Implementing and Operating Cisco Security Core Technologies (SCOR)

In this Implementing and Operating Cisco Security Core Technologies course provides a comprehensive, hands-on introduction to modern Cisco security technologies used to protect enterprise, campus, remote, and cloud-based networks. The curriculum begins with core network security and information security concepts, including common TCP/IP, application, and endpoint attacks, establishing a strong foundation for understanding today's threat landscape. Students are then guided through the architecture, deployment, and policy configuration of Cisco Secure Firewall platforms, including Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense, with focused coverage on access control, NAT, intrusion prevention, malware protection, and file policies. VPN technologies are explored in depth, covering cryptographic fundamentals, site-to-site IPsec solutions, VTI-based tunnels, and secure remote-access VPNs using both ASA and Threat Defense platforms.

The course extends beyond perimeter security to address email, web, endpoint, and DNS-layer protection using Cisco Secure Email Gateway, Cisco Secure Web Appliance, Cisco Umbrella, and Cisco Secure Endpoint. Learners gain practical experience configuring email security policies, web proxy services, HTTPS decryption, acceptable use controls, and malware protection, while also exploring endpoint detection, ransomware protection, and endpoint analysis workflows. Network access control and infrastructure protection are covered through detailed examination of 802.1X authentication, control plane security, and Layer 2 and Layer 3 data plane protections, ensuring students understand how to secure the network fabric itself.

Advanced visibility and analytics capabilities are introduced through traffic telemetry methods, Cisco Secure Network Analytics, and Cisco Secure Cloud Analytics, providing insight into encrypted traffic analysis, global threat intelligence, and anomaly detection across on-premises and cloud environments. The course concludes with coverage of cloud computing and cloud security principles, software-defined networking security considerations, and integrated security operations across private and public cloud deployments. A robust lab program reinforces all concepts, allowing students to configure, deploy, and analyze real Cisco security technologies in practical scenarios, equipping them with the skills needed to design, implement, and operate secure enterprise and cloud networks.

How You'll Benefit

This training will help you: 

• Gain hands-on experience implementing core security technologies and learn best practices using Cisco security solutions
• Qualify for professional and expert-level security job roles
• Prepare for the 350-701 SCOR v2.0 exam
• Earn 30 CE credits toward recertification

Upon completing this course, the student will be able to:

• Explain how different threat actors operate by describing their motivations, common attack vectors, typical breach and credential-abuse patterns, and the role of the cyber threat intelligence lifecycle in helping organizations understand and track these evolving threats
• Describe how structural weaknesses in software and web applications are identified, classified, and prioritized using concepts such as vulnerability classes, OWASP, CVE, and CVSS, and explain how AI/LLM systems extend this landscape with new vulnerability patterns
• Explain why humans and identity remain a primary attack vector by describing social-engineering and credential-theft lifecycles and by outlining the key conceptual defense layers that organizations apply to reduce, but not completely remove, identity-driven risk
• Describe the main cryptographic building blocks, hashing, symmetric and asymmetric encryption, key exchange, digital signatures, PKI, and encrypted transport protocols, and explain the specific security guarantees and trust assumptions each introduces into an enterprise design
• Explain how Zero Trust, defense in depth, and the Cisco SAFE Blueprint framework together turn threat, vulnerability, identity, and cryptographic insights into a coherent security architecture that assumes failure, limits blast radius, and guides technology placement across the environment
• Describe why the Layer 2 access network is a foundational security boundary by explaining how segmentation, topology, addressing, neighbor discovery, and edge-port controls work together to prevent local attacks from undermining higher-layer security
• Describe how to secure network infrastructure devices by reducing their attack surface, protecting management and control planes as privileged authority channels, and choosing management-plane architectures that create clear, defensible trust boundaries
• Explain how to design and operate AAA for infrastructure administration by choosing appropriate protocols, defining AAA and fallback behavior, and systematically troubleshooting AAA failures to restore secure administrative access
• Perform Cisco Secure Firewall Threat Defense Basic Setup
• Configure access control policy with intrusion policy, file and malware policy to meet given security requirements
• Configure secure site-to-site VPN solutions to establish connectivity between remote sites using Cisco Secure Firewall Threat Defense
• Configure remote access VPN solutions on Cisco Secure Firewall Threat Defense to provide secure connectivity to the corporate network for remote users
• Evaluate cloud security strategies using NIST 800-145 shared responsibility models, security frameworks, and CASB solutions for multicloud environments
• Describe cloud workload security strategies encompassing microsegmentation principles, Cisco Secure Workload, Multicloud Defense platforms, and eBPF-based security approaches
• Describe DevSecOps and Infrastructure as Code principles and interpret Python scripts to call security appliances API
• Describe SASE and SSE architectures and Cisco Secure Access capabilities providing unified, cloud-delivered protection of private applications and the internet across remote and branch environments
• Configure cloud-delivered connectivity, identity-aware authentication, and granular access policies to provide secure access to private applications for remote and branch users
• Configure connectivity identity, and security controls to provide secure access to the internet and SaaS applications for remote and branch users
• Explain how identity, device context, and policy-driven access control work together in secure network access solutions, and describe how Cisco ISE supports differentiated access through AAA, guest access, profiling, and BYOD
• Configure wired and wireless network access control with Cisco ISE by implementing 802.1X and MAB, applying Cisco ISE authentication and authorization policy, selecting appropriate EAP and supplicant approaches, and using RADIUS and CoA to enforce the change access state
• Explain how Cisco Duo supports zero-trust principles through strong user verification, device trust, adaptive access policy, and identity-risk visibility with Cisco Identity Intelligence
• Explain how Cisco Secure Email Threat Defense is integrated and configured in Microsoft 365-based email environments to provide message visibility, threat analysis, and remediation against phishing, business email compromise, and account takeover
• Explain how organizations build, validate, and enforce endpoint trust through device management, asset visibility, compliance and posture assessment, and application control to reduce endpoint security risk
• Explain how modern endpoint security, such as Cisco Secure Endpoint with Cisco Secure Malware Analytics, combines prevention, continuous detection, malware analysis, and event-driven investigation by using Endpoint Protection Platform (EPP) and Endpoint Detection and Response (EDR) concepts
• Describe how Splunk Enterprise and Splunk Cloud function as data analytics platforms for security operations, explain how Splunk platform components and deployment models support scalable data processing and analytics, construct queries using Splunk Processing Language to search and analyze the ingested data, explain how Cisco security products are integrated into Splunk, and describe how Splunk Enterprise extends the platform with SIEM capabilities
• Explain how Splunk SOAR supports SOC operations through orchestration, playbook automation, and case-driven response, and describe how it works with Splunk Enterprise Security and Cisco XDR to automate investigation and response workflows
• Explain how XDR unifies threat detection, investigation, and response across multiple security domains, and describe how Cisco XDR provides cross-domain visibility, correlation, prioritization, investigation, and coordinated and automated response across integrated security controls

