Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Cisco
Exam Format
90 min
65-75
Variable (Cisco does not publish passing scores)
Professional
Registration
$300 USD
Pearson VUE or online proctoring
Validity
3 years
Pass any 300-level concentration exam; Pass the current CCNP Security core exam (350-701 SCOR); Pass any CCIE lab exam
300-206 Exam Topics and Domains
300-206 is organized into 6 weighted domains. Expect to work with Cisco ASA, Cisco IOS Router, Cisco IOS Switch, Cisco Switch, and more.
1
Threat Defense
25%
Implement Firewall (ASA or IOS)
Implement ACLsImplement static/dynamic NAT/PATImplement object groupsDescribe threat detection featuresImplement botnet traffic filteringConfigure application filtering and protocol inspectionDescribe ASA security contexts
- Configure and verify Access Control Lists on Cisco security devices
- Implement Network Address Translation solutions including static, dynamic, and PAT
- Utilize object groups to simplify security policy management
- Configure threat detection and botnet filtering on Cisco ASA
- Implement application filtering using Modular Policy Framework
Implement Layer 2 Security
Configure DHCP SnoopingConfigure Dynamic ARP Inspection (DAI)Configure Storm ControlConfigure Port SecurityDescribe MACSecConfigure IP Source Guard
- Implement comprehensive Layer 2 security controls on Cisco switches
- Configure DHCP snooping, DAI, and IP Source Guard to prevent common Layer 2 attacks
- Implement port security to control MAC address access
- Understand MACSec for Layer 2 encryption
2
Cisco Security Devices GUIs and Secured CLI Management
25%
Implement SSHv2, HTTPS, and SNMPv3 access on network devices
Configure SSHv2Configure HTTPS managementConfigure SNMPv3
- Implement secure management protocols on Cisco devices
- Configure SSHv2 for secure CLI access
- Enable HTTPS for secure web management
- Deploy SNMPv3 with appropriate security levels
Implement RBAC on the ASA/IOS using CLI and ASDM
Configure Role-Based Access Control
- Implement role-based access control for administrative separation
- Configure privilege levels and CLI views
- Manage administrative access using ASDM
Describe Cisco Prime Infrastructure
Cisco Prime Infrastructure capabilities
- Understand Cisco Prime Infrastructure capabilities
- Describe centralized network management features
Describe Cisco Security Manager (CSM)
Cisco Security Manager overview
- Understand Cisco Security Manager capabilities
- Describe centralized security management benefits
Implement Device Managers
Configure ASA features using ASDM
- Navigate and utilize Cisco ASDM for ASA management
- Use ASDM wizards for configuration tasks
- Leverage ASDM troubleshooting tools
3
Threat Defense Architectures
16%
Design a Firewall Solution
High AvailabilitySecurity Zoning ConceptsTransparent vs. Routed ModesSecurity Contexts
- Design firewall solutions with high availability
- Implement proper security zoning
- Choose appropriate firewall modes for different scenarios
- Understand security contexts for multi-tenant environments
Design Layer 2 Security Solutions
Layer 2 Security Architecture
- Design secure Layer 2 architectures
- Implement VLAN segmentation for security
4
Management Services on Cisco Devices
12%
Configure AAA on Cisco Routers and ASA
AAA AuthenticationAAA AuthorizationAAA Accounting
- Implement AAA for authentication, authorization, and accounting
- Configure RADIUS and TACACS+ server integration
- Set up command authorization and accounting
Configure Device Hardening
System Hardening
- Implement device hardening measures
- Configure control plane protection
Implement Logging
Syslog Configuration
- Configure comprehensive logging on Cisco devices
- Implement centralized syslog collection
5
Troubleshooting, Monitoring and Reporting Tools
10%
Monitor Firewall Operations
ASA Monitoring Commands
- Utilize monitoring tools for firewall operations
- Perform packet capture and analysis
- Use ASA Packet Tracer for troubleshooting
