Associate Cisco · Exam 200-201 · formerly CyberOps Associate

Cisco CCNA Cybersecurity 200-201 Study Guide

CCNA Cybersecurity (formerly CyberOps Associate) is Cisco's associate-level credential for security operations. Exam 200-201 (CCNACBR) validates the skills needed to work in a security operations center (SOC): monitoring, detecting, analyzing, and responding to cybersecurity threats.

Overview

Level

Associate

Vendor

Cisco

Audience

Aspiring SOC analysts, blue-team and security-operations beginners, help desk or networking technicians moving into cybersecurity, and career changers targeting entry-level threat monitoring and incident response roles.

Why get CCNA Cybersecurity

CCNA Cybersecurity proves you can do the day-one work of a SOC tier-1 analyst: read logs, spot intrusions, analyze network and host data, and follow an incident-response process. It is one of the few associate-level certifications built specifically around security operations rather than general security theory, which maps directly to real SOC job tasks. Employers hiring for SOC and blue-team roles treat it as evidence that a candidate understands monitoring tooling, attacker techniques, and the analyst workflow—not just terminology. It also pairs naturally with CompTIA Security+ (a broad security baseline) and CCNA (a networking foundation), forming a strong entry-level cybersecurity resume.

Salary expectations

Typical salary range

$60,000 – $110,000

Entry-level SOC tier-1 analyst roles typically start around $55K–$75K depending on location and clearance. With 2–3 years of monitoring and incident-response experience, SOC analyst and security analyst roles commonly reach $90K–$110K, and senior/blue-team specialists go higher. Government and federal-contractor SOC roles often add strong benefits and clearance premiums on top of base salary.

When to get CCNA Cybersecurity

Get CCNA Cybersecurity if you want to work in a SOC, threat detection, or incident response. It is ideal after—or alongside—CompTIA Security+, which gives broader security fundamentals. A basic grasp of networking (TCP/IP, ports, protocols) makes the network intrusion analysis domain far easier, so some CCNA or Network+ exposure first is a real advantage. If your goal is offensive security (pen testing) or governance/risk rather than defensive operations, other certifications may fit better.

Exam details

Exam Quick Reference

Exam Code
200-201
Vendor
Cisco
Level
Associate
Duration
120 minutes
Format
Multiple-choice and multiple-response questions. Approximately 95–105 questions.
Questions
95–105 questions (approximate; Cisco does not publish the exact count)
Official exam page Verify current pricing

Renewal: Valid for 3 years. Renew by passing another Cisco exam, earning Continuing Education credits through the Cisco CE program, or achieving a higher-level Cisco certification before expiration.

Skills covered

Security Concepts (20%)

  • The CIA triad and core security principles
  • Common attack types, the cyber kill chain, and MITRE ATT&CK
  • Defense-in-depth and security deployment models
  • Risk, vulnerabilities, exploits, and threat actors
  • Access control models and security terminology

Security Monitoring (25%)

  • Network data types: full packet capture, session/NetFlow, and transaction data
  • Reading and interpreting logs from common sources
  • Detecting attacks in network traffic (DNS, web, and email-based)
  • Impact of encryption, NAT, and tunneling on visibility
  • Common artifacts used to identify malicious activity

Host-Based Analysis (20%)

  • Endpoint components: processes, the registry, and file systems
  • Endpoint logs and host-based intrusion detection
  • Interpreting malware analysis reports
  • Identifying indicators of compromise on a host
  • Windows and Linux host investigation basics

Network Intrusion Analysis (20%)

  • Interpreting IDS/IPS and firewall events
  • Analyzing packet captures with Wireshark and tcpdump
  • Mapping events to protocol headers and PDUs
  • Extracting files and artifacts from captured traffic
  • Distinguishing true positives, false positives, and benign traffic

Security Policies and Procedures (15%)

  • The incident response process (NIST SP 800-61)
  • SOC metrics, runbooks, and the analyst workflow
  • Evidence handling and chain of custody
  • The VERIS framework and incident categorization
  • Network and server profiling concepts

Step-by-step study path

This sequence reflects what consistently works for SOC-bound candidates. Follow it in order—don't skip ahead.

  1. 1

    Download the official 200-201 exam topics

    Get the official CCNACBR (200-201) exam topics from the Cisco Learning Network. The five domains and their weightings are your study roadmap—review them before buying any course so you study what the exam actually tests.

  2. 2

    Shore up networking fundamentals

    The Security Monitoring and Network Intrusion Analysis domains together are 45% of the exam, and both assume you can read TCP/IP, ports, and protocol behavior. If networking is new to you, spend time here first—CCNA or Network+ material is more than enough background.

  3. 3

    Work through a primary video course

    Choose one comprehensive 200-201 video course and complete it end to end rather than jumping between several. A full CyberOps Associate course on Udemy covers all five domains with worked examples. See the paid resources section for options.

