Cisco / Cybersecurity operations / 300-220
Complete the CBRCOR + CBRTHD CCNP route
Add Threat Hunting and Defending to the CBRCOR core to complete this recommended CCNP Cybersecurity combination. Focus on hypotheses, adversary behavior, attribution limits, hunting processes, evidence, and outcomes.
Recommended prior milestone · no formal prerequisite
Check your 350-201 foundation
Cisco lists no formal prerequisite. Use this checkpoint to identify gaps before the more advanced route.
Complete professional combination
Pair 300-220 with CBRCOR core
This route requires both exams for the named CCNP combination. Each passed exam also earns its corresponding Specialist credential.
Core learning
Follow the current official objectives
- 1.Threat modeling
- 2.Threat actor attribution techniques
- 3.Threat hunting techniques
- 4.Threat hunting processes
- 5.Threat hunting outcomes and improvement
Hands-on consolidation
Build and troubleshoot in an isolated lab
Design and execute three hunts over safe historical data: identity abuse, command-and-control behavior, and lateral movement. Define hypotheses and data requirements, document queries and findings, test alternative explanations, and turn confirmed findings into detections.
You can run a reproducible hunt, distinguish observation from attribution, communicate confidence, and convert findings into measured defensive improvements.
Practice and review
Find gaps with our 300-220 test
75 original, source-backed questions; the first 7 are free. Pair knowledge review with the practical lab above.
Try our 300-220 practice test →