
Cisco CCNA Cybersecurity (200-201)
Exam 200-201 Cisco Intermediate
Cisco's SOC-analyst certification, formerly CyberOps Associate — monitoring, intrusion analysis and incident response from a network operations perspective.
1 course · 11 sections · 80 lectures · 68 labs · at least 85 h of hands-on labs
All 68 200-201 hands-on labs on one page →
Free to start: the free lessons and guides for this roadmap →
Free resources to get you started
Exam domains
- Security Concepts — 20%
- Security Monitoring — 25%
- Host-Based Analysis — 20%
- Network Intrusion Analysis — 20%
- Security Policies and Procedures — 15%
Try a free SOC lab: Shut the door (~4 min) → A scripted simulation in your browser. No account needed.
The path
Start here →
Step 1 — Learn CCNA Cybersecurity
Security monitoring, host and network analysis, incident response.
1 course · 11 sections · 80 lectures
Learn
- CourseCCNA Cybersecurity (200-201) - Video Training Series (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 80 lectures
- Course Overview 1
- Welcome to the Course! 2
- Foundations of Digital Defense 19
- Threat Detection and Surveillance 19
- Endpoint Protection and Analysis 9
- Network Traffic Analysis and Interpretation 10
- Cybersecurity Governance and Best Practices 11
- Exam Preparation 4
- Congratulations and Next Steps 1
- Practice Exams 2
- Course Downloads 2
Step 2 — Analyse real traffic
Detect intrusions in live captures.
35 labs
Learn
- CourseCovered in CCNA Cybersecurity (200-201) - Video Training Series (opens in a new tab)opens on courses.stationx.net — host and network analysis sections 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 80 lectures
- Course Overview 1
- Welcome to the Course! 2
- Foundations of Digital Defense 19
- Threat Detection and Surveillance 19
- Endpoint Protection and Analysis 9
- Network Traffic Analysis and Interpretation 10
- Cybersecurity Governance and Best Practices 11
- Exam Preparation 4
- Congratulations and Next Steps 1
- Practice Exams 2
- Course Downloads 2
Practise
- LabsIntro to Network Security & Traffic Analysis — 12 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Applying Filters to TCPDump and WiresharkDuration: 1 h
- DNS as a Remote ShellDuration: 1 h
- Firewall Setup and ConfigurationDuration: 1 h
- Gap Analysis of Firewall RulesDuration: 2 h
- Implementing Least-Privilege on WindowsDuration: 1 h
- Network Segmentation (FW/DMZ/WAN/LAN)Duration: 1 h
- Setting Up Zones in a FirewallDuration: 1 h
- Snorby Setup and OperationDuration: 1 h
- TCPDumpDuration: 1 h
- Tweaking Firewall Rules for DetectionDuration: 1 h
- Using Snort and Wireshark to Analyze TrafficDuration: 1 h
- WiresharkDuration: 1 h
- LabsNetwork Intrusion Detection — 8 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Comprehensive Threat ResponseDuration: 2 h
- Conduct Supplemental MonitoringDuration: 1 h
- Create Custom Snort RulesDuration: 1 h
- MITRE ATT&CKDuration: 1 h
- Monitoring for False PositivesDuration: 1 h
- Monitoring Network TrafficDuration: 1 h
- Monitoring Network Traffic for Potential IOA/IOCDuration: 1 h
- SNORT Configuration and Operation LabDuration: 1 h
- LabsNetwork Forensics — 15 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Analyze Browser-based Heap Spray AttackDuration: 1 h
- Automated in-Depth Packet DecodingDuration: 2 h
- Clonezilla NetworkDuration: 1 h
- Identifying Intrusion and Mitigating Attacks with RHEL ServerDuration: 1 h
- Identifying Malicious CallbacksDuration: 1 h
- Identifying Malicious Network ConnectionsDuration: 1 h
- Incident Detection and IdentificationDuration: 3 h
- Nexpose: Analysis & Reporting (Executive, High Risk and Recommendation Reporting)Duration: 1 h
- Parse Files Out of Network TrafficDuration: 1 h
- Searching for Indicators of CompromiseDuration: 1 h
- Setting up Filters and Queries in KibanaDuration: 1 h
- Use pfTop to Analyze Network TrafficDuration: 1 h
- Verify Attributes of Identified SilentBanker IntrusionDuration: 1 h
- Verify Attributes of Intrusion Through Additional AnalysisDuration: 1 h
- Windows Event Log Manipulation via Windows Event ViewerDuration: 1 h
Step 3 — Monitor with a SIEM and analyse hosts
Collect and correlate logs, then work the endpoint: processes, memory and malware artefacts. Security Monitoring is 25% of the exam, Host-Based Analysis 20%.
