What is it?

What exactly is the Cisco Certified Network Associate Cybersecurity?

Cisco's associate-level cybersecurity credential that proves you can monitor, analyze, and respond to threats in a Security Operations Center.

The Cisco Certified Network Associate (CCNA) Cybersecurity is delivered via the 200-201 CBROPS (Understanding Cisco Cybersecurity Operations Fundamentals) exam and is Cisco's associate-level security certification, the direct successor to the former CyberOps Associate. It validates the job-ready skills SOC Tier-1 analysts use daily: security concepts, security monitoring, host-based and network intrusion analysis, and incident-handling procedures. Passing it opens roles such as Security Operations Center (SOC) Analyst, Junior Security Analyst, and Threat Analyst. It sits above the entry-level CCST and below the professional CCNP Security in Cisco's cybersecurity pathway, and it requires no formal prerequisite although CCNA-level networking knowledge is helpful.

The path in brief

1. Confirm no formal prerequisite and review the 200-201 blueprint
2. Complete Cisco's CBROPS course or an aligned SOC-analyst study plan
3. Practice reading logs, PCAPs, and security alerts in labs
4. Schedule the 200-201 exam through Pearson VUE (test center or OnVUE)
5. Pass the exam and claim your Cisco digital badge
6. Plan CCNP Security (SCOR + concentration) as the next step

Before you book

Who is eligible to sit the Cisco Certified Network Associate Cybersecurity?

Open to all candidates; anyone may register and sit the 200-201 exam through Pearson VUE.

Who it is for: Aspiring and early-career security operations analysts, SOC Tier-1 analysts, network engineers moving into security, and career changers with basic IT knowledge.

The test itself

What is the format of the Cisco Certified Network Associate Cybersecurity?

The Cisco Certified Network Associate Cybersecurity is administered by Pearson VUE and runs 120 minutes and requires Cisco does not publish a fixed passing score; results are reported on a scaled 300-1000 range and the statistical cut score typically falls around 750-850. You receive a pass/fail result with a section-level breakdown. to pass.

The fine print

What are the retake and renewal rules for the Cisco Certified Network Associate Cybersecurity?

Proctoring & delivery

Delivered by Pearson VUE: at authorized test centers or online via OnVUE remote proctoring (CCST uses the Certiport/Pearson VUE platform). A government-issued photo ID is required; online tests include a room/environment scan.

Retake policy

If you fail, Cisco requires a waiting period of 5 calendar days before you may retake the same exam. Each attempt requires full payment of the exam fee. Cisco does not cap total attempts, but some exams limit attempts within a 12-month window.

Score reporting

Results are reported as pass/fail and made available online (Cisco Certification Tracking System) typically within 48 hours. A section-level performance breakdown is provided to help target further study; scaled scores use a 300-1000 range (CCNA/CCNP-style exams).

Recertification

All Cisco certifications are valid for 3 years from the date earned. Recertify before expiry by (a) passing a higher-or-equal level qualifying exam, (b) earning Continuing Education (CE) credits through eligible training/activities, or (c) a combination of exam + CE. For associate-level certs 30 CE credits are required; for professional-level 40 CE credits. Certificates can also be extended via the Cisco Continuing Education program.

Refunds & rescheduling

Exam fees are generally non-refundable once scheduled, but Pearson VUE allows rescheduling or cancellation up to 24-48 hours before the appointment without penalty; no-shows forfeit the fee. CCST/Certiport policies may differ by region.

What it pays

How much does this credential pay?

$124,910 median for information security analysts (BLS, May 2024) — but tier-1 SOC starts well below it

The occupation this exam points at is Information Security Analysts, and the headline number for that group is genuinely strong: a median of $124,910 in May 2024, and a projected 29 percent employment increase from 2024 to 2034, which is one of the fastest growth rates BLS publishes for any occupation. Two caveats matter enormously if you are using this page to decide whether to spend $300. First, that median describes the whole occupation, including people with a decade of experience and a CISSP. The job 200-201 qualifies you for is tier-1 SOC analyst — alert triage on a rota, often on nights or weekends — and that seat sits nearer the bottom decile than the median. BLS reports that the lowest 10 percent of information security analysts earned less than $69,660, and that is the realistic band for a first monitoring job, with the network-support figure of $73,340 a useful cross-check for what employers pay someone doing shift work with a single associate-level credential. Second, the credential does not do the pay lifting on its own. What moves a tier-1 analyst to tier-2 within eighteen months is demonstrable artefact work — being the person who can open a PCAP and say what happened — and 200-201 is valuable precisely because it is the only associate exam that tests that directly. No published survey isolates holders of this specific credential: Skillsoft's IT Skills and Salary Report reports averages for Cisco certifications generally, but it does not break out CCNA Cybersecurity separately, so we have not quoted a figure that would really be measuring a different exam.

Job growth.29% projected growth 2024-34 for information security analysts (much faster than average)

Source: BLS Occupational Outlook Handbook — Information Security Analysts

Your schedule

How long should I study for it?

120-160 hours of focused study

Two hundred and one is a single 120-minute exam with no second paper, which sounds forgiving until you notice what it actually asks for. This is a defender's exam built around interpreting evidence: reading a packet capture, correlating a NetFlow record against a firewall log, deciding whether a process tree on a Windows or Linux host is normal. You cannot memorise your way to that. The plan below assumes roughly 120-160 hours spread over ten weeks, with the explicit rule that at least a third of your time is spent in front of real data rather than a book. It also assumes you are studying the v1.2 blueprint, live since January 2026, which added AI-focused objectives — AI-assisted threat monitoring, AI-generated social engineering, security risks specific to AI deployments — that are absent from every CyberOps-branded resource published before 2026. If your material says "CyberOps Associate" on the cover, the core five domains are still valid but you must layer the v1.2 additions on top.

