Domain 1 · 20%
SCOR-350-701 · blueprint v2.0
Implementing and Operating Cisco Security Core Technologies
CCNP/CCIE Security core. One master lab topology, built once and added to module by module.
4/106
SCOR-350-701 · Implementing and Operating Cisco Security Core Technologies
Lesson slugs never change and lessons are never renumbered — a link you save today still resolves after a blueprint revision.
CCNP/CCIE Security core. One master lab topology, built once and added to module by module — every lesson written for this exam, not stitched from a video library.
MODULE 1 Information Security Fundamentals
01 M1 · Lab 1: Build the Core Lab — Workstations, AD & the Attacker In Production 02 Security Fundamentals: Threat, Vulnerability, Risk & the CVE/CVSS Engine In Production 03 Vulnerability Prioritization: KEV, EPSS, SSVC & BOD 26-04 In Production 04 Zero Trust Architecture & Defense in Depth (Cisco SAFE) In Production 05 Security Intelligence: Authoring, Sharing & Consumption In Production 06 Phishing & Social Engineering: Controls That Protect Humans In Production MODULE 2 Common Threats
01 Common Threats: On-Premises, Hybrid & Cloud — Malware, DoS/DDoS, Breaches & Credential Compromise In Production L1 M2 · Lab 1: Common Threats: On-Premises, Hybrid & Cloud — Malware, DoS/DDoS, Breaches & Credential Compromise Lab 02 OWASP Top Ten in Practice: SQL Injection & XSS, Live from ATK-KALI-01 In Production 03 Vulnerability Classes Beyond the Web: Weak/Hardcoded Passwords, Missing Ciphers, Buffer Overflow, Path Traversal & CSRF In Production L2 M2 · Lab 2: Exploit the Web & Beyond: OWASP Top Ten, Weak Credentials, Missing Ciphers & Overflows · 2 scenarios Lab 04 AI/LLM Security: Prompt Injection, System Prompt Leakage, Embedding Weaknesses & AI Supply Chain In Production L3 M2 · Lab 3: AI/LLM Security: Prompt Injection, System Prompt Leakage, Embedding Weaknesses & AI Supply Chain Lab 05 Man-in-the-Middle: ARP Spoofing Packet Walk In Production L4 M2 · Lab 4: Man-in-the-Middle: ARP Spoofing Packet Walk Lab MODULE 3 Cryptography & PKI
01 Cryptography Foundations: Hashing, Encryption & PKI In Production 02 Stand Up the Enterprise CA on AD-01 & Issue Certificates In Production 03 The SSL/TLS Handshake: Packet Walk In Production 04 Post-Quantum Cryptography: NIST Algorithms, Hybrid Key Exchange & Migration In Production 05 QUIC & MASQUE: Where TLS Is Going In Production L1 M3 · Lab 1: Cryptography End to End: Enterprise CA, the TLS Handshake, Post-Quantum & QUIC · 5 scenarios Lab 06 IPsec: AH, ESP, IKE, PSK vs Certificates & NAT Traversal In Production MODULE 4 ASA Stateful Firewall
01 M4 · Lab 1: Power On the ASA Perimeter In Production 02 Stateful Firewalls In Production 03 ASA: Deployment Types In Production 04 ASA: Security Contexts In Production L2 M4 · Lab 2: ASA Foundations: Stateful Inspection, Deployment Types & Security Contexts · 3 scenarios Lab 05 ASA: Security Levels ⚑ Live 06 ASA: DMZ Interface & Verification ⚑ In Production 07 ASA: Objects & Object Groups ⚑ In Production 08 ASA: Service Groups & Access Rules ⚑ In Production 09 ASA: NAT Concepts and Rule Evaluation ⚑ Live 10 ASA: NAT — Static NAT and Dynamic PAT ⚑ In Production 11 ASA: NAT — Identity Rules, Verification and Troubleshooting ⚑ In Production 12 ASA: Interface ACLs ⚑ In Production 13 ASA: Global ACLs ⚑ In Production 14 ASA: Advanced Access Policies — Modular Policy Framework (MPF) ⚑ In Production L3 M4 · Lab 3: ASA Perimeter Build: Security Levels, DMZ, Objects, NAT, ACLs & MPF · 9 scenarios Lab 15 ASA: High Availability (HA) Live L4 M4 · Lab 4: ASA: High Availability (HA) Lab 16 M4 · Lab 5: ASA Perimeter Policy ⚑ In Production MODULE 5 Firepower NGFW
