries the most weight?

Security Monitoring at 25 percent is the largest single domain. The three analysis domains, Security Monitoring, Host-Based Analysis, and Network Intrusion Analysis, together account for 65 percent of the exam.

Is CBROPS harder than the CCNA?

They test different skills rather than different difficulty levels. CBROPS is lighter on configuration and heavier on analysis and interpretation, so candidates from a security background often find it more intuitive than the routing-focused associate exam.

Do I need hands-on tools to prepare?

Effectively yes. A protocol analyser and access to sample packet captures and logs are close to essential, because the analysis domains ask you to interpret real evidence rather than recite definitions.

What job does CBROPS lead to?

It maps most directly to Tier 1 SOC analyst and security operations analyst roles. It signals that you can triage alerts, escalate correctly, and contribute on a monitoring team from your first day.

How long is the CyberOps Associate valid?

The certification is valid for three years. It can be renewed by passing an eligible exam or by earning continuing education credits through Cisco’s recertification programme.

How long does it take to prepare for CBROPS?

Eight to ten weeks at eight to ten hours per week is realistic for candidates with a networking background. Those new to security should plan for around fourteen weeks, weighting the extra time toward monitoring and packet analysis.

Conclusion

Cisco 200-201 CBROPS is an analysis exam wearing a certification’s clothing. Its five domains reproduce the daily reality of a SOC, and the weightings are the clearest signal you have about where to spend your time: Security Monitoring and the two analysis domains decide the outcome, and policy knowledge ties them together.

Treat the vocabulary of Security Concepts as non-negotiable groundwork, then spend the bulk of your preparation inside real logs and packet captures. The exam presents evidence and asks for interpretation, and that fluency only comes from practice with genuine data.

Plan eight to ten weeks, follow the domain weightings, and read the official blueprint verbatim so no objective slips through. CyberOps Associate is the recognised entry point to defensive security, and it opens the door to the SOC roles where the rest of a security career begins.

What Does the Cisco 200-301 CCNA Exam Cover?

Cisco 200-301, “Implementing and Administering Cisco Solutions,” is a 120-minute exam of roughly 90 to 110 questions costing $300 USD. It covers six weighted domains: Network Fundamentals (20%), Network Access (20%), IP Connectivity (25%), IP Services (10%), Security Fundamentals (15%), and Automation and Programmability (10%).

How Is the Exam Scored?

Cisco does not publish a fixed passing score. Scores are scaled, typically reported on a 1000-point scale with the threshold generally falling somewhere in the 800s, and the exact cut varies with form difficulty. The practical consequence is that you cannot compute a target – you prepare to be comfortably above the line rather than to clear a known number. The same scaled scoring applies further up the track, including on the 350-501 service provider core.

Domain Weightings at a Glance

Read that table before you read a single chapter. IP Connectivity, Network Fundamentals, and Network Access together account for 65 percent of the exam – routing, addressing, and switching remain the heart of the CCNA no matter how much the surrounding technology changes. The full objective list is published on the official CCNA exam topics page, and it is worth reading verbatim rather than through a third-party summary. Engineers heading toward the data centre track meet the same discipline again in the CCNP Data Center core.

Why Does CCNA Still Matter in a Cloud-First Network?

CCNA remains relevant because cloud adoption changed where networks live, not whether they exist. Workloads moved into virtual private clouds that still require subnets, routing tables, access control, and NAT – so the 200-301 fundamentals transfer directly, even for engineers who may never rack a physical switch. The same design thinking is tested far further up the ladder, as the Cisco design expert exam shows.

The Vocabulary Transfers to Every Cloud

A cloud engineer configuring a route table, a security group, and a NAT gateway is doing exactly what the CCNA teaches, under different product names. Engineers who skip the fundamentals and learn only one cloud provider’s console tend to hit a wall the moment something does not behave as the documentation promised, because they have no model of what is happening underneath.

“We still need those CCIEs. The experience they bring – understanding the planning, designing, implementing, and optimizing of any Cisco solution, is critical.”

Troubleshooting Is the Scarce Skill

Distributed systems fail in ways that look like application problems and turn out to be MTU, asymmetric routing, or a DNS resolver pointing somewhere unexpected. The ability to reason from the physical layer upward is not obsolete – it is scarcer, which makes it more valuable.

What has genuinely changed is the automation expectation, and Cisco reflected that by giving programmability its own weighted domain. Modern network roles assume you can read structured data and call an API, which is why the exam now includes REST concepts alongside spanning tree. Candidates planning a longer path often look at the CCNP Enterprise certification paths once the associate level is behind them.

