Cisco CCNP Security Core (350-701 SCOR) v2.0

Security gaps rarely sit in one place. A misconfigured trunk port, a missing NAT exemption on a remote access VPN, or unclear cloud shared-responsibility terms can each expose the business. Without shared skills, security work ends up with one or two specialists.

Role fit: This Intermediate, Professional-level course suits network engineers, security analysts, and IT practitioners who already handle routing and switching. It covers the CCNP Security core exam (350-701 SCOR) and spans network, cloud, endpoint, email, identity, and zero-trust security, so it works for both network and security staff.

Time investment: Plan on about 32 hours per learner across 35 skills. Team Leads can assign focused skill groups around current operational priorities without pulling people off critical work for long stretches.

Risk and compliance: Learners cover CIS Benchmarks, AAA with TACACS+, cloud security policies and frameworks, and shared responsibility models. These topics support audit conversations and better contract terms with cloud providers.

Change management: The firewall skills have learners build an EVE-NG lab and configure Cisco FTD, site-to-site VPNs, and remote access VPNs. Endpoint, secure access, identity-aware access, and zero-trust topics help teams evaluate security design choices before rollout.

Scenario-based troubleshooting exercises and step-by-step lab walkthroughs reinforce each skill. Training Managers can group skills into Playlists that match current projects.

IT teams complete this training to close the gap between security theory and the incidents that actually disrupt operations. The course is built around scenarios your Team Lead will recognize: remote access and traffic-flow problems, legacy systems that need protection when patching is not straightforward, and cloud environments where standard IP-based visibility is not enough.

• Faster firewall and VPN troubleshooting: Practitioners learn repeatable routing, access policy, and NAT checks for Cisco Secure Firewall Threat Defense (FTD). That helps teams isolate remote access VPN and traffic-flow issues before they turn into extended downtime.
• Smaller blast radius at Layer 2: Your team practices VLAN segmentation, trunk and native VLAN lockdown, and port security. These controls contain ARP and MAC flooding attacks inside a single VLAN and reduce the chance of unintended access across trunks.
• Identity-driven access control: Engineers configure 802.1X, MAB, and CoA in Cisco ISE, then validate VLAN assignment based on identity and access policy decisions.
• Clearer cloud accountability: Shared responsibility and micro-segmentation lessons help teams know which security tasks belong to your organization and which belong to the provider, such as operating system and application security responsibilities. They also show how segmentation can reduce exposure when a system cannot be patched immediately.

Because lessons are taught on live gear and vendor demos rather than screenshots, IT Directors get practitioners who can apply each control in production with less trial and error.

Knowledge

• How VLAN segmentation, access and trunk port settings, native VLAN control, and port security limit the blast radius of Layer 2 attacks such as ARP attacks, MAC address flooding, and CAM table overflow
• Why the cloud shared responsibility model matters, including which security duties stay with the customer for application data and users in PaaS environments, and how micro-segmentation reduces cloud risk
• How network access control with Cisco ISE answers three questions before granting access: who the user is, what device they're using through profiling, and whether it's healthy through posture
• How Cisco Secure Firewall Threat Defense (FTD) policies for decryption, IPS, and malware protection give visibility into application-layer traffic
• How centralized telemetry from sources such as NetFlow, Syslog, SNMPv3, and SIEM tools helps security teams detect threats, monitor utilization, and respond to suspicious activity
• How zero-trust architecture and tools such as Cisco Secure Workload and Cisco ISE fit into a layered defense

Ability

• Build a hands-on FTD lab, then configure the data plane, content control policies, site-to-site VPNs, and remote access VPNs
• Troubleshoot firewall and VPN failures with the routing, permissions, and NAT method, including finding a missing NAT exemption for VPN clients
• Configure and verify AAA with a TACACS+ server to centralize device management authentication
• Configure 802.1X, MAB, and Change of Authorization (CoA) in ISE so authenticated users are placed in the correct VLAN
• Protect legacy systems that can't be patched by monitoring which hosts need access and restricting traffic around them
• Investigate malware and email threat events in Cisco Secure Endpoint, and review vulnerability data in Splunk