thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Courses  /  Cisco  /  Cisco CCNP Cybersecurity - Performing Cybersecurity Using Cisco Security Technologies (CBRCOR)
Exam 350-201CBRCOR (CCNP Cybersecurity core) Cisco

Cisco CCNP Cybersecurity - Performing Cybersecurity Using Cisco Security Technologies (CBRCOR)

Five days on SOC operations, threat detection, incident investigation and security automation, aimed squarely at the 350-201 CBRCOR core exam for CCNP Cybersecurity.

Five days, instructor-led In class or live online Class Hub + 90 days Military funding accepted

Course overview

Core examCCNP CybersecurityAdd one concentration exam to complete the certification
4 domainsOne examFundamentals, techniques, processes and automation
5 days+ 90 days of Class HubLive class, then recordings and labs for 90 days

thinQtank® Learning is offering a unique five-day training camp comprised of five days of instructor-led learning that gives students the knowledge and skills needed to implement cybersecurity using Cisco technologies. The Performing Cybersecurity Using Cisco Security Technologies (CBRCOR) course guides you through the fundamentals, methods, and automation of cybersecurity operations. The knowledge you gain in this training will prepare you for the role of Information Security Analyst on a Security Operations Center (SOC) team. You will learn foundational concepts and their application in real-world scenarios, as well as how to leverage playbooks to formulate an Incident Response (IR). The training teaches you how to use automation for security using cloud platforms and a SecDevOps methodology. You will learn the techniques for detecting cyberattacks, analyzing threats, and making appropriate recommendations to improve cybersecurity.

Your certification path

Where this course sits: what to have first, and where it leads.

This courseCisco CCNP Cybersecurity - Performing Cybersecurity Using Cisco Security Technologies (CBRCOR)Exam 350-201

Course objectives

What you will be able to do by the end of the class.

Run the SOC playbookUse playbooks, incident response workflows and metrics, and explain how compliance and risk shape SOC work.
Detect and huntApply SIEM, SOAR, UEBA, threat intelligence and tuned detection rules to find attacks early.
Investigate casesWork a case from first alert through IOC and IOA analysis, malware analysis and endpoint investigation.
Harden and segmentRecommend hardening, patching, segmentation, zero trust and DLP controls that reduce exposure.
Secure cloud operationsExplain IaaS and PaaS security considerations and how DevSecOps changes the SOC.
Automate responseWrite Python and Bash, work with JSON, XML and CSV, and call REST APIs to automate SOC tasks.

Who it is for

Who gets the most from this class, and what to know before you start.

Who should attend

  • SOC analysts with at least a year of experience
  • Incident responders and incident managers
  • Cybersecurity engineers and investigators
  • Network engineers moving into security operations
  • Engineers preparing for CCNP Cybersecurity

Prerequisites

  • Familiarity with the Splunk search and navigation functions
  • Basic understanding of scripting using one or more of Python, JavaScript, PHP or similar
  • Familiarity with UNIX/Linux shells (bash, csh) and shell commands

Course outline

8 modules. Open any one to see what it covers.

01SOC fundamentals
  • SOC service coverage and responsibilities
  • Playbooks and incident response workflow
  • Metrics, compliance standards and risk analysis
02Cloud and asset protection
  • Cloud environment types and IaaS/PaaS security
  • Segmentation, microsegmentation and zero trust
  • Patching, hardening and posture evaluation
03Detection techniques
  • SIEM and SOAR in practice
  • UEBA and AI-driven analytics
  • Tuning detection rules to cut false positives
04Threat intelligence and TTPs
  • Using threat intelligence feeds
  • Mapping attacker TTPs
  • Indicators of compromise and indicators of attack
05Investigation process
  • Threat modeling and case investigation steps
  • Malware and endpoint analysis
  • Data loss investigations
06Network analysis
  • Traffic pattern analysis during attacks
  • Packet capture and log analysis tools and their limits
  • Proactive threat hunting
07Vulnerability response
  • Triage and prioritization with CVSS
  • Mitigation planning
  • Reporting to stakeholders
08Security automation
  • Python and Bash for SOC tasks
  • JSON, XML, CSV and HTML data formats
  • REST APIs, HTTP responses, authentication, CI/CD and IaC

The full lesson-by-lesson outline is in the course datasheet (PDF).

