thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cisco · Cybersecurity · Associate

Cisco CCNA Cybersecurity (formerly CyberOps Associate) exam guide

Exam 200-201 CCNACBR (Understanding Cisco Cybersecurity Operations Fundamentals) v1.2

CCNA Cybersecurity (renamed from CyberOps Associate in February 2026) validates the core skills of a security operations center analyst: security monitoring, host and network intrusion analysis, and security policies and procedures. It is one of the few vendor exams designed specifically around Tier 1 and Tier 2 SOC work.

QuestionsSee official page
Time limit120 minutes
Passing scoreSee official page
Exam fee$300 USD
Valid for3 years
DeliveryProctored at a test center or online, scheduled through Cisco's certification portal

Format: Multiple choice (single and multiple answer), drag-and-drop, and simulation/testlet-style items; pass/fail. Fee note: Cisco Learning Credits accepted.

Who it's for

Aspiring and junior SOC analysts, incident responders and network engineers moving into security operations.

What the exam covers

Security Concepts—
Security Monitoring—
Host-Based Analysis—
Network Intrusion Analysis—
Security Policies and Procedures—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None. Existing CyberOps Associate holders were transitioned to CCNA Cybersecurity.

Recommended: Familiarity with Ethernet and TCP/IP networking, Windows and Linux operating systems, and basic security concepts.

Keeping it active

Valid 3 years. Recertify before expiry by earning 30 Cisco Continuing Education (CE) credits, or by passing one associate exam, one professional core or concentration exam, or a CCIE lab. Passing a higher-level Cisco exam also renews it.

Skills & careers

Skills it validates

  • Analyzing packet captures and NetFlow for indicators of compromise
  • Interpreting IDS/IPS alerts, firewall and proxy logs
  • Host-based analysis of Windows and Linux artifacts and processes
  • Applying the Cyber Kill Chain, MITRE ATT&CK and Diamond Model
  • Classifying incidents and following NIST SP 800-61 response steps
  • Understanding SIEM, SOAR and threat intelligence workflows
  • Cryptography and PKI fundamentals

Job roles

SOC AnalystCybersecurity AnalystIncident ResponderSecurity Monitoring AnalystThreat Analyst (Junior)Network Security Analyst

DoD 8140

The exam (as CyberOps Associate) has been listed on the DoD 8570/8140 baseline for CSSP Analyst and CSSP Incident Responder roles; confirm the current DoD 8140 qualification matrix for your specific work role. Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Weeks 1-2: Security concepts: CIA, threat actors, attack vectors, access control models, cryptography basics.
  2. Weeks 3-4: Security monitoring: data types (full packet capture, NetFlow, logs), SIEM and SOAR, evasion techniques.
  3. Weeks 5-6: Host-based analysis on Windows and Linux; practice in a lab with Sysinternals and Linux logs.
  4. Weeks 7-8: Network intrusion analysis with Wireshark and Security Onion; read real PCAPs.
  5. Weeks 9-10: Policies, NIST incident response, CVSS and forensics; then timed practice exams.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Practice reading raw packet captures and log lines; many questions show an artifact and ask what it indicates.
  • Know the differences between true/false positives and negatives with concrete examples.
  • Memorize NIST SP 800-61 phases and which activities belong in each.
  • Be able to map an observed behavior to a Cyber Kill Chain or ATT&CK stage.
  • Know Windows and Linux file system, process and log locations at a basic level.

Key terms for this exam

All 37 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

Is CyberOps Associate now CCNA Cybersecurity?

Yes. Cisco renamed it on February 3, 2026, and the exam code 200-201 continues with an updated v1.2 blueprint.

How much does the 200-201 exam cost?

US$300.

CCNA Cybersecurity vs Security+?

Security+ is broader and more commonly required for DoD and general security jobs; CCNA Cybersecurity is deeper on SOC monitoring and analysis. SOC hiring managers value both.

Do I need the CCNA first?

No, there are no prerequisites, but solid TCP/IP knowledge is essential.

What is next after CCNA Cybersecurity?

CCNP Cybersecurity (350-201 CBRCOR plus a concentration such as CBRFIR) or CompTIA CySA+.

Official page: www.cisco.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.