Network Fundamentals: What Does the 20% Domain Test?

Network Fundamentals covers network components, topology architectures, physical interfaces and cabling, IPv4 and IPv6 addressing, subnetting, and wireless principles. At 20 percent it is roughly one fifth of the exam, and it is the domain where a weak foundation quietly costs marks across every other domain too.

Subnetting Is the Highest-Leverage Skill

Subnetting appears explicitly here and implicitly throughout IP Connectivity, and under exam time pressure you cannot afford to work it out longhand. The goal is instant recall: given an address and a prefix, state the network address, broadcast address, usable range, and host count without hesitation.

Do Not Treat IPv6 as an Afterthought

IPv6 deserves more respect than most candidates give it. Address types – global unicast, link-local, unique local, multicast – and the rules for abbreviating an address are reliable question material, and link-local behaviour in particular catches people who studied IPv6 late.

The Conceptual Marks Are Free

The rest of the domain is conceptual: what a switch does versus a router versus a firewall, how two-tier and three-tier campus designs differ, when to use single-mode versus multimode fibre. These are quick marks provided you have actually read them rather than assumed you know them from experience.

How Do VLANs and Wireless Fit Into Network Access?

Network Access covers VLANs and trunking, EtherChannel, spanning tree, wireless architectures, and access point configuration. Also worth 20 percent, this domain is where switching is tested – and it rewards candidates who have configured these features rather than only read about them.

VLANs and Trunking Come First

You need to configure access and trunk ports, understand what the native VLAN is and why a mismatch causes problems, and know how VLANs are carried between switches. Trunk negotiation and allowed-VLAN lists are common scenario material.

Spanning Tree Is the Most Underestimated Topic

Understand what problem it solves – a layer 2 loop will saturate a network in seconds because frames have no TTL to expire – and know how root bridge election works, what the port states mean, and how to influence the outcome with priority and cost. Questions frequently show a topology and ask which port blocks.

Wireless Now Tests Architecture

Wireless has grown in the syllabus and now covers architecture as much as configuration: autonomous versus controller-based deployments, AP modes, and the basics of connecting a WLC. You should be able to describe a client’s path from association through authentication onto the wired network.

IP Connectivity Is 25% – What Should You Master First?

IP Connectivity is the largest domain at 25 percent, covering the routing table, static routing, OSPFv2, and first-hop redundancy protocols. Master how a router selects a path before anything else, because that decision logic underpins every question in the domain.

Path Selection Follows a Strict Order

The exam tests this relentlessly. The longest prefix match wins first – a more specific route always beats a less specific one regardless of protocol. Only among routes of equal prefix length does administrative distance decide which source to trust, and only within a single protocol does metric break the remaining tie.

1. Longest prefix match – most specific route wins, always evaluated first
2. Administrative distance – trustworthiness of the source: connected 0, static 1, OSPF 110
3. Metric – used only to choose between routes from the same protocol

Learn OSPF Properly, Not Broadly

OSPF is the only dynamic routing protocol on the exam. Neighbour adjacency requirements, area concepts, router IDs, cost calculation, and the common reasons two routers refuse to form an adjacency – mismatched area, subnet, timers, or authentication – are all reliable question sources. The protocol is specified in RFC 2328, which is worth skimming for the state machine even though the exam will not quote it.

First-Hop Redundancy Rounds It Out

Understand the problem it solves – hosts have one default gateway and no mechanism to fail over – and how a virtual IP shared between routers resolves it.

Which IP Services Appear Most Often on the Exam?

IP Services covers NAT, NTP, DHCP, DNS, SNMP, syslog, QoS concepts, and remote access protocols. At 10 percent it is a smaller domain, but its topics are operationally ubiquitous, so questions tend to be practical rather than theoretical.

NAT Terminology Carries the Most Marks

NAT is the heaviest topic here and the one with the most confusing terminology. Learn the four address categories – inside local, inside global, outside local, outside global – as a matter of vocabulary discipline, because questions often present a translation table and ask you to identify which column is which. Static NAT, dynamic NAT, and PAT should each be distinguishable from a described scenario.

DHCP and DNS Are Tested for Troubleshooting

Know the DHCP message exchange in order, and understand why a relay agent is needed when the server sits on a different subnet – a broadcast will not cross a router unaided.

