Domain 1 · 10%
SCAZT-300-740 · blueprint v2.0
Designing and Implementing Secure Cloud Access for Users and Endpoints
CCNP Security concentration. One master lab topology, built once and added to module by module.
1/56
SCAZT-300-740 · Designing and Implementing Secure Cloud Access for Users and Endpoints
Lesson slugs never change and lessons are never renumbered — a link you save today still resolves after a blueprint revision.
CCNP Security concentration. One master lab topology, built once and added to module by module — every lesson written for this exam, not stitched from a video library.
01 M1 · Lab 1: Build the SCAZT Lab - Cloud Accounts, the IdP & the Container Node In Production 02 Zero Trust Architecture & Defense in Depth (Cisco SAFE) In Production 03 Zero Trust Frameworks: NIST SP 800-207 & the CISA Zero Trust Maturity Model v2.0 In Production 04 MITRE ATT&CK for the Cloud: Selecting Mitigations for IdP, SaaS & IaaS Techniques In Production L2 M1 · Lab 2: MITRE ATT&CK for the Cloud: Selecting Mitigations for IdP, SaaS & IaaS Techniques Lab 05 Security Requirements for AWS, Azure & GCP: Identity, Native Controls, Posture & Shared Responsibility In Production L3 M1 · Lab 3: Security Requirements for AWS, Azure & GCP: Identity, Native Controls, Posture & Shared Responsibility Lab 06 Operational Requirements for Public Cloud: Visibility, Monitoring, Infrastructure & the Consumption Model In Production L4 M1 · Lab 4: Operational Requirements for Public Cloud: Visibility, Monitoring, Infrastructure & the Consumption Model Lab 07 Private Cloud: VMware Hypervisors & Kubernetes Container Orchestration In Production L5 M1 · Lab 5: Private Cloud: VMware Hypervisors & Kubernetes Container Orchestration Lab 08 eBPF Runtime Security: Cilium & Tetragon Observability and Enforcement for Containers In Production L6 M1 · Lab 6: eBPF Runtime Security: Cilium & Tetragon Observability and Enforcement for Containers Lab
01 M2 · Lab 1: Stand Up the Identity Plane - IdP, Duo Tenant & Directory In Production 02 Cisco Duo in Zero Trust: MFA, Device Trust & Adaptive Access Policies In Production 03 Cisco Duo SSO, the Authentication Proxy & Cisco Identity Intelligence Live 04 Identity Intelligence Across Identity Providers: Signals, Risk Scoring & Blind Spots In Production L2 M2 · Lab 2: Identity Signals: Duo SSO, the Authentication Proxy & Identity Intelligence Across Providers · 2 scenarios Lab 05 Implement User & Device Authentication with Identity Certificates In Production L3 M2 · Lab 3: Implement User & Device Authentication with Identity Certificates Lab 06 Implement Phishing-Resistant Multifactor Authentication with Cisco Duo In Production L4 M2 · Lab 4: Implement Phishing-Resistant Multifactor Authentication with Cisco Duo Lab 07 Implement Endpoint Posture Policies for User Access to Resources In Production 08 Implement Trusted Endpoint Policies for Device Access with Cisco Duo In Production L5 M2 · Lab 5: Device Trust with Duo: Endpoint Posture & Trusted Endpoint Policies · 2 scenarios Lab 09 Configure User & Device Trust with SAML Authentication for Web and Mobile Applications In Production L6 M2 · Lab 6: Configure User & Device Trust with SAML Authentication for Web and Mobile Applications Lab 10 Configure SSO & Automated User Provisioning Over an IdP Connection: SAML + SCIM In Production L7 M2 · Lab 7: Configure SSO & Automated User Provisioning Over an IdP Connection: SAML + SCIM Lab 11 SAML Assertions & SCIM Provisioning Calls: Packet Walk In Production L8 M2 · Lab 8: SAML Assertions & SCIM Provisioning Calls: Packet Walk Lab
01 M3 · Lab 1: The Policy Edge - Secure Firewall, the WAF Node & the Secure Access Tenant In Production 02 SSE & SASE: From Umbrella to Cisco Secure Access In Production 03 Encrypting Data In Transit and At Rest in the Cloud: TLS, IPsec & Tunnel Design In Production L2 M3 · Lab 2: Encrypting Data In Transit and At Rest in the Cloud: TLS, IPsec & Tunnel Design Lab 04 How IPS, DLP & Malware Protection Secure Private Access In Production L3 M3 · Lab 3: How IPS, DLP & Malware Protection Secure Private Access Lab 05 Cisco AI Defense: Purpose, Characteristics & Where It Sits in the Architecture In Production 06 AI Access & AI Guardrails in Cisco Secure Access In Production L4 M3 · Lab 4: AI Access & AI Guardrails in Cisco Secure Access Lab 07 Web Application Firewalls & DDoS: What a WAF Actually Absorbs In Production L5 M3 · Lab 5: Web Application Firewalls & DDoS: What a WAF Actually Absorbs Lab 08 Design Security Policy for the Security Service Edge: Rule Model, Order & Identity Conditions In Production 09 Enforcing Application Policy on Edge Devices: Cisco Secure Firewall, Meraki & Catalyst SD-WAN In Production L6 M3 · Lab 6: Policy at the Edge: SSE Rule Design & Enforcement on Secure Firewall, Meraki & SD-WAN · 2 scenarios Lab
