CCNP SCOR 350-701 Study Guide (v2.0): What Changed, Domains and Labs

SCOR (350-701, Implementing and Operating Cisco Security Core Technologies) is the core exam of CCNP Security and the qualifying exam for the CCIE Security lab. Since 27 August 2026 the live version is v2.0: a 120-minute exam across six domains, from security concepts and Cisco Secure Firewall to cloud security, Secure Service Edge with Cisco Secure Access, endpoint protection, ISE, Duo, Splunk and Cisco XDR. Passing it on its own earns the Cisco Certified Specialist – Security Core certification.

v2.0 is a rewrite, not a refresh, and a lot of older study material is now partly out of date. This guide covers what changed from v1.1, what each domain asks of you, a 12-week plan and the labs that are realistic to build at home. Before you book, read Cisco's official SCOR v2.0 exam topics; that page is the only source that counts.

SCOR 350-701 at a glance

What changed in SCOR v2.0?

Start with the domains. One was replaced outright and three changed weight:

New or expanded in v2.0

• AI as threat and attack surface. A new topic on AI/LLM vulnerabilities (prompt injection, system prompt leakage, vector and embedding weaknesses, supply chain), AI guardrails in Secure Access, and AI/ML in XDR and SIEM/SOAR.
• Modern cryptography. Post-quantum cryptography, TLS, QUIC and MASQUE next to PKI and IPsec; SSL VPN and GETVPN among the VPN types.
• Secure Service Edge replaces Content Security. SSE and SASE concepts and configuring Cisco Secure Access.
• Cisco Secure Firewall (FTD) at the center of network security. Policy, VPN configuration and VPN troubleshooting on FTD, plus cloud management with Cisco Security Cloud Control.
• Hardening and prioritizing. CIS benchmarks for Secure Firewall and IOS XE; CVEs and CVSS scores; zero trust and Cisco SAFE.
• Cloud, visibility and identity. Cisco Multicloud Defense, Cisco Secure Workload, eBPF, Splunk, Cisco XDR and Cisco Duo.
• Higher verbs. AAA moved from configure to troubleshoot; Change of Authorization from describe to configure.

Gone or reduced

• Content Security: web proxy redirection, Secure Web Appliance, the Secure Email Gateway and configuring Umbrella. Email security survives in the endpoint domain as Cisco Secure Email Threat Defense.
• SDN northbound and southbound APIs and Cisco DNA Center APIs.
• Configuring VPNs on IOS routers and with AnyConnect. IOS VPN types remain, at describe level.
• The named analytics products of v1.1 (Secure Network Analytics, Secure Cloud Analytics, pxGrid, Encrypted Traffic Analytics and others); visibility is now framed around XDR and Splunk.

What is on the SCOR v2.0 exam?

Here is what each domain contains according to the official topics, and what that means for your preparation.

The AI items line up closely with the OWASP Top 10 for LLM Applications, so read that list. For post-quantum cryptography, know the problem and the fix. A large enough quantum computer would break RSA and elliptic-curve key exchange and signatures, and "harvest now, decrypt later" makes that a current risk for long-lived secrets; the answer is NIST's post-quantum standards such as ML-KEM and ML-DSA, often deployed in hybrid mode next to classical algorithms. QUIC runs over UDP with TLS 1.3 built in, which makes it hard for inspection devices to see into; MASQUE uses HTTP/3 to tunnel UDP and IP traffic through a proxy. For Python you won't write code, just read a script and say which endpoint it calls, how it gets a token and what it does with the JSON.

This is the biggest domain, and v2.0 centers it on Cisco Secure Firewall Threat Defense. Know in broad strokes how FTD evaluates a connection (prefilter, security intelligence, then access control rules, with intrusion and file policies attached to the rules that allow traffic), the management options (Secure Firewall Management Center, the on-box device manager, Security Cloud Control) and the deployment modes (routed or transparent; inline or passive IPS). Troubleshoot VPNs in stages: does IKE phase 1 come up (proposals, authentication, UDP 500 and 4500), does phase 2 come up (protected networks must match), does traffic flow (NAT exemption, routing, access control)? Layer 2 security and AAA carry over from CCNA and ENCOR; if you know them, they are the cheapest marks on the exam.

Know who is responsible for what in IaaS, PaaS and SaaS. Multicloud Defense gives consistent network security and policy across public clouds; Secure Workload gives workload visibility and microsegmentation, allowing only the flows an application needs. eBPF lets security tools observe and enforce inside the Linux kernel without kernel modules. The Splunk item is a configure topic: know how data gets in (forwarders, the HTTP Event Collector, add-ons for the source product) and how you search it.

SSE is the security half of SASE (secure web gateway, CASB, zero trust network access and firewall as a service, delivered from the cloud); SASE adds the networking half, typically SD-WAN. Cisco's SSE is Cisco Secure Access. Secure Internet Access protects users going to the internet, including DLP and guardrails for AI applications. Secure Private Access connects users to private applications, per application with zero trust access or with VPN as a service. Investigate is the threat intelligence view; learn what its risk scores and indicators mean.

