Updated 1 Nov 2026 · 6 min read
On this page
What the Cisco CCNA Cybersecurity 200-201 is and who it is for
The 200-201 CCNACBR, Understanding Cisco Cybersecurity Operations Fundamentals, is the one exam behind the CCNA Cybersecurity certification. Cisco describes it as a test of security concepts, security monitoring, host-based analysis, network intrusion analysis, and security policies and procedures. Cisco pitches it at people launching a career in cybersecurity operations, the work done in a security operations centre (SOC).
If the name is unfamiliar, that is because it is new. Until early 2026 this was the CyberOps Associate certification and the exam code was CBROPS. Cisco rebranded its cybersecurity certifications under the CCNA and CCNP names from February 2026, and anyone who already held an active CyberOps certification was recognised at the matching new level automatically. The exam number stayed 200-201. The current version is v1.2, whose exam topics document dates from July 2025. There are no prerequisites, and passing the exam alone earns you the certification.
Cisco CCNA Cybersecurity 200-201 at a glance
| Item | Detail |
|---|---|
| Exam code | 200-201 CCNACBR (version 1.2) |
| Time allowed | 120 minutes |
| Exam fee | US$300, or Cisco Learning Credits |
| Languages | English |
| Where you sit it | Pearson VUE, at a test centre or online |
| Certification valid for | 3 years |
Two rows are missing on purpose. Cisco does not publish a question count for this exam, and it does not publish passing scores either. Its policy says passing scores are set by statistical analysis and may change without notice.
What is on the exam
Security concepts (20%). The vocabulary of defence. You compare security deployments (network, endpoint and application tools, agentless versus agent-based protection, SIEM, SOAR, containers and cloud), define terms such as threat hunting, run book automation and sliding window anomaly detection, and separate risk, threat, vulnerability and exploit. Access control models and the CVSS metrics are here, as is the 5-tuple approach to isolating a compromised host in a set of logs.
Security monitoring (25%). The largest domain. It asks what data each technology gives you, from TCP dump and NetFlow to next-generation firewalls and email filtering, and how NAT, tunnelling, TOR, encryption and load balancing reduce what you can see. It also covers the attack families (network, web application, social engineering including generative AI, endpoint), evasion techniques and certificates: cipher suites, X.509, key exchange and PKCS.
Host-based analysis (20%). What happens on the endpoint. Host intrusion detection, antimalware and host firewalls, now described in terms of rules, signatures and predictive AI. You identify Windows and Linux components, the role of attribution (assets, indicators of compromise and attack, chain of custody), classify evidence as best, corroborative or indirect, and read operating system, SIEM, SOAR and command line logs, plus sandbox reports.
Network intrusion analysis (20%). The packet level. You map events to the technology that produced them, sort true and false positives and negatives, compare deep packet inspection with stateful filtering and taps with inline interrogation, pull files out of a TCP stream in Wireshark, read protocol header fields from Ethernet up to HTTP/2 and interpret basic regular expressions.
Security policies and procedures (15%). Process and frameworks. Asset, patch and vulnerability management, incident response as NIST SP 800-61 describes it, evidence handling from NIST SP 800-86, network and server profiling, protected data types (PII, PSI, PHI, intellectual property), the Cyber Kill Chain and Diamond Model, and SOC metrics such as time to detect and time to contain.
Why people fail it
The 200-201 reads like a shift in a SOC. Many of its objectives ask you to interpret raw evidence, not just recall a definition: a PCAP file, operating system or SIEM logs, a NetFlow record or a sandbox report, and what the analyst should conclude from it. Candidates who learnt definitions from slides but never practised reading raw output are the ones who come out short.
The second trap is near-identical categories. Best versus corroborative versus indirect evidence, true positive versus benign, discretionary versus nondiscretionary access control, and which NIST 800-61 phase a stakeholder belongs in all look easy until the plausible answers sit side by side. Learn the distinction, not just the word.
Third, people skip the unglamorous objectives. Regular expressions, CVSS terms, certificate components, evidence collection order and volatile data collection are small topics, but each is listed in the exam topics and each can cost you marks. Finally, the v1.2 AI wording (generative AI social engineering, predictive AI in endpoint tools) is missing from older study material written for v1.1.
