CCNA Cybersecurity (200-201 CCNACBR) study guide
CCNA Cybersecurity (200-201 CCNACBR) · Work through your exam, one topic at a time.
The Cisco Certified CyberOps Associate credential - exam code 200-201 CCNACBR - is Cisco's entry-level security-operations certification. It is aimed at people who want to work in, or are newly working in, a security operations center: Tier 1 analysts, SOC triage staff, network engineers moving toward security, and students building a defensive-security foundation. Unlike a pure networking track, the exam is built around the day-to-day work of detecting and responding to incidents rather than configuring devices. The blueprint is organized into five areas: security concepts (threat actors, vulnerabilities, cryptography basics, and the CIA triad), security monitoring (telemetry sources, alerting, and how data flows into analysis), host-based analysis (endpoint logs, process behavior, fileless activity, and Windows and Linux artifacts), network intrusion analysis (packet analysis, protocol behavior, and reading traffic for signs of compromise), and security policies and procedures (incident response process, playbooks, and governance). The CCNA Cybersecurity (200-201 CCNACBR) study guide has 5 sections and about 1,966 words.
01Security Concepts
Domain 1 of the 200-201 blueprint, Security Concepts, carries roughly 20% of the exam. It tests precise use of risk vocabulary - naming the asset, threat, vulnerability and control in a scenario - and the models used to describe attacker behavior.
391 words, about 2 min02Security Monitoring
Domain 2, Security Monitoring, is the largest slice at roughly 25%. It asks where evidence comes from, how it is normalized and correlated, and how an analyst moves from a raw alert to a defensible conclusion.
419 words, about 2 min03Host-Based Analysis
Domain 3, Host-Based Analysis, is about 20%. It tests reading endpoint evidence - Windows event logs, Sysmon, Linux authentication logs, process trees, file artifacts - and reaching a conclusion without destroying evidence.
378 words, about 2 min04Network Intrusion Analysis
Domain 4, Network Intrusion Analysis, is about 20%. It tests protocol-level reading of packets and flows, recognition of scan and exfiltration patterns, and interpretation of IDS output.
371 words, about 2 min05Security Policies and Procedures
Domain 5, Security Policies and Procedures, is about 15%. It tests governance vocabulary, the incident-response lifecycle, evidence handling, and the compliance obligations that shape an analyst's decisions.
407 words, about 2 min