01 M5 · Lab 1: Power On FTD & FMC In Production 02 Firepower: Deployments In Production L2 M5 · Lab 2: Firepower: Deployments Lab 03 Management Models: Single vs Multidevice, In-Band vs Out-of-Band, On-Premises vs Cloud (Cisco Security Cloud Control) In Production L3 M5 · Lab 3: Management Models: Single vs Multidevice, In-Band vs Out-of-Band, On-Premises vs Cloud (Cisco Security Cloud Control) Lab 04 Firepower: Packet Processing & Policies In Production L4 M5 · Lab 4: Firepower: Packet Processing & Policies Lab 05 Firepower: Objects In Production 06 Firepower: Policies — Access Control (ACP) In Production 07 Firepower: Policies — AVC & Application Control In Production 08 Firepower: Policies — URL Filtering In Production L5 M5 · Lab 5: Firepower Access Control: Objects, the ACP, AVC & URL Filtering · 4 scenarios Lab 09 FTD: NAT Concepts and Rule Evaluation In Production 10 FTD: NAT — Dynamic PAT and Static Publication In Production 11 FTD: NAT — Identity Rules, Verification and Troubleshooting In Production L6 M5 · Lab 6: FTD NAT: PAT, Static Publication, Identity Rules & Verification · 2 scenarios Lab 12 Firepower: Policies — Prefilter In Production L7 M5 · Lab 7: Firepower: Policies — Prefilter Lab 13 Firepower: Security Intelligence (SI) In Production L8 M5 · Lab 8: Firepower: Security Intelligence (SI) Lab 14 Firepower: Policies — Network Discovery In Production 15 Firepower: Policies — IPS In Production 16 Firepower: Policies — Malware & File In Production L9 M5 · Lab 9: Firepower Threat Policies: Network Discovery, IPS & Malware/File · 3 scenarios Lab MODULE 6 Endpoint Security
01 M6 · Lab 1: Power On the Secure Endpoint Console & Workstations In Production 02 EPP vs EDR — and Why Endpoint Security at All In Production 03 Endpoint Protection & Detection: Secure Endpoint, Secure Client & Malware Analytics In Production 04 Configure Antimalware Protection: Policies, Outbreak Control & Quarantines In Production L2 M6 · Lab 2: Configure Antimalware Protection: Policies, Outbreak Control & Quarantines Lab 05 Triage Secure Endpoint: Interpreting Malware Detection Events In Production L3 M6 · Lab 3: Triage Secure Endpoint: Interpreting Malware Detection Events Lab 06 Endpoint Hygiene: MDM, Asset Inventory & Posture Assessment In Production 07 Configure Email Security with Cisco Secure Email Threat Defense In Production L4 M6 · Lab 4: Configure Email Security with Cisco Secure Email Threat Defense Lab MODULE 7 Secure Network Access (ISE)
01 M7 · Lab 1: Power On ISE, the Access Layer & Wireless In Production 02 Identity Management: Guest, Profiling, Posture & BYOD In Production 03 Configure & Troubleshoot TACACS+ Device Administration In Production 04 Configure & Troubleshoot RADIUS Network Access In Production L2 M7 · Lab 2: ISE AAA: TACACS+ Device Administration & RADIUS Network Access · 2 scenarios Lab 05 802.1X, EAP & RADIUS Flows: Packet Walk In Production 06 Configure 802.1X, MAB & WebAuth with ISE In Production 07 Authorization: dACLs & Dynamic VLAN Assignment In Production L3 M7 · Lab 3: 802.1X End to End: EAP & RADIUS Flows, MAB, WebAuth, dACLs & Dynamic VLANs · 3 scenarios Lab 08 Change of Authorization (CoA): Triggers, Packet Flow & Verification In Production L4 M7 · Lab 4: Change of Authorization (CoA): Triggers, Packet Flow & Verification Lab 09 Configure Profiling, Guest Services & BYOD In Production L5 M7 · Lab 5: Configure Profiling, Guest Services & BYOD Lab 10 Configure Posture Assessment & Device Compliance In Production L6 M7 · Lab 6: Configure Posture Assessment & Device Compliance Lab 11 Cisco Duo in Zero Trust: MFA, Device Trust & Adaptive Access Policies In Production 12 Cisco Duo SSO, the Authentication Proxy & Cisco Identity Intelligence Live MODULE 8 Infrastructure Security
01 Layer 2 Attacks & Defenses: Port Security, DHCP Snooping, DAI & Storm Control In Production 02 Configure Segmentation: VLANs, SGTs & Private VLANs In Production L1 M8 · Lab 1: Layer 2 Hardening & Segmentation: Port Security, DHCP Snooping, DAI, VLANs, SGTs & PVLANs · 2 scenarios Lab 03 Device Hardening with CIS Benchmarks: Cisco Secure Firewall (FTD) & IOS XE In Production L2 M8 · Lab 2: Device Hardening with CIS Benchmarks: Cisco Secure Firewall (FTD) & IOS XE Lab 04 Secure Management Access: SNMPv3, NetConf, RestConf & APIs In Production 05 Secure Log Transport: Syslog Hardening In Production 06 Trusted Time: Authenticated NTP In Production L3 M8 · Lab 3: Secure the Management Plane: SNMPv3, APIs, Syslog Hardening & Authenticated NTP · 3 scenarios Lab MODULE 9 Telemetry & Visibility