Course features

How the class is taught, and why it works.

Live, instructor-ledEvery session is taught live by a certified instructor, in the classroom and online at the same time.
Hands-on labs30% of class time is hands-on lab work, not slides.
Exam preparation built inPractice questions and focused review aligned to exam 350-201.
Class Hub for 90 daysRecordings, materials and practice stay open for the class plus 90 days after it ends.
Attend your waySterling, VA, Atlanta, GA, Burbank, CA, or live online from anywhere.
Funding friendlyMilitary flat rate, thinQflex monthly payments, or a formal quote for your employer.

What you get

Everything below is included in the course price.

Class Hub access for the length of the class plus 90 days
thinQtank® Learning Accelerated Custom Exam Study Guide for the CBRCOR exam
Exam delivery in classroom with 98% success
Custom and focused exam preparation software and materials
Course specific thinQtank® Learning publications to promote a fun and exciting learning
Membership to the thinQtank® Learning University Online
WE DO NOT "TEACH THE TEST" - Students will receive valuable examples and discussion
Receive all reading material and study guides when you register
All courses taught by CCIE Certified instructors
Additional hours of remote lab access
Custom video recordings with even more in-depth learning of course topics
Customized practice exam software
Digital courseware
Retake any or all portions of the course as many times as you like in person or live on-line for 24 months
Six months mentoring access to CCIE engineers after completing the course
Post-class ongoing "Office Hours" events: Interactive events grant you access to top instructors long after your class is completed to ensure that you successfully utilize what you've learned.
Cisco-related Acronym List to help you understand key terms
Tips & Tricks: From preparing for your course through post-class review, these tips will help you to apply your new knowledge

Format: Five days of instructor-led learning · 70% Lecture and 30% Hands-On Labs · Instructor-Led Training, Immersive Live-Online Training, On-Site and Custom Delivery

Study plan

How the five days run, plus what to do before and after class.

Before class
  • Check the prerequisites above and fill any gaps
  • We send joining details and course materials before day one
Day 1
  • SOC fundamentals
  • Cloud and asset protection
Day 2
  • Detection techniques
  • Threat intelligence and TTPs
Day 3
  • Investigation process
  • Network analysis
Day 4
  • Vulnerability response
  • Security automation
Day 5
  • Final review and exam strategy
After class
  • Class Hub stays open 90 days: recordings, labs and practice
  • Book your exam while the material is fresh

The order of topics can shift with the class; your instructor confirms the schedule on day one.

The certification exam

Performing Cybersecurity Using Cisco Security Technologies (CBRCOR) v1.2 · exam 350-201

Exam code350-201
QuestionsNot published
Time120 minutes
Passing scoreNot published

Exam domains and weighting

1. Fundamentals
20%
2. Techniques
30%
3. Processes
30%
4. Automation
20%

Domain weights are from Cisco's published exam topics. Cisco does not publish the question count or passing score.

Format
Multiple choice and other question types
Voucher
Exam voucher available — ask us to add it to your registration. Pearson VUE test center or online proctored; we help you register and schedule
Validity
CCNP certifications are valid for three years; recertify with continuing education credits or exams

DoD 8140 and college credit

What this certification counts for with the Department of Defense, and toward a degree.

DoD 8140 / 8570 This certification is not on the DoD 8570 baseline list. Under DoD 8140, a degree or qualifying training can also meet the requirement. See which certifications qualify in the DoD Workforce Navigator.
College credit None of the 9 universities in our College Credit Navigator publishes credit for this certification yet. Ask us for a free credit review and we will check your options.

Where it can take you

Roles this certification is commonly asked for.

SOC Analyst (Tier 2/3)Lead investigations and escalations rather than just triage.
Incident ResponderContain, investigate and recover from security incidents.
Threat HunterSearch proactively for attackers that alerts have missed.
Security Automation EngineerBuild SOAR playbooks and scripts that speed up response.
Cybersecurity EngineerDesign and tune detection and response tooling.

