Cisco SCOR 350-701 study plan

Define the CIA triad, defense-in-depth, and zero-trust principles, then map each to at least two concrete Cisco security products or features

Differentiate AAA components (authentication, authorization, accounting) and identify which Cisco ISE and RADIUS/TACACS+ functions implement each

Compare symmetric vs asymmetric encryption, hashing, and PKI certificate lifecycle stages, and explain where each appears in a VPN or TLS handshake

Build a personal glossary of at least 40 Security Concepts terms with one-line definitions in your own words

Explain common attack types (phishing, ransomware, DDoS, MITM, SQL injection, social engineering) and match each to a mitigation control

Describe the Cisco security architecture layers (network, cloud, endpoint, content) and state the purpose of each product family in one sentence

Interpret risk concepts including threat, vulnerability, exposure, and likelihood, and apply them to a short scenario

Outline compliance and regulatory drivers (PCI DSS, HIPAA, GDPR) and note which security controls they typically require

Configure and explain site-to-site IPsec VPN phases (IKEv1/IKEv2, ESP, tunnel vs transport mode) and identify the parameters that must match on both peers

Differentiate remote-access VPN options (SSL VPN, clientless, AnyConnect) and select the right one for a given user scenario

Describe Cisco firewall platforms and features (ASA, Firepower, zone-based firewall) and explain stateful inspection vs next-generation filtering

Explain NAT, ACL, and firewall placement trade-offs in a segmented network design

Explain intrusion prevention vs intrusion detection, and describe how Cisco IPS/NGIPS signatures and policies are tuned to reduce false positives

Describe segmentation approaches (VLANs, VRFs, microsegmentation, TrustSec/SGT) and choose one for a given traffic-isolation requirement

Compare content security controls: secure web gateway, email security, DNS-layer protection, and CASB, stating what each blocks

Trace a malicious URL from user click through DNS, proxy, and endpoint controls, noting where each control can intervene

Define cloud service models (IaaS, PaaS, SaaS) and the shared responsibility split for each, listing what the customer still owns

Explain how Cisco cloud security offerings (Umbrella, Cloudlock/CASB, SecureX/cloud-delivered Firewall) address cloud traffic and SaaS usage

Describe virtual firewall and cloud-native security group constructs, and contrast them with on-premises firewall policy

Identify cloud logging and telemetry sources and explain how they feed a SIEM or analytics platform

Explain email security pipeline stages (reputation, anti-spam, anti-malware, sandboxing, DLP) and the order in which they act

Describe web proxy functions including URL categorization, TLS decryption, and acceptable-use policy enforcement

Compare on-premises ESA/WSA with cloud-delivered equivalents and state migration considerations

Interpret a content security policy scenario and decide which control should act first on a given threat

Compare endpoint protection approaches (antivirus, EDR, EPP, XDR) and explain what telemetry each collects

Describe Cisco endpoint offerings (Secure Endpoint/AMP, Umbrella roaming client, Secure Client) and how they integrate

Explain 802.1X, MAB, and web authentication flows, and describe how Cisco ISE applies posture and authorization policy

Describe TrustSec/SGT-based enforcement and how network visibility tools (NetFlow, Stealthwatch/Secure Network Analytics) detect anomalies

Re-quiz every domain and log weak areas, then spend targeted time on the two lowest-scoring domains

Practice scenario questions that combine domains (for example cloud access with endpoint posture and content filtering) and justify each answer

Review your week 1-7 deliverables and correct any inaccuracies you now spot

Simulate exam timing with two timed mixed-domain practice sets and review every missed item