01 M9 · Lab 1: Power On the Telemetry Stack In Production 02 Security Monitoring & Telemetry Technologies: NetFlow, Logs & Beyond In Production 03 Configure Flexible NetFlow Export: Telemetry Hands-On In Production L2 M9 · Lab 2: Configure Flexible NetFlow Export: Telemetry Hands-On Lab 04 Network Visibility & Enforcement: Telemetry, AI/ML Analytics & Cisco XDR In Production L3 M9 · Lab 3: Network Visibility & Enforcement: Telemetry, AI/ML Analytics & Cisco XDR Lab 05 Splunk for Security Operations: SIEM, SOAR, Orchestration & Automation In Production 06 Exfiltration & Its Detection: DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger/IRC, NTP & Cloud Storage In Production L4 M9 · Lab 4: Exfiltration & Its Detection: DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger/IRC, NTP & Cloud Storage Lab MODULE 10 VPNs: Site-to-Site
01 M10 · Lab 1: Power On the Branch Site In Production 02 Site-to-Site VPN Options & Design: sVTI, IPsec, DMVPN, FlexVPN & GETVPN In Production 03 IKEv2 Tunnel Establishment: Packet Walk In Production L2 M10 · Lab 2: IKEv2 Tunnel Establishment: Packet Walk Lab 04 Configure IOS Site-to-Site IPsec with sVTI In Production L3 M10 · Lab 3: Configure IOS Site-to-Site IPsec with sVTI Lab 05 Configure Site-to-Site VPN: FTD to Branch Router In Production L4 M10 · Lab 4: Configure Site-to-Site VPN: FTD to Branch Router Lab 06 Troubleshoot VPN Tunnel Establishment on FTD: Debugs That Matter In Production L5 M10 · Lab 5: Troubleshoot VPN Tunnel Establishment on FTD: Debugs That Matter Lab MODULE 11 VPNs: Remote Access
01 Remote Access VPN & Cisco Secure Client Architecture In Production 02 Configure Remote Access VPN: FTD & Cisco Secure Client In Production L1 M11 · Lab 1: Configure Remote Access VPN: FTD & Cisco Secure Client Lab 03 Verify & Troubleshoot RA VPN: TLS/DTLS Session Establishment & Debugs In Production L2 M11 · Lab 2: Verify & Troubleshoot RA VPN: TLS/DTLS Session Establishment & Debugs Lab 01 M12 · Lab 1: Secure Access Tenant & Branch Component Availability In Production 02 SSE & SASE: From Umbrella to Cisco Secure Access In Production 03 Configure Secure Internet Access: DNS Forwarding, Branch Egress, Web Policies, Destination Lists & Reporting In Production L2 M12 · Lab 2: Configure Secure Internet Access: DNS Forwarding, Branch Egress, Web Policies, Destination Lists & Reporting Lab 04 Configure Secure Private Access: ZTNA to Internal Apps In Production L3 M12 · Lab 3: Configure Secure Private Access: ZTNA to Internal Apps Lab 05 Configure DLP & AI Guardrails for Secure Internet Access In Production L4 M12 · Lab 4: Configure DLP & AI Guardrails for Secure Internet Access Lab 06 Interpret Secure Access Investigate: Scores & Indicators In Production 07 SDN & SD-WAN: Architecture, North- & South-Bound APIs, Securing the Overlay ⚑ In Production
MODULE 13 Cloud Security
01 M13 · Lab 1: Power On the Cloud Services Simulator In Production 02 Cloud Shared Responsibility Models In Production 03 Cloud Service & Deployment Models: NIST 800-145, Cloud Types & CASB Selection In Production 04 Selecting Cloud Security Capabilities: Deployment Models, Frameworks & Policy Management In Production 05 Application & Workload Security: eBPF-Based Protection In Production 06 Cloud Network, Application & Data Security: Multicloud Defense & Secure Workload In Production L2 M13 · Lab 2: Cloud Network, Application & Data Security: Multicloud Defense & Secure Workload Lab 07 Configure Splunk to Ingest Cloud Logging & Monitoring Data In Production L3 M13 · Lab 3: Configure Splunk to Ingest Cloud Logging & Monitoring Data Lab MODULE 14 DevSecOps & Security Programmability
01 DevSecOps: CI/CD, Containers, IaC Security & Secure Software Development In Production 02 Secure a CI/CD Pipeline: Container & IaC Scanning Hands-On In Production L1 M14 · Lab 1: Secure a CI/CD Pipeline: Container & IaC Scanning Hands-On Lab 03 Interpret Python Scripts Against Cisco Security Appliance APIs In Production Part of the Cisco Security Track
All-Access covers every course in the track — see pricing.
Exam Mapping
The objective namespace is separate from the course namespace — a blueprint revision cannot break a course link, and the reverse is also true.
Domain 2 · 25%
Network Security
Domain 3 · 15%
Cloud Security
Domain 4 · 10%
Secure Service Edge
Domain 5 · 15%
Endpoint Protection and Detection
Domain 6 · 15%