Upcoming dates

Every class runs in the classroom and live online at the same time. Pick the dates; choose how you attend when you register.

DatesLocationFormat
Dec 7 – 11, 2026 Burbank, CA Classroom + live online Reserve
Apr 26 – 30, 2027 Burbank, CA Classroom + live online Reserve
Jun 14 – 18, 2027 Burbank, CA Classroom + live online Reserve
Aug 9 – 13, 2027 Burbank, CA Classroom + live online Reserve
Oct 11 – 15, 2027 Burbank, CA Classroom + live online Reserve
Dec 6 – 10, 2027 Burbank, CA Classroom + live online Reserve

Paying for it

The price above is our standard rate. These options can bring it down or spread it out.

Military & veterans
$1,500

Flat rate per class when you use Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0. Your program confirms eligibility.

Funding details
thinQflex™
Name your price

Paying yourself? Tell us what you can pay and over how many months, up to twelve. We say yes, or come back with terms.

Make an offer
Employer or agency
Formal quote

A formal quote with the course and exam voucher as separate lines, valid 30 days. Group and government pricing available.

Request a quote

How to enroll

Four steps from here to certified.

  1. Pick your datesChoose a class from the dates above, in a classroom or live online.
  2. Reserve or get a quoteReserve your seat, ask for a quote for your employer, or make a thinQflex offer.
  3. Get readyWe confirm your seat and send joining details and materials before day one.
  4. Attend and certifyTake the class, then sit exam 350-201, with Class Hub open for 90 days after.

Frequently asked questions

What else do I need for CCNP Cybersecurity?
One concentration exam: 300-215 CBRFIR (forensics and incident response), which we teach, or 300-220 CBRTHD (threat hunting and defense).
Do I need Splunk experience?
It helps. Familiarity with Splunk search, a Linux shell and some basic scripting will make the labs and the automation domain easier.
Does CBRCOR count on its own?
Yes. Passing 350-201 earns a Cisco Certified Specialist certification as well as covering the CCNP Cybersecurity core requirement.
What does it cost?
The standard price is $3,850; exam voucher available — ask us to add it to your registration. Military students using AF COOL, Army CA, MyCAA or VET TEC 2.0 pay $1,500, and thinQflex lets you name your own price and monthly payment.
How long is the class?
Five days of live, instructor-led training, about 30% of it hands-on labs.
Can I attend live online?
Yes. Every class runs live online at the same time as the classroom, with the same instructor and labs.
How long do I keep access to the materials?
Your Class Hub stays open for the length of the class plus 90 days.
Is the exam included?
The exam voucher is priced separately; we can add it to your registration or quote.
Can I use military funding?
Yes. With Air Force COOL, Army CA, MyCAA or VET TEC 2.0 you pay a flat $1,500 per class.
Can my employer pay?
Yes. Request a quote and we will send a formal one, valid for 30 days.
What if I cannot pay all at once?
Use thinQflex to name your price and spread payments over up to twelve months.
Where are the classrooms?
Sterling, Virginia; Atlanta, Georgia; and Burbank, California. Every class also runs live online, so you can join from anywhere.
What do I need to attend online?
A computer with a reliable internet connection, a headset or speakers, and a microphone. A webcam is recommended.
Will I get a certificate of completion?
Yes. You receive a thinQtank Learning certificate of completion when you finish the class.
Which course should I take next?
Most students go on to Cisco CCNP Cybersecurity - Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity (CBRFIR), Cisco CCNA Cybersecurity, Cisco CCNP Security - Implementing and Operating Cisco Security Core Technologies (SCOR). Tell us your goal and we will map the path with you.
Do you run private classes for teams?
Yes. We deliver private classes on-site or online for teams and agencies, on your dates. Ask for a quote.
Can you help me choose the right course?
Yes. Call 855-868-4467 or email sasmith@thinqtanklearning.com and we will recommend the right starting point.

Ready to earn your CCNP Cybersecurity - Performing Cybersecurity Using Cisco Security Technologies (CBRCOR)?

Next class Dec 7 – 11, 2026 · Burbank, CA and live online.