A study plan that fits the exam
Seven weeks at a steady pace, with the extra week going to security monitoring because it carries the most weight. Before week one, try the free 200-201 practice questions to see where you stand.
- Week 1, security concepts. CIA triad, deployment types, access control models and CVSS metrics.
- Week 2, security monitoring part one. Data types (full packet capture, session, transaction, statistical, metadata, alert) and what each technology produces. Capture your own traffic and open it in Wireshark.
- Week 3, security monitoring part two. Attack families, evasion, and certificates. Inspect a real TLS handshake and name every component.
- Week 4, host-based analysis. Windows and Linux internals, log reading, evidence types and sandbox reports. Read real event logs, not summaries of them.
- Week 5, network intrusion analysis. Protocol headers, file extraction from a PCAP, alert classification and regex.
- Week 6, security policies and procedures. NIST SP 800-61 and 800-86, profiling, protected data, the Kill Chain and Diamond Model.
- Week 7, timed practice. Work through the 462-question 200-201 practice pack with answers first, then the questions-only copy against a 120-minute clock. Go back to the domain behind every miss.
On exam day
Cisco delivers its associate written exams through Pearson VUE, both in person and online. At a test centre you need two forms of identification, both signed, and one must be a government-issued photo ID. Pearson VUE also captures your photo and a digital signature, and you cannot take anything into the exam room, including notes, watches or your phone.
Online, check-in opens 30 minutes before your appointment, so be ready when it does. Cisco's online testing guidance says its exams have no scheduled break, and leaving your computer ends the session. Physical pens, paper and whiteboards are not allowed, although OnVUE may offer an on-screen whiteboard. When you finish, you receive a score report with your performance by exam section.
Frequently asked questions
How soon can I retake the 200-201 if I fail?
Cisco makes you wait five calendar days, counting from the day after the failed attempt, before you sit the same associate exam again. If you pass, you cannot take the same exam number again for at least 180 days.
How do I keep the certification active?
It is valid for three years. You can recertify by earning 30 Continuing Education credits, by retaking the exam, or by advancing to the next certification level, as long as you do it before it expires. If it lapses, you start the full exam process again.
Is this still worth taking now it is called CCNA Cybersecurity?
The rename did not bring a new exam version: the exam is still v1.2, whose topics document predates the rename, so v1.2 material still applies. The new name puts it under the CCNA brand, which Cisco argues employers already treat as a benchmark, and it is the associate step before CCNP Cybersecurity.
Is a practice pack enough on its own?
No. Practice questions show you how Cisco frames scenarios and where your gaps are, but they do not teach you to read a packet capture. Pair them with hands-on time in Wireshark and real logs, and use the exam topics document as your checklist.
When your practice scores are steady, get the full Cisco 200-201 practice pack for your final weeks of timed revision.
Sources
The official pages the facts in this guide were checked against.
- cisco.com/site/us/en/learn/training-certifications/exams/ccnacbr.html
- cisco.com/site/us/en/learn/training-certifications/certifications/cybersecurity/ccna-cybersecurity/index.html
- learningcontent.cisco.com/documents/marketing/exam-topics/200-201-CBROPS-v1.1.pdf
- blogs.cisco.com/learning/par-merat-announces-learn-with-cisco
- learningcontent.cisco.com/documents/marketing/exam-topics/200-201-CCNACBR-v1.2_02July2025.pdf
- cisco.com/site/us/en/learn/training-certifications/exams/registration.html
- cisco.com/site/us/en/learn/training-certifications/exams/index.html
- cisco.com/site/us/en/learn/training-certifications/exams/policies.html
- cisco.com/c/dam/en_us/training-events/exams/online-testing-faq.pdf
- cisco.com/site/us/en/learn/training-certifications/certifications/recertification/index.html
What people say about this pack
WOW!!! I passed my 200-201 exam earlier this morning. The pdf file is really helpful. I learnt more from the questions and finally, I passed my 200-201 exam successfully.
Excellent question answers for CyberOps Associate exam . Prepared me well for the exam. Scored 92% in the first attempt. Highly recommend Cert Stash to everyone.