Monitor IOS Router Firewall Features
Zone-Based Firewall Monitoring
- Monitor Zone-Based Firewall operations
- Troubleshoot ZBFW policies
- Analyze firewall statistics
Implement NetFlow
NetFlow Configuration and Analysis
- Configure NetFlow for traffic visibility
- Analyze NetFlow data for security monitoring
Troubleshooting Common Issues
Firewall Troubleshooting Methodology
- Apply systematic troubleshooting methodology
- Resolve common firewall configuration issues
- Use logs and monitoring tools for problem diagnosis
6
Security Components and Considerations
12%
Describe Security Threats and Vulnerabilities
Common Network Attacks
- Identify common security threats
- Understand attack vectors and mechanisms
- Recognize vulnerabilities in network infrastructure
Implement Security Best Practices
Defense-in-Depth Strategy
- Apply defense-in-depth security principles
- Implement security best practices across network infrastructure
Describe VPN Technologies
IPsec VPN FundamentalsSSL VPN
- Understand VPN technologies and protocols
- Describe IPsec and SSL VPN fundamentals
- Identify appropriate VPN solutions for different scenarios
How do I earn this certification?
Passing 300-206 earns the CCNP Security certification. It sits in the Security track.
Current Level Exams
- 300-208 - SISAS - Implementing Cisco Secure Access SolutionsFocuses on identity services, 802.1X, profiling services, guest management, and BYOD
- 300-209 - SIMOS - Implementing Cisco Secure Mobility SolutionsCovers VPN technologies including site-to-site, remote access, clientless, and AnyConnect VPNs
- 300-210 - SITCS - Implementing Cisco Threat Control SolutionsFocuses on content security, email security, web security, and cloud web security
- 300-206 - SENSS - Implementing Cisco Edge Network Security SolutionsCurrent exam - covers perimeter security including ASA firewalls, ACLs, NAT, and zone-based firewalls
Next Level Options
- CCIE Security Lab - CCIE Security Lab Exam Expert-level certification requiring passing both a written exam and an 8-hour hands-on lab exam
- 350-701 - SCOR - Implementing and Operating Cisco Security Core TechnologiesCore exam for the new CCNP Security track that replaced the legacy CCNP Security in 2020
Alternative Paths
- 300-135 - TSHOOT - Troubleshooting and Maintaining Cisco IP NetworksComplementary troubleshooting skills applicable to security scenarios
- 300-415 - ENSDWI - Implementing Cisco SD-WAN SolutionsSD-WAN solutions incorporate security features; valuable for understanding modern security architectures
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
Use the PlanetCert practice test alongside the study plan below to prepare efficiently for 300-206.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2019-08-01
Updates
- Cisco ASA Software 9.12 Latest ASA features including enhanced threat detection and improved NAT capabilities are tested • Release date: 2019-07-29
- Zone-Based Firewall IOS 15.x ZBFW remains a core exam topic with configuration and troubleshooting scenarios • Release date: Ongoing updates
- Layer 2 Security Features IOS 15.x / IOS-XE DHCP snooping, DAI, port security, and IP Source Guard configuration knowledge required • Release date: Continuous enhancements
Who should take this exam?
This exam is typically taken by Network security engineers and Security administrators.
- CCNA Security certification or equivalent knowledge
- Working knowledge of Cisco IOS and Cisco ASA
- Understanding of networking fundamentals
- Experience with firewalls and perimeter security devices
- Familiarity with security concepts and best practices
Important: Exam Retirement Notice
Related practice tests
- 300-535Automating and Programming Cisco Service Provider Solutions (SPAUTO)
- 200-901CCNA Automation (DevNet Associate)
- 200-201CCNA Cybersecurity (CyberOps Associate)
- 200-301Cisco Certified Network Associate (CCNA)
- 300-420Designing Cisco Enterprise Networks (ENSLD)