The Lighter Topics Still Appear

• NTP – correlated logs are useless with unsynchronised clocks
• Syslog – severity levels are worth memorising outright
• QoS – classification, marking, queuing, policing versus shaping, all conceptual

What Security Fundamentals Does CCNA Expect?

Security Fundamentals covers threat concepts, access control lists, device hardening, layer 2 security features, and wireless security. Worth 15 percent, it tests defensive configuration a network engineer would genuinely deploy rather than specialist security analysis.

“You can’t secure something if you don’t understand it. A security pro without a strong foundation in networking is trying to protect a house without knowing where the windows and doors are.”

Access Control Lists Are the Centre of the Domain

Three rules carry most of the marks:

1. Top-down evaluation – the list stops at the first match, so order changes the outcome
2. Implicit deny – every list ends with one, whether you wrote it or not
3. Placement – standard ACLs filter only on source and belong near the destination; extended ACLs match far more and belong near the source so unwanted traffic dies early

Layer 2 Security Is Distinctive CCNA Material

Port security limits which MAC addresses may appear on a port. DHCP snooping distinguishes trusted from untrusted ports so a rogue server cannot hand out addresses. Dynamic ARP Inspection builds on that snooping database to stop ARP spoofing. Understand the dependency: DAI relies on DHCP snooping being in place.

Wireless Security Has Consolidated

WPA2 and WPA3 dominate, and you should be able to distinguish personal from enterprise modes. Personal uses a shared passphrase; enterprise authenticates each user individually against a RADIUS server, which is why it dominates in corporate deployments.

How Much Programmability Does CCNA Actually Require?

Automation and Programmability is worth 10 percent and tests concepts rather than coding ability. You need to explain how automation changes network management, compare traditional and controller-based architectures, interpret JSON encoded data, and describe REST API characteristics – not write working scripts.

Most Candidates Misjudge This Domain

Engineers from a scripting background assume it will be harder than it is; traditional network engineers assume it will be impenetrable. In reality the bar is comprehension.

JSON Is the Concrete Skill

Given a block of JSON, you should be able to read a value out of a nested structure and recognise the difference between an object and an array. Questions typically show data and ask what a particular field contains.

Focus on the Conceptual Contrasts

• Controller-based networking centralises the control plane; traditional networking distributes it
• Configuration management tools push desired state rather than imperative commands
• REST uses HTTP verbs against resource URIs and returns structured data

Knowing why each exists matters more than knowing any product’s syntax.

How Should You Build a CCNA Lab?

A CCNA lab is non-negotiable, and it does not require physical equipment. Cisco Packet Tracer covers the overwhelming majority of 200-301 topics for free, and building configurations by hand is what converts memorised commands into the recall speed the exam demands.

Break Things on Purpose

Configuring a working OSPF adjacency teaches you the commands; deliberately mismatching the area, then the subnet mask, then the hello timer, and watching the adjacency fail each time teaches you what the exam actually tests. Scenario questions describe symptoms, not configurations.

1. Build it working – configure the feature until traffic passes and you understand each command
2. Break it deliberately – introduce one fault at a time and observe the symptom
3. Diagnose from output – use show and debug commands to identify the fault as if you had not caused it
4. Rebuild from memory – reconstruct the topology without notes a few days later

Weight Lab Time by Domain

VLANs and trunking, spanning tree, OSPF, ACLs, and NAT deserve repeated passes; QoS and automation concepts can be handled through reading. Time in the lab should track the weighting table, not your curiosity.

What Roles Does the CCNA Open?

CCNA maps most directly to network administrator, network engineer, NOC technician, and support engineer roles, and it functions as a recognised baseline for infrastructure positions generally. It is one of the few certifications hiring managers outside networking still recognise by name.

Its Strongest Use Is as a Credibility Bridge

Help desk staff moving toward infrastructure, systems administrators inheriting network responsibility, and career changers all benefit disproportionately, because CCNA is concrete evidence of specific knowledge rather than a claim of general aptitude. Candidates weighing the associate options often compare it against the security track first, and the 200-201 versus 200-301 comparison lays out where each one leads.

For Working Engineers, the Value Is Structure

Practical experience tends to be deep in whatever the employer runs and thin everywhere else, and the six domains expose those gaps. It also unlocks the professional-level tracks, where CCNP splits into enterprise, security, collaboration, and data centre specialisations.

Two Practical Notes

The certification is valid for three years and renewable through re-examination or continuing education credits, so treat it as a commitment rather than a one-off. Exams are scheduled through Pearson VUE’s Cisco programme, in a test centre or online with a proctor.