What to Expect in the Exam

Implementing and Operating Cisco Security Core Technologies (350-701 SCOR) v2.0 is a 120-minute exam associated with the Cisco Certified Specialist - Security Core certification and satisfies the core exam requirement for the CCNP Security and CCIE Security certifications.

This exam tests your knowledge of implementing and operating core security technologies, including:  

• Network security
• Cloud security
• Secure service edge
• Endpoint protection and detection
• Network access
• Visibility
• Enforcements

The primary audience for this course is as follows:

• Security Engineers
• Network Engineers
• Network Designers
• Network Administrators
• Systems Engineers
• Consulting Systems Engineers
• Technical Solutions Architects
• Cisco Integrators and Partners
• Network Managers
• Program Managers
• Project Managers

There are no prerequisites for this training. However, the knowledge and skills you are recommended to have before attending this training are:

• Familiarity with Ethernet and TCP/IP networking
• Working knowledge of the Windows operating system
• Working knowledge of Cisco IOS networking and concepts
• Familiarity with basics of networking security concepts

These skills can be found in the following Cisco Learning Offering:   

• Implementing and Administering Cisco Solutions (CCNA)

Course Outline

Module 1: Modern Cyber Threat Analysis and Intelligence

Module 2: Vulnerabilities, Exploits, and AI Risks

Module 3: Social Engineering, Identity Abuse, and Phishing Controls

Module 4: Cryptographic Foundations

Module 5: Layer 2 Security

Module 6: Design Principles: Zero Trust and SAFE

Module 7: Device Hardening and Secure Management

Module 8: AAA Troubleshooting for Device Admin Access

Module 9: Cisco Secure Firewall Threat Defense Deployment

Module 10: Cisco Secure Firewall Security Policies

Module 11: Site-to-Site VPN Solutions

Module 12: Remote Access VPN Solutions

Module 13: Cloud Security Models and Frameworks

Module 14: Secure Cloud Workloads and eBPF

Module 15:  DevSecOps and Security Automation

Module 16: Zero Trust Identity with Cisco Duo

Module 17: SASE and SSE Architecture

Module 18: Secure Private Access Implementation

Module 19: Secure Internet Access Implementation

Module 20: Identity and Access Management Foundations

Module 21: Configuring 802.1X, MAB, and CoA with Cisco ISE

Module 22: Cisco Secure Email Threat Defense (ETD)

Module 23: Endpoint Trust, Compliance, and Device Management

Module 24: Modern EDR and Malware Analytics

Module 25: Splunk and Security Analytics

Module 26: SOC Automation and SOAR

Module 27: Extended Detection and Response (XDR)

Lab Outline

• Lab 1: Cisco IOS XE Device Hardening
• Lab 2: OSPFv3 Routing Protocol Authentication
• Lab 3: TACACS+ Network Device Administration
• Lab 4: Cisco Secure Firewall Initial Setup
• Lab 5: Cisco Secure Firewall Policy Management
• Lab 6: Cisco Secure Firewall Site-to-Site VPN
• Lab 7: Cisco Secure Firewall Remote Access VPN
• Lab 8: Implement Secure Private Access
• Lab 9: Implement Secure Internet Access
• Lab 10: Cisco ISE MAB and Wired 802.1X
• Lab 11: Cisco Secure Email Threat Defense
• Lab 12: Cisco Secure Endpoint
• Lab 13: Cisco Secure Firewall Integration with Splunk
• Lab 14: Cisco XDR