1. Weeks 1-212-14 hrs/week

   Domain 1 — Security Concepts, and the vocabulary the other four domains assume

   • CIA triad, defence in depth, threat actors and attack surface, then the risk vocabulary Cisco uses precisely: risk, threat, vulnerability, exploit
   • Learn the alert classification matrix cold — true positive, true negative, false positive, false negative — with a worked example of each
   • Access control models (DAC, MAC, RBAC, ABAC) and where each is actually deployed
   • Read the v1.2 AI objectives directly from the Cisco exam-topics PDF and note which sub-topics your book predates
2. Weeks 3-413-15 hrs/week

   Domain 2 — Security Monitoring, the heaviest-weighted domain on the paper

   • Understand what each data source can and cannot tell you: NetFlow, session data, full packet capture, transaction data, alert data, statistical data
   • Install Wireshark and open real captures from a public malware-traffic archive; practise following a TCP stream and extracting an object
   • Learn why encryption, NAT, tunnelling, TOR and P2P each degrade visibility, and what compensating source you reach for
   • Set up Security Onion or Splunk Free and generate then hunt your own events
3. Weeks 5-612-14 hrs/week

   Domain 3 — Host-Based Analysis

   • Build one Windows and one Linux VM and deliberately generate the evidence: failed logons, a scheduled task, a process launched from a temp directory
   • Read Windows event logs, Sysmon output, and Linux /var/log entries until the field names are familiar rather than novel
   • Learn endpoint technology roles: host firewall, antimalware, application allow-listing, systems-based sandboxing
   • Practise reading a process tree and saying which parent-child relationship is suspicious and why
4. Weeks 7-813-15 hrs/week

   Domain 4 — Network Intrusion Analysis

   • Work through capture files and identify the attack from the traffic alone: port scan, brute force, SQL injection attempt, DNS tunnelling, beaconing
   • Read IDS alert output alongside the packets that generated it, so signature text stops being abstract
   • Learn protocol header fields that carry investigative value — TTL, TCP flags, HTTP headers, DNS query type
   • Practise extracting files from a capture and hashing them
5. Week 912-14 hrs/week

   Domain 5 — Security Policies and Procedures, plus the frameworks

   • NIST SP 800-61 incident response lifecycle as an ordered, questionable list
   • Chain of custody, evidence handling, and the order of volatility
   • Map an attack narrative onto the Cyber Kill Chain and onto the Diamond Model — the exam expects both
   • SOC metrics and the tier-1 to tier-3 escalation model
6. Week 1012-14 hrs

   Timed mixed drilling and the v1.2 delta

   • Full 120-minute timed practice exams, shuffled across all five domains, at least three of them
   • Go back over every AI-related v1.2 objective — these are the items your older resources did not cover
   • Re-drill only the domains where your timed score sits lowest; ignore the ones already comfortable
   • One light revision day before the exam, then stop

What to buy

Which study resources are worth paying for?

Everything on the market for this exam is still branded CyberOps Associate, because the rename to CCNA Cybersecurity only happened in February 2026 and publishers move slower than Cisco marketing. That is fine for the five core domains and a real gap on the v1.2 AI objectives. Budget most of your money for a question bank and none of it for a boot camp — the free lab material is where the actual learning happens on this exam.

Prices checked 2026-08 and shown as USD list price before tax; subscription tiers and Cisco Learning Credit rates change, so confirm at the vendor before purchase. We do not rank by commission.

What you'll face

What question types will I see?

One hundred and twenty minutes, delivered in English, graded pass/fail. There are no configuration simulations on 200-201 — this is not a CLI exam — but that does not make it a multiple-choice memory test. The characteristic item presents evidence and asks for an analytical judgement: which data source answers this question, what does this process tree indicate, how should this alert be classified. Expect single-answer multiple choice as the bulk of the paper, multiple-response items that state how many options to select and score all-or-nothing, and drag-and-drop matching for things like kill chain phases, Diamond Model vertices and incident-response steps. A meaningful number of stems are exhibit-driven: a log excerpt, a table of flow records, a described capture. Cisco presents one question at a time and does not permit backward navigation, so budget time by checkpoint rather than planning to review at the end.

Samples are editor-written illustrations of the published blueprint, not live exam items.

Reference

What are the key facts about the Cisco Certified Network Associate Cybersecurity?

Cisco Certified Network Associate Cybersecurity is a certification credential; awarded by Cisco Systems; the exam fee is US$300 (plus applicable tax; regional pricing may differ). Redeemable with Cisco Learning Credits.; typical preparation is Approximately 2-4 months of part-time study (about 80-120 hours)..

In short

Is the Cisco Certified Network Associate Cybersecurity worth it?

• Single-exam associate cybersecurity certification (200-201 CBROPS), 120 minutes, ~95-105 questions, US$300.
• Five weighted domains - Security Monitoring is the heaviest at 25%; policies/procedures the lightest at 15%.
• No formal prerequisite; maps to NICE framework SOC Tier-1 analyst tasks.
• Valid 3 years; pairs naturally with CCNP Security as the next step.

Trust

Where does this information come from?

Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.

• Official Cisco Certified Network Associate Cybersecurity exam page Exam page
• Cisco Systems certification programme Programme rules

Research confidence: high · Last reviewed 2026-08