How Should You Structure a CCNA Study Plan?

Ten to twelve weeks at eight to ten hours per week suits most candidates with some IT background, and closer to sixteen weeks for complete beginners. Allocate study time in proportion to the published domain weightings, and spend at least half of every session in the lab rather than reading.

A Twelve-Week Sequence

1. Weeks one to three – fundamentals and addressing. Work through Network Fundamentals and drill subnetting daily until it is instant. Do not progress until IPv4 subnetting is automatic; everything downstream depends on it.
2. Weeks four to six – switching. Build VLANs, trunks, EtherChannel, and spanning tree in the lab. Break each one deliberately and diagnose the symptom.
3. Weeks seven to nine – routing. Static routing, then OSPF in depth, then first-hop redundancy. Practise reading a routing table and predicting which entry wins before checking.
4. Week ten – services and security. NAT, DHCP, DNS, NTP, then ACLs and layer 2 hardening. Write ACLs until placement and ordering are reflexive.
5. Weeks eleven to twelve – automation and review. Cover the programmability concepts, then move to timed full-length practice.

Two Habits That Separate Passes From Retakes

First, take timed practice exams early rather than saving them for the end – they diagnose weak domains far better than self-assessment does. Second, review the questions you answered correctly but guessed at, since those represent knowledge that will not survive a differently worded question. Working through the CCNA 200-301 practice exam under real time pressure reveals whether your pace matches the roughly 75 seconds per question the format allows.

The Cisco Learning Network community is a useful supplement for the topics that resist self-study, particularly spanning tree behaviour and OSPF adjacency troubleshooting.

Frequently Asked Questions

How many questions are on the CCNA 200-301 exam?

The exam contains roughly 90 to 110 questions in 120 minutes. The count varies by form, which works out to approximately 75 seconds per question including simulation items that take considerably longer.

What is the passing score for CCNA?

Cisco does not publish a fixed passing score. Results are scaled on a 1000-point scale with the threshold typically in the 800s, varying with form difficulty. Prepare to be comfortably above the line rather than targeting a specific number.

How much does the 200-301 exam cost?

The exam fee is $300 USD plus applicable taxes. Pricing varies by region, and Cisco periodically offers discounted vouchers through training partners and community programmes.

Are there prerequisites for CCNA?

There are no formal prerequisites. Cisco recommends around one year of experience implementing and administering Cisco solutions, but many candidates pass through structured self-study and lab practice without that background.

Which domain carries the most weight?

IP Connectivity at 25 percent is the largest single domain, covering routing tables, static routing, OSPFv2, and first-hop redundancy. Network Fundamentals and Network Access follow at 20 percent each.

Do I need physical Cisco equipment to prepare?

No. Cisco Packet Tracer is free and covers the overwhelming majority of 200-301 topics. Physical hardware or virtualised alternatives add realism but are not required to pass.

How much programming does the automation domain require?

None. The Automation and Programmability domain is worth 10 percent and tests concepts – interpreting JSON, describing REST API characteristics, and comparing controller-based with traditional architectures. You are not asked to write code.

Is OSPF the only routing protocol on the exam?

OSPFv2 is the only dynamic routing protocol you must configure. Static routing is also tested. EIGRP and BGP are not part of the current 200-301 objectives, so study OSPF in depth rather than routing protocols broadly.

How long is CCNA valid?

The certification is valid for three years. It can be renewed by passing an eligible exam or by earning continuing education credits through Cisco’s recertification programme.

How long does it take to prepare for CCNA?

Ten to twelve weeks at eight to ten hours per week is realistic for candidates with some IT background. Complete beginners should plan for around sixteen weeks, weighting the extra time toward subnetting and hands-on lab work.

Conclusion

Cisco 200-301 remains a demanding exam because it is broad rather than deep, and the published domain weightings are the most useful preparation tool you have. IP Connectivity, Network Fundamentals, and Network Access account for 65 percent between them – routing, addressing, and switching still decide whether you pass.

Build the lab early and use it to break things rather than only to build them. The exam describes symptoms and asks for causes, which is a skill you can only acquire by causing the symptoms yourself and watching what the output looks like.

Plan ten to twelve weeks, drill subnetting until it is reflexive, study OSPF properly rather than broadly, and take timed practice early enough that it can still change how you study. The CCNA has outlasted every technology shift that was supposed to retire it, and it does so because the fundamentals it tests are the ones that keep mattering.