24 labs
Learn
- CourseCovered in CCNA Cybersecurity (200-201) - Video Training Series (opens in a new tab)opens on courses.stationx.net — Threat Detection and Surveillance, and Endpoint Protection and Analysis sections 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 80 lectures
- Course Overview 1
- Welcome to the Course! 2
- Foundations of Digital Defense 19
- Threat Detection and Surveillance 19
- Endpoint Protection and Analysis 9
- Network Traffic Analysis and Interpretation 10
- Cybersecurity Governance and Best Practices 11
- Exam Preparation 4
- Congratulations and Next Steps 1
- Practice Exams 2
- Course Downloads 2
Practise
- LabsQRadar SIEM — 9 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Event Log Collection with QRadarDuration: 2 h
- QRADAR - Auditing Service Accounts and Generating SIEM ReportsDuration: 2 h
- QRadar - Centralized MonitoringDuration: 1 h
- QRADAR - Collecting Logs and Verifying Syslog Aggregation with pfSenseDuration: 2 h
- QRadar - IDS Setup and ConfigurationDuration: 1 h
- QRadar - Log Correlation & Analysis to Identify Potential IOCDuration: 1 h
- QRadar - Log Correlation & Analysis to Identify Potential IOC with Custom Log TypesDuration: 3 h
- QRADAR - Setting Up SYSLOG Forwarding From a Windows SystemDuration: 2 h
- QRadar - Snort Signatures, IDS Tuning, and BlockingDuration: 1 h
- LabsMalware Analysis & Reverse Engineering — 15 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Analysis and Recommendation ReportDuration: 1 h
- Analyze and Classify MalwareDuration: 1 h
- Analyze DoomJuice Infection to Identify Attack Vector and PayloadDuration: 1 h
- Analyze Malicious Activity in Memory Using VolatilityDuration: 1 h
- Conduct Root Cause Analysis for System CrashesDuration: 1 h
- Detect Embedded Shellcode in a Microsoft Office DocumentDuration: 1 h
- Dynamic Malware AnalysisDuration: 1 h
- Fundamentals of Malware Analysis
- Linux AnalysisDuration: 1 h
- Log AnalysisDuration: 1 h
- MAC AnalysisDuration: 1 h
- Practical Malware Analysis Labs
- Recover from IncidentDuration: 2 h
- Remove TrojanDuration: 1 h
- Validate Indications of Compromise: Analysis of PE FileDuration: 1 h
Step 4 — Respond to incidents
Incident handling, evidence and chain of custody, and the plans behind them: Security Policies and Procedures is 15% of the exam.
9 labs
Learn
- CourseCovered in CCNA Cybersecurity (200-201) - Video Training Series (opens in a new tab)opens on courses.stationx.net — Cybersecurity Governance and Best Practices section 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 80 lectures
- Course Overview 1
- Welcome to the Course! 2
- Foundations of Digital Defense 19
- Threat Detection and Surveillance 19
- Endpoint Protection and Analysis 9
- Network Traffic Analysis and Interpretation 10
- Cybersecurity Governance and Best Practices 11
- Exam Preparation 4
- Congratulations and Next Steps 1
- Practice Exams 2
- Course Downloads 2
Practise
- LabsForensic Investigations and Evidence Handling — 9 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Analyze and Update a Company BCP/BIA/DRP/CIRPDuration: 2 h
- BCP DRP and Test PlanningDuration: 2 h
- Creating a Case in AutopsyDuration: 2 h
- Creating a Case in OSFDuration: 1 h
- Creation of BCP and DRPDuration: 3 h
- FTK Analysis & ReportingDuration: 1 h
- FTK Enterprise Fundamentals and Mobile InvestigationDuration: 2 h
- Metadata Extraction LabDuration: 1 h
- Registry AnalysisDuration: 2 h
Before the exam
- CoursePractice exams in CCNA Cybersecurity (200-201) - Video Training Series (opens in a new tab)opens on courses.stationx.net — the “Practice Exams” section






