Ccnp Security Course Outline May 2026

Best for: Firewall administrators migrating from ASA to FTD.

Best for: Web Security Specialists.

The CCNP Security course outline is intimidating, but it is also the most practical certification for modern networking. A CCNA shows you can route packets; a CCNP Security shows you can stop malicious packets.

By mastering the 350-701 SCOR (policy, cloud, and infrastructure) and a concentration like 300-710 SNCF (NGFW management), you prove you can architect a Zero-Trust solution, harden cloud perimeters, and stop ransomware at the gateway.

Next Steps: Download the official Cisco exam blueprints (v1.1 as of 2025), subscribe to a lab platform (Cisco DevNet Sandbox or EVE-NG Community), and start with configuring a simple IPsec tunnel. The outline is your map; the lab is your engine.

The Cisco Certified Network Professional (CCNP) Security certification is a professional-level credential designed to validate your skills in securing complex network infrastructures. To earn this certification, you must pass two exams: the mandatory Core Exam (SCOR 350-701) and one Concentration Exam of your choice. 1. Mandatory Core Exam: SCOR 350-701

The Implementing and Operating Cisco Security Core Technologies (SCOR) exam covers the foundational knowledge required for any security professional.

Security Concepts (25%): Common threats in on-premises, cloud, and hybrid environments; security vulnerabilities like SQL injection and cross-site scripting.

Network Security (20%): Comparing IPS and firewall solutions; implementing network foundation protection (NFP) and securing routing protocols.

Securing the Cloud (15%): Security solutions for cloud environments and shared responsibility models. ccnp security course outline

Content Security (15%): Implementing web proxy redirection, authentication, and Cisco Umbrella.

Endpoint Protection and Detection (10%): Comparing EPP and EDR solutions; managing malware and outbreaks.

Secure Network Access, Visibility, and Enforcement (15%): Identity management concepts (BYOD, profiling, posture) and Cisco ISE basics. 2. Concentration Exam Options

You must choose one of the following to complete your CCNP Security certification: Exclusive Cisco CCNP Security Syllabus - Updated 2026

Module 1: Adaptive Security Appliance (v9.14) ASA Overview and History. ASA deployment. Bootstrapping and basic ASA configuration. Network Kings

Cisco CCNP Security Gets a Major Upgrade: What You Need to Know

To earn the CCNP Security certification, candidates must pass two exams: the core exam (SCOR 350-701) and one security concentration exam of their choice. The curriculum focuses on securing enterprise networks through firewalls, VPNs, identity management, and automation.  1. Core Exam: 350-701 SCOR 

The Implementing and Operating Cisco Security Core Technologies (SCOR) exam serves as the foundation, covering six critical domains: 

Security Concepts (25%): Threat intelligence, common attacks (phishing, social engineering), cryptography, and cloud service models (SaaS, PaaS, IaaS). Best for: Firewall administrators migrating from ASA to FTD

Network Security (20%): Configuring firewalls (NGFW), site-to-site and remote access VPNs, and NetFlow-based threat detection.

Securing the Cloud (15%): Application and data security in hybrid/cloud environments and implementing DevSecOps principles.

Content Security (15%): Configuring email security features and web security via Cisco Umbrella and proxy redirection.

Endpoint Protection and Detection (10%): Antimalware (AMP), endpoint management, and multi-factor authentication.

Secure Network Access, Visibility, and Enforcement (15%): Implementing 802.1X, AAA protocols (RADIUS/TACACS+), and network segmentation.  2. Concentration Exams (Choose One) 

Candidates specialize by passing one of the following exams, each focusing on a specific technology or solution:  Exam Code  Key Topics Covered 300-710 SNCF Securing Networks with Cisco Firepower

Deployment of Cisco Firepower NGFW and NGIPS, policy management, and troubleshooting. 300-715 SISE Implementing and Configuring Cisco ISE

Identity Services Engine (ISE) configuration, 802.1X, BYOD, and guest access. 300-720 SESA Securing Email with Cisco ESA

Protection against SPAM, phishing, and malware using Email Security Appliances. 300-725 SWSA Securing the Web with Cisco WSA The CCNP Security course outline is intimidating, but

Web filtering, transparent user identification, and proxy configuration. 300-730 SVPN Implementing Secure Solutions with VPNs

Site-to-site (DMVPN, FlexVPN) and remote access VPN solutions. 300-735 SAUTO Automation for Cisco Security

Programming security tasks using Python and Ansible via APIs. Quick Facts for Candidates 

Prerequisites: There are no formal prerequisites for taking the exams, though 3–5 years of security experience is recommended.

Training Resources: Official study materials are available through Cisco Press.

Certification Validity: The CCNP Security certification is valid for three years.  CCNP Security certification - Cisco

You must pass one of the following in addition to SCOR.

This is the mandatory foundational exam. It covers six major domains with percentage weights indicating emphasis.

| Domain | Topics Covered | Approx. Weight | |--------|----------------|----------------| | 1. Security Concepts | Threat intelligence, cryptography fundamentals (PKI, hashing, encryption), security frameworks (NIST, ISO), risk management, and DevSecOps principles. | 20% | | 2. Network Security | Network access control (802.1X, MAB), zone-based firewalls, Cisco IOS security features (CoPP, ACLs), and segmentation (VRF-Lite, micro-segmentation). | 20% | | 3. Securing the Cloud | Cloud security models (IaaS, PaaS, SaaS), Cisco Umbrella, cloud-native security (AWS/Azure security groups), and CASB integration. | 15% | | 4. Content Security | Web and email security appliances (Cisco WSA, ESA), filtering techniques, anti-malware policies, and data loss prevention (DLP). | 15% | | 5. Endpoint Protection & Detection | Cisco AMP for endpoints, endpoint detection and response (EDR), malware analysis, and forensic data collection. | 15% | | 6. Secure Network Access & Visibility | Identity Services Engine (ISE) policies, guest access, BYOD, network visibility with NetFlow/IPFIX, and stealthwatch. | 15% |