breakfixlearn.com
edge# show ccnp-security

CCNP Security

My study notes for SCOR 350-701 v2.0, the core exam for CCNP and CCIE Security, written while I prepare for it. Every lecture is mapped to Cisco's published exam topics, and every flashcard and practice question links back to the paragraph that explains it.

lectures
1 published
objectives
2/47 have notes
flashcards
60 in the deck
questions
35 in the exam bank

Lectures in study order

  1. D2Network Security: Firewalls, IPS, and VisibilityWhat enforces, where it goes, and how you see what got past it: firewall and IPS solutions and deployment models (2.1) and security monitoring and telemetry (2.2).2.12.238 min · Oct 26, 2026

Exam blueprint coverage

The six domains of the v2.0 exam with their weights. Topics marked notes have a lecture; the rest are on the way. Last update Oct 26, 2026.

20%1.0 Security Concepts0/10 topics · 0 cards · 0 questions

10 exam topics
  1. 1.1Explain attack threats against on-premises, hybrid, and cloud environments such as viruses, trojans, DoS/DDoS, phishing, rootkits, man-in-the middle, malware, data breaches, insecure APIs, compromised credentials, PQC, and AIplanned
  2. 1.2Describe security vulnerabilities and exploits such as software bugs, weak and/or hardcoded passwords, OWASP top ten, missing encryption ciphers, buffer overflow, path traversal, cross-site scripting/forgery, SQL injection, and identification and prioritization using CVEs and CVSS scoresplanned
  3. 1.3Describe vulnerabilities in AI/LLM models such as prompt injection, system prompt leakage, vector and embedding weaknesses, and supply chainplanned
  4. 1.4Describe the controls used to protect against phishing and social engineering attacksplanned
  5. 1.5Describe cryptography security components such as hashing, encryption, PKI, SSL, TLS, QUIC, MASQUE, IPsec, NAT-T IPv4 for IPsec, preshared key, certificate-based authorization, and post-quantum cryptographyplanned
  6. 1.6Describe site-to-site and remote access VPN deployment types such as virtual tunnel interfaces, standards-based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPNplanned
  7. 1.7Describe security intelligence authoring, sharing, and consumptionplanned
  8. 1.8Describe zero trust architectureplanned
  9. 1.9Describe defense in depth strategy such as Secure Architecture for Everyone (SAFE)planned
  10. 1.10Interpret scripts used to call security appliances APIs in a language such as Pythonplanned

25%2.0 Network Security2/10 topics · 60 cards · 35 questions

10 exam topics
  1. 2.1Describe network security solutions and deployment models that provide intrusion prevention and firewall capabilitiesnotes
  2. 2.2Describe security monitoring and telemetry technologiesnotes
  3. 2.3Configure network infrastructure security methods (network segmentation using VLANs or SGTs; Layer 2 and port security; DHCP snooping; Dynamic ARP inspection; storm control; and defenses against MAC, ARP, VLAN hopping, STP, and DHCP rogue attacks)planned
  4. 2.4Select management options for network security solutions (single vs. multidevice manager, in-band vs. out-of-band, on-premises vs. cloud with Cisco Security Cloud Control)planned
  5. 2.5Describe CIS benchmarks for hardening devices such as Cisco Secure Firewall (FTD) and Cisco IOS XEplanned
  6. 2.6Troubleshoot AAA for device and network access such as TACACS+ and RADIUSplanned
  7. 2.7Configure secure network management of perimeter security and infrastructure devices such as SNMPv3, NetConf, RestConf, APIs, secure syslog, and NTP with authenticationplanned
  8. 2.8Implement access control policies, AVC, URL filtering, malware protection, and intrusion prevention using Cisco Secure Firewall (FTD)planned
  9. 2.9Configure site-to-site and remote access VPN using Cisco Secure Firewall (FTD) and Cisco Secure Clientplanned
  10. 2.10Troubleshoot VPN tunnel establishment on Cisco Secure Firewall (FTD)planned

15%3.0 Cloud Security0/7 topics · 0 cards · 0 questions

7 exam topics
  1. 3.1Describe security responsibility within common Cloud Shared Responsibility Modelsplanned
  2. 3.2Select security capabilities, deployment models, cloud security frameworks, and policy management to secure the cloudplanned
  3. 3.3Select security solutions for cloud environments (public; private; hybrid; community cloud; NIST 800-145 SaaS, PaaS, and IaaS; and Cloud Access Security Broker)planned
  4. 3.4Describe network, application, and data security in cloud environments with solutions such as Cisco Multicloud Defense and Cisco Secure Workloadplanned
  5. 3.5Configure Splunk to ingest cloud logging and monitoring data from other security solutionsplanned
  6. 3.6Describe application and workload security concepts including eBPFplanned
  7. 3.7Describe DevSecOps (Infrastructure as Code security, CI/CD pipeline, container orchestration, and secure software development)planned

10%4.0 Secure Service Edge0/5 topics · 0 cards · 0 questions

5 exam topics
  1. 4.1Describe Security Service Edge (SSE) and Secure Access Service Edge (SASE)planned
  2. 4.2Configure Cisco Secure Access Secure Internet Accessplanned
  3. 4.3Configure Cisco Secure Access Secure Private Accessplanned
  4. 4.4Configure data loss prevention and AI guardrails for secure internet accessplanned
  5. 4.5Interpret Cisco Secure Access Investigate scores and indicatorsplanned

15%5.0 Endpoint Protection and Detection0/7 topics · 0 cards · 0 questions

7 exam topics
  1. 5.1Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) solutionsplanned
  2. 5.2Describe endpoint device management and asset inventory systems such as MDMplanned
  3. 5.3Describe endpoint posture assessment solutions to ensure endpoint securityplanned
  4. 5.4Describe endpoint protection and detection security with solutions such as Cisco Secure Client and Cisco Secure Malware Analyticsplanned
  5. 5.5Configure endpoint antimalware protection using Cisco Secure Endpointplanned
  6. 5.6Interpret Cisco Secure Endpoint malware detection eventsplanned
  7. 5.7Configure email security features with Cisco Security Email Threat Defenseplanned

15%6.0 Network Access, Visibility, and Enforcement0/8 topics · 0 cards · 0 questions

8 exam topics
  1. 6.1Describe identity management and secure network access concepts such as guest services, profiling, posture assessment, and BYODplanned
  2. 6.2Describe device compliance and application controlplanned
  3. 6.3Configure network access control mechanisms such as 802.1X and MAB with Cisco Identity Services Engineplanned
  4. 6.4Configure network access with CoAplanned
  5. 6.5Explain exfiltration techniques such as DNS tunneling, HTTPS, email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and cloud storageplanned
  6. 6.6Describe network visibility and enforcement using telemetry and native AI/ML capabilities with XDR and SIEM/SOAR platforms such as Splunk and Cisco XDRplanned
  7. 6.7Describe Cisco Duo in a zero-trust security architecture (Trust Monitor, MFA, Device Trust, health checks, Adaptive Access policies, SSO, and CII)planned
  8. 6.8Describe managing, orchestrating, and automating security information and events with Splunkplanned

Packet Tracer labs

Coming next: showcase walkthroughs with topology, configs and verification output, plus baseline .pkt files to download (each with a SHA-256 hash) so you can build the lab yourself. Topics Packet Tracer can't simulate, such as FTD, ISE and Secure Access, stay conceptual or move to CML.