SCOR 350-701 v2.0 vs v1.1: every change explained

Short version. SCOR v2.0 has been the only version since 27 August 2026. Content Security (web and email appliances) is gone, a new Secure Service Edge domain (Cisco Secure Access) takes its place, Network Security grows to 25%, and new topics include AI/LLM attacks, post-quantum cryptography, zero trust, Splunk, Cisco Duo and Multicloud Defense. The exam is still 120 minutes and still the core exam for both CCNP Security and CCIE Security.

Key dates

There was no overlap window: since 27 August you can only book v2.0.

Domain weights: v1.1 vs v2.0

Weights come from Cisco's published exam topics for each version. Network Security plus Endpoint now make up 40% of the exam, up from 30%.

1.0 Security Concepts (25% → 20%)

• New: AI. AI-driven attacks appear in the threat list (1.1), and there is a whole objective on vulnerabilities in AI/LLM models: prompt injection, system prompt leakage, vector and embedding weaknesses, supply chain (1.3).
• New: post-quantum cryptography in both threats (1.1) and crypto components (1.5), along with QUIC and MASQUE.
• VPN types widened (1.6): SSL VPN and GETVPN join VTI, IPsec, DMVPN and FlexVPN.
• New: zero trust architecture (1.8) and defense in depth with Cisco SAFE (1.9).
• Dropped: SDN northbound/southbound APIs and Cisco DNA Center APIs. The Python API-script objective stays (1.10).
• Vulnerability prioritisation with CVE and CVSS is now named explicitly (1.2).

2.0 Network Security (20% → 25%)

• The two v1.1 firewall/IPS objectives merge into one: 2.1 network security solutions and deployment models for firewall and IPS. Read my free notes for 2.1 and 2.2.
• v1.1's NetFlow objective grows into 2.2 security monitoring and telemetry technologies (NetFlow, telemetry, SNMPv3, syslog, NDR and more).
• New: CIS benchmarks for hardening Secure Firewall (FTD) and IOS XE (2.5).
• Segmentation now names SGTs alongside VLANs (2.3).
• Management options name Cisco Security Cloud Control (formerly CDO) (2.4).
• AAA changes from configure to troubleshoot TACACS+ and RADIUS (2.6).
• VPN moves onto the firewall. v1.1 tested site-to-site VPN on IOS routers. v2.0 asks you to configure site-to-site and remote access VPN on Secure Firewall (FTD) with Secure Client (2.9) and to troubleshoot FTD tunnel establishment (2.10). This is where the retired SVPN exam's content went.

3.0 Cloud Security (15%, new content)

• Named products: Cisco Multicloud Defense and Cisco Secure Workload (3.4).
• New: Splunk: configure it to ingest cloud logging and monitoring data (3.5).
• New: eBPF for application and workload security (3.6).
• DevSecOps now includes Infrastructure as Code security (3.7).
• The v1.1 sub-topics on cloud patch management and cloud security assessments are no longer listed.

4.0 Secure Service Edge (new, 10%) replaces Content Security

The whole v1.1 Content Security domain (web proxy redirection and identity, Secure Email Gateway, Secure Web Appliance, and Umbrella configuration) is gone. In its place:

• Describe SSE and SASE (4.1).
• Configure Cisco Secure Access: Secure Internet Access (4.2) and Secure Private Access (4.3).
• Configure DLP and AI guardrails for internet access (4.4).
• Interpret Secure Access Investigate scores and indicators (4.5).

If your v1.1 book has big chapters on WSA, ESA and Umbrella dashboards, you can skim them. DNS-layer security and SWG concepts still matter, now through Secure Access.

5.0 Endpoint Protection and Detection (10% → 15%)

• Named products: Cisco Secure Client and Secure Malware Analytics (5.4).
• Configure Cisco Secure Endpoint (5.5) and, new, interpret its malware detection events (5.6).
• Email moved here: configure Cisco Security Email Threat Defense (5.7), the cloud email security product, instead of the old ESA appliance.
• The v1.1 objectives on MFA strategy and endpoint patching are no longer listed on their own. MFA comes back through Cisco Duo in domain 6.

6.0 Network Access, Visibility, and Enforcement (15%, new content)

• 802.1X and MAB with Cisco ISE (6.3). WebAuth is no longer named.
• CoA moves from describe to configure (6.4).
• Exfiltration techniques add cloud storage (6.5).
• The v1.1 product list (Secure Network Analytics, Secure Cloud Analytics, pxGrid, Umbrella Investigate, Cognitive Intelligence, ETA, NVM) is replaced by telemetry with native AI/ML in Cisco XDR and SIEM/SOAR platforms such as Splunk (6.6) and managing and automating events with Splunk (6.8).
• New: Cisco Duo in a zero-trust architecture: Trust Monitor, MFA, Device Trust, health checks, Adaptive Access, SSO (6.7).

What happened to the concentration exams

You still need SCOR plus one concentration exam for CCNP Security.

Can you still use v1.1 study material?

Partly. Roughly the concepts half carries over: threats, cryptography, VPN theory, firewall and IPS fundamentals, Layer 2 security, AAA, NetFlow, ISE and 802.1X, exfiltration. What doesn't carry over:

• Everything on WSA, ESA and Umbrella configuration (old domain 4).
• Site-to-site VPN configured on IOS routers as the main VPN skill. v2.0 wants FTD and Secure Client.
• SDN and DNA Center API objectives.
• Old product names: Stealthwatch, AMP for Endpoints, Threat Grid, AnyConnect and CDO now appear as Secure Network Analytics, Secure Endpoint, Secure Malware Analytics, Secure Client and Security Cloud Control.

And nothing in a v1.1 book covers AI/LLM security, PQC, QUIC/MASQUE, zero trust, SAFE, CIS benchmarks, Splunk, Duo, Multicloud Defense, Secure Workload, eBPF or Secure Access. Plan new material for those.

SCOR v2.0 FAQ

If I passed SCOR v1.1, do I need to retake it?

No. Cisco confirmed that a SCOR v1.1 pass still counts toward CCNP Security when combined with any concentration exam, including one taken on or after 27 August 2026. After passing one CCNP-level exam you have three years to pass the other.

How long is the SCOR v2.0 exam, and how many questions does it have?

It is a 120-minute exam. Cisco does not publish a fixed question count or passing score, so treat any exact number you see online as a guess.

Is SCOR still the CCIE Security qualifying exam?

Yes. Cisco lists SCOR 350-701 v2.0 as associated with both the CCNP Security and CCIE Security certifications.

Is there a free SCOR v2.0 practice exam?

Cisco's official practice exam is expected by the end of 2026. Until then you can use my free SCOR v2.0 mock exam: original questions weighted like the real blueprint, with a timed mode, a practice mode, and explanations that link to the notes.

Which domain should I study first?

Network Security (25%) is now the largest domain and underpins everything else. Start with firewall, IPS and telemetry (2.1, 2.2), then work through the rest. The blueprint coverage map shows which topics have notes so far.