01 M4 · Lab 1: The Workload Lab - App Tiers, Enforcement Agents & the Cluster In Production 02 Cloud Network, Application & Data Security: Multicloud Defense & Secure Workload In Production 03 Application Discovery & Dependency Mapping with Cisco Secure Workload In Production 04 Designing Microsegmentation to Stop Lateral Movement In Production 05 Enforce Microsegmentation Hands-On: Host Agents & Kubernetes Network Policy In Production 06 Policy Creation, Validation & Analysis in Cisco Secure Workload In Production 07 Vulnerability Assessment & Response for Workloads In Production L2 M4 · Lab 2: Workload Segmentation with Secure Workload: Discovery, Microsegmentation, Enforcement & Vulnerability Response · 6 scenarios Lab
01 M5 · Lab 1: Prepare the Secure Access Lab - Tenant, Roaming Client & Branch Egress In Production 02 Configure Secure Internet Access: DNS & Web Policies, Destination Lists & Reporting In Production 03 Configure DNS Security in Cisco Secure Access In Production L2 M5 · Lab 2: Secure Internet Access: DNS Security, Web Policies, Destination Lists & Reporting · 2 scenarios Lab 04 Configure the Secure Web Gateway: Web Policy, TLS Decryption & Tenant Controls In Production L3 M5 · Lab 3: Configure the Secure Web Gateway: Web Policy, TLS Decryption & Tenant Controls Lab 05 Configure Data Loss Protection in Cisco Secure Access In Production L4 M5 · Lab 4: Configure Data Loss Protection in Cisco Secure Access Lab 06 Configure CASB: App Discovery, Risk Scoring & Tenant Restrictions In Production L5 M5 · Lab 5: Configure CASB: App Discovery, Risk Scoring & Tenant Restrictions Lab 07 Troubleshoot Secure Internet Access: Steering, Certificates, Identity & Bypass In Production L6 M5 · Lab 6: Troubleshoot Secure Internet Access: Steering, Certificates, Identity & Bypass Lab
01 M6 · Lab 1: Tenant, Hosts & Branch Devices for Secure Private Access In Production 02 Configure Secure Private Access: ZTNA to Internal Apps In Production 03 Configure Secure Private Access for Workloads: Resource Connector vs IPsec Backhaul In Production 04 Configure Branch Connectivity to the Secure Access Edge In Production L2 M6 · Lab 2: Secure Private Access: ZTNA to Internal Apps, Resource Connectors, IPsec Backhaul & Branch Connectivity · 3 scenarios Lab 05 Configure VPN as a Service with ISE as the RADIUS Server In Production 06 Configure Zero-Trust Access: Clientless and Client-Based with Cisco Secure Client In Production 07 MASQUE over QUIC: How the Zero-Trust Tunnel Is Actually Built - Packet Walk In Production 08 Digital Experience Monitoring with ThousandEyes & Secure Access In Production L3 M6 · Lab 3: Zero-Trust Tunnels: VPNaaS with ISE, Clientless & Client ZTNA, MASQUE over QUIC & ThousandEyes DEM · 4 scenarios Lab
01 M7 · Lab 1: The Operations Stack - Splunk, Telemetry Sources & the XDR Trial In Production 02 Selecting the Right Tool: Visibility, Microsegmentation, Traffic Analysis & Enforcement In Production 03 Network Visibility & Enforcement: Telemetry, AI/ML Analytics & Cisco XDR In Production 04 Interpreting Traffic Flow & Telemetry Reports: Baselines and Compliance Behaviour In Production L2 M7 · Lab 2: Interpret the Telemetry: Visibility, XDR Analytics, Flow Baselines & Compliance Behaviour · 2 scenarios Lab 05 Interpreting Cisco Secure Access Dashboards & Reports In Production L3 M7 · Lab 3: Interpreting Cisco Secure Access Dashboards & Reports Lab 06 Integrating Cisco Secure Access with Cisco XDR & Splunk Enterprise for the SOC In Production L4 M7 · Lab 4: Integrating Cisco Secure Access with Cisco XDR & Splunk Enterprise for the SOC Lab
Part of the Cisco Security Track
All-Access covers every course in the track — see pricing.
Exam Mapping
The objective namespace is separate from the course namespace — a blueprint revision cannot break a course link, and the reverse is also true.