  4. 4

    Read the official cert guide

    The Cisco Press CyberOps Associate Official Cert Guide by Omar Santos is the only Cisco-approved self-study book. Use it alongside your video course to reinforce the host-based and intrusion-analysis topics that need more depth than video alone.

  5. 5

    Get hands-on with SOC tools

    This exam rewards practical analyst skills. Practice with Wireshark on sample captures, explore logs in a tool like Security Onion, and work through TryHackMe's SOC Level 1 path. Hands-on reps make the monitoring and intrusion-analysis questions far easier.

  6. 6

    Practice reading logs and packet captures

    Drill the core analyst task: given a log entry or packet capture, decide whether it is malicious, benign, or a false positive—and why. Many exam questions are scenario-based and test exactly this judgment, not memorization.

  7. 7

    Take timed practice exams

    Once you have covered all five domains, work through practice exams under timed conditions. Aim to score consistently above 85% before booking. Review every wrong answer until you understand the underlying concept, not just the correct option.

  8. 8

    Schedule and sit the exam

    Register through Pearson VUE and take the 120-minute exam at a test center or online proctored. Book about two weeks out to set a firm deadline. Arrive rested—scenario questions reward clear thinking over cramming.

Starting step 3?

A full CyberOps Associate course on Udemy covers all five 200-201 domains. See the paid resources section below for options and pricing.

View course options →

Free resources

Official Documentation Cisco 200-201 CCNACBR Exam Topics (Official)

The official exam blueprint with all five domains and their weightings. This is your study roadmap—start here.
Community Cisco Learning Network – CyberOps Community

Official study groups, discussion forums, and free study materials for the CCNACBR exam. Search before posting—most common questions are already answered.
Hands-on Labs TryHackMe – SOC Level 1 Learning Path

Browser-based blue-team labs covering log analysis, SIEM, network and endpoint investigation. The free rooms map directly to 200-201 monitoring and intrusion-analysis skills.
Video Course MyDFIR – SOC Analyst Series (YouTube)

Free, practical SOC-analyst content on detection, log analysis, and incident response—useful for building the hands-on intuition the exam tests.
Community r/cybersecurity on Reddit

Active community with SOC career advice and recent exam-experience reports. Useful for understanding what tier-1 SOC work actually looks like.

Vouchers & exam cost

Buy 200-201 CyberOps Exam Voucher – Cisco Official

The 200-201 exam is $300 USD at standard pricing and is scheduled through Pearson VUE. Always verify current pricing on the official Cisco site before purchasing.

Frequently asked questions

Is CCNA Cybersecurity the same as CyberOps Associate?

Yes. As part of Cisco's 2026 certification rebrand, the Cisco Certified CyberOps Associate was renamed CCNA Cybersecurity. The exam code (200-201) and content are essentially the same—only the name changed. You will still see both names used interchangeably for a while.

Is CCNA Cybersecurity good for beginners?

Yes, for people targeting security operations. There are no formal prerequisites. It is genuinely entry-level for the SOC analyst path, but it assumes some comfort with networking (TCP/IP, ports, protocols). Complete beginners should spend a few weeks on networking basics first.

How hard is the 200-201 exam?

It is a real associate-level exam. The questions are scenario-based and test analyst judgment—reading logs and packet captures and deciding what is malicious—rather than pure memorization. Most candidates find the monitoring and intrusion-analysis domains the toughest because they require hands-on practice.

How long does it take to study for CCNA Cybersecurity?

Most candidates spend 2 to 4 months part-time. Those with existing networking or security experience (for example, after Security+) may be ready in 6 to 8 weeks. Hands-on practice with tools like Wireshark and TryHackMe matters as much as video completion.

Do I need CCNA or networking knowledge first?

Not formally, but it helps a lot. Nearly half the exam involves analyzing network traffic and intrusions, which is far easier if you already understand IP addressing, ports, and protocols. CCNA or CompTIA Network+ material is more than enough background—you do not need to pass them first.

CCNA Cybersecurity or CompTIA Security+ — which should I get first?

Security+ is broader and is the more common hiring baseline, so many people start there. CCNA Cybersecurity is more focused on hands-on SOC operations. They complement each other well: Security+ for the broad fundamentals, CCNA Cybersecurity to prove you can do real monitoring and analysis work.

What certification comes after CCNA Cybersecurity?

The natural Cisco progression is CCNP Cybersecurity (formerly CyberOps Professional). Many SOC analysts also branch out to vendor-neutral certs like CompTIA CySA+ for threat detection, or pursue blue-team/DFIR credentials as they specialize.

Does CCNA Cybersecurity expire?

Yes. Like all Cisco associate certifications, it is valid for three years. Renew it by passing another Cisco exam, earning Continuing Education credits through the Cisco CE program, or achieving a higher-level Cisco certification before it expires.

Ready to study?

Start with the free Cisco exam topics and TryHackMe's SOC Level 1 path, then add the Udemy course and Omar Santos' official cert guide for full coverage.

Udemy View recommended course
Explore more Cisco certs