EPP tries to stop a threat before it runs; EDR assumes something gets through and gives you the telemetry to detect, investigate and respond. For Secure Endpoint, learn policies, groups and exclusions, and how to read an event: what was detected, where, with what file disposition. Secure Malware Analytics is the sandbox that produces a behavior report for a submitted file.

The ISE part is the most hands-on. Know the 802.1X roles (supplicant, authenticator, authentication server), what MAB does for a device without a supplicant, and why CoA exists: ISE needs a way to change an authorized session when profiling or posture learns something new. Keep three things apart: a SIEM collects, correlates and searches events; a SOAR automates the response; XDR correlates detections across endpoint, network, email and cloud into incidents. Duo is tested as part of zero trust (MFA, Device Trust, Trust Monitor, Adaptive Access, SSO): verify the user, verify the device, then decide per application.

How hard is SCOR?

Cisco doesn't publish pass rates or the passing score, so any number you read is a guess. What makes SCOR hard is breadth: switch-port security, firewall policy, cloud architecture, endpoint tools, identity, SIEM and AI risks, many of them in products you have never logged into. v2.0 also raised the bar on Secure Firewall, with explicit topics on FTD policy and VPN troubleshooting.

If you come from routing and switching, the product-heavy topics (Secure Access, Secure Endpoint, XDR, Splunk, Multicloud Defense) will take most of your time, because you have to learn both the concept and Cisco's implementation of it. 120 minutes is enough if you know the material, but not enough to work things out from scratch.

One lesson from failing my first CCNA attempt with 58% applies here too: recognizing a topic when you read about it is not the same as answering correctly under time pressure. Test yourself before you book, not after.

How long should you study for SCOR v2.0?

A realistic range is 12 to 20 weeks at 8 to 10 hours a week, depending on how much of the Cisco security portfolio you already use. The plan below is 12 weeks for someone with CCNA-level networking and some security background; if FTD and ISE are new to you, double weeks 4 to 7.

Which labs should you build for SCOR?

SCOR mixes things you can lab at home with cloud services you can't. The first five labs run in Cisco Modeling Labs (CML), EVE-NG or GNS3 with legally obtained images; the last two rely on trials and Cisco's own hands-on labs.

1. Layer 2 security. On IOSvL2 switches: port security, DHCP snooping against a rogue DHCP server on a Linux node, Dynamic ARP Inspection, storm control. Trigger each one and read what it logs.
2. IOS VPNs. An IKEv2 tunnel with VTIs, then DMVPN or FlexVPN. Put a NAT router in the path and watch NAT-T move IKE to UDP 4500. It's describe level, but building it once makes the VPN types easy to tell apart.
3. Secure Firewall. FTDv managed by a virtual Secure Firewall Management Center, both in evaluation mode. Build an access control policy with AVC and URL filtering, attach intrusion and file policies, then a site-to-site VPN to an IOS router and remote access with Cisco Secure Client. Break the VPN on purpose: mismatched proposals, a missing NAT exemption, protected networks that don't match.
4. ISE. 802.1X and MAB on a switch port against ISE in evaluation mode; trigger a CoA and watch the session change. ISE needs a lot of RAM, so check your host first.
5. Secure management and APIs. SNMPv3 authPriv, authenticated NTP, syslog to a collector, and a short Python script that reads data over RESTCONF from IOS XE. Writing one script makes the "interpret this script" questions much easier.
6. Splunk. A Splunk Enterprise trial on a Linux VM, receiving syslog from your routers and firewall and data through an HTTP Event Collector input. Write searches that answer real questions, such as which VPN peers failed.
7. Cloud-delivered products. Secure Access, Secure Endpoint, XDR, Duo, Multicloud Defense, Secure Workload and Email Threat Defense can't run in a home lab. Use free or trial accounts where offered, Cisco U. hands-on labs and the walkthroughs in Cisco's documentation. Aim to know the screens, the policy objects and the order of steps.

How to study for SCOR

• Work from the v2.0 topics, not a v1.1 course outline. Check that every book, video course and question bank you use says v2.0.
• Learn each product the same way. What problem does it solve, where does it sit, what are its policy objects, and what do its events look like?
• Practise against the clock. SCOR is broad, so timed practice is also how you find the domains you've been avoiding.
• Reuse what you know from the enterprise track. AAA, 802.1X, ACLs and CoPP also appear in ENCOR's security domain; my CCNP ENCOR study guide covers that side.

SCOR FAQ

CertAce is not affiliated with or endorsed by Cisco Systems. Cisco, CCNP and CCIE are trademarks of Cisco Systems, Inc. Exam facts on this page come from Cisco's published exam topics for 350-701 SCOR v2.0; check that page for changes before you book.