Formerly known as CyberOps Associate, the CCNA Cybersecurity certification validates the skills of an entry-level analyst in a security operations center (SOC). This five-day course covers the 200-201 exam outline and builds the habits of the job: reading an alert, analyzing a packet capture, reconstructing what happened on an endpoint and following an incident response procedure. It is a practical first step toward a SOC role.
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : 200-201 CCNACBR v1.2 · 120 min · English · pass/fail result
Exam voucher : Exam voucher: included or optional depending on the package — contact us.
Objectives
Master security concepts: CIA triad, defense in depth, access control models, CVSS
Identify useful monitoring data sources and common network and web attacks
Analyze endpoint activity: logs, operating system components, indicators of compromise
Interpret IDS/IPS alerts and extract evidence from a PCAP file
Apply incident response and evidence handling frameworks
Classify protected data and profile networks and hosts
Program
Security concepts (20%)
Network, endpoint and cloud deployments
Threat intelligence
Access control models and CVSS
Security monitoring (25%)
Attack surface
Data sources: NetFlow, firewalls, tcpdump
Network and web attacks (DDoS, SQL injection, XSS)
Evasion techniques
Host-based analysis (20%)
Endpoint security technologies
Windows and Linux components
Log interpretation
Malware analysis tools
Network intrusion analysis (20%)
IDS/IPS alerts
Protocol headers
Extracting files from a PCAP
False positives and false negatives
Security policies and procedures (15%)
Incident response (NIST SP 800-61)
Forensics (NIST SP 800-86)
Asset and patch management
Prerequisites
No formal prerequisites from Cisco
Recommended: TCP/IP basics, working knowledge of Windows and Linux, and basic network security concepts (CCNA level helps)
Target audience
Aspiring tier-1 SOC analysts
Network or system technicians moving into security
Cybersecurity students
IT teams that want to work better with their SOC
The exam
Exam 200-201, Understanding Cisco Cybersecurity Operations Fundamentals (version 1.2), lasts 120 minutes and is delivered in English through Pearson VUE, at a test center or online. Results are pass/fail. Passing it earns the CCNA Cybersecurity certification, the new name of CyberOps Associate since early 2026. The certification is valid for three years and can be renewed by exam or with Continuing Education credits; the associated Cisco course is worth 28 credits.
Preparation tips
Practice with Wireshark on real captures
Learn to tell a true positive from a false positive quickly
Review the NIST incident response phases until you can list them in order
Frequently asked questions (FAQ)
Does CCNA Cybersecurity replace CyberOps Associate?
Yes, it is a rename: the exam is still 200-201, with the same version 1.2 outline. Only the certification name and the exam's short code (now CCNACBR) have changed.
Do I need the regular CCNA first?
No, it is not required. Cisco does recommend solid networking basics, and being close to CCNA level makes the course far more comfortable.
How long is the 200-201 exam?
The exam lasts 120 minutes. Cisco does not publish a fixed number of questions, so manage your time by moving on from sticking points quickly and keeping a buffer for the end.
Which jobs does this certification target?
Mainly tier-1 SOC analyst, incident detection analyst or security technician roles. It is also a good base before CCNP Cybersecurity.
Does the course include hands-on work?
Yes. Packet capture analysis, log reading, alert triage and incident response drills take up a large share of the five days, so you practice the same tasks a junior analyst handles on shift.
Securevalley training — online and in-person sessions. Contact us for pricing and registration terms.
Securevalley is not a training partner of Cisco. Cisco, CCNA and CyberOps are trademarks of Cisco.