CCNA Security no longer exists. Cisco retired it, along with the 210-260 IINS exam, in the February 2020 certification overhaul, so any CCNA Security book you buy today prepares you for a credential you cannot earn. Its firewall, VPN, AAA and Layer 2 security topics did not disappear, though; they now sit across three living paths: the security domain of CCNA 200-301, CCNA Cybersecurity (the old CyberOps Associate, still exam 200-201) and CCNP Security. That last one changed most recently: its SCOR 350-701 core exam moved to v2.0 on August 27, 2026.
Most Official Cert Guides on sale predate the topic lists they are sold against, so picking one takes care. Below are six books for the successors, mapped to where each old topic is tested now. Exam codes and versions were checked against Cisco’s own pages in October 2026, and prices against Amazon that week.
Pick a Cisco Security Book by Goal
If you only want the answer, match your goal to one book and stop there:
- First security certification, SOC or analyst role: CCNA Cybersecurity 200-201 Official Cert Guide
- Same certification, more labs: Cisco Certified CyberOps Associate 200-201 Certification Guide
- CCNP Security core: SCOR 350-701 Official Cert Guide, 2nd Edition plus SSE, SASE, and Zero Trust
- Identity and NAC concentration: SISE 300-715 Official Cert Guide
- Firewall concentration: Cisco Secure Firewall and IPS Official Cert Guide
Searching for “CCNA Security” because you want a networking job with security in it? Start with CCNA 200-301 instead. Its security fundamentals domain covers port security, DHCP snooping, ACLs and AAA, and our CCNA 200-301 book guide covers the study sets for it. Match the book to your test date, because February 2, 2027 is the last day for CCNA v1.1 and v2.0 starts on February 3, 2027.
Map the Old CCNA Security Topics to Current Exams
Video courses titled “CCNA Security 210-260 Cert Prep” still turn up in search, split into seven parts from security concepts to content and endpoint security. They teach a retired exam, but the skills behind each part are still tested somewhere. This table shows where, using the current Cisco topic lists for CCNA 200-301 v1.1, CCNA Cybersecurity 200-201 v1.2 and SCOR 350-701 v2.0:
| 210-260 part | Where it’s tested now | Book that covers it |
|---|---|---|
| 1. Security concepts | CCNA 200-301 security fundamentals, CCNA Cybersecurity domain 1 (20%), SCOR v2.0 domain 1 | Picks 1, 2 and 3 |
| 2. Secure access | SCOR v2.0 topics 2.6 (AAA with TACACS+ and RADIUS) and 6.3 (802.1X and MAB with ISE), SISE 300-715 | Picks 3 and 5 |
| 3. VPN | SCOR v2.0 topics 1.6, 2.9 and 2.10 (VPN on Cisco Secure Firewall), SNCF 300-710. The last SVPN test day was August 26, 2026 | Picks 3 and 6 |
| 4. Secure routing and switching | CCNA 200-301 Layer 2 security, SCOR v2.0 topic 2.3 | Pick 3 |
| 5. Cisco firewall technologies | SCOR v2.0 topics 2.1 and 2.8, SNCF 300-710 | Picks 3 and 6 |
| 6. Intrusion prevention | SCOR v2.0 topics 2.1 and 2.8 (IPS on Secure Firewall), SNCF 300-710 | Picks 3 and 6 |
| 7. Content and endpoint security | SCOR v2.0 domain 4 (SSE with Cisco Secure Access) and domain 5 (Secure Endpoint, Email Threat Defense). The last ESA and WSA test day was August 26, 2026 | Picks 3 and 4 |
Part 7 changed the most. CCNA Security taught web and email security as appliances you rack and configure. SCOR v2.0 teaches them as cloud services: secure internet access, secure private access, data loss prevention and AI guardrails delivered from Cisco Secure Access. If an old course or book spends chapters on the Web Security Appliance, that time is better spent on SSE, which is why pick 4 is on this list.
Check Which Cisco Security Exams Are Current
Cisco reshuffled both security tracks. CyberOps Associate became CCNA Cybersecurity under the same 200-201 exam code, and CCNP Security lost three concentration exams when SCOR v2.0 arrived in August 2026. The Cisco Learning Network listed this lineup in October 2026:
| Certification | Exam and current version | Major-publisher book on sale |
|---|---|---|
| CCNA Cybersecurity | 200-201 CCNACBR v1.2 | Yes, written for v1.0, free v1.2 supplement |
| CCNP Security core | 350-701 SCOR v2.0 | Written for v1.1 only |
| CCNP Security concentration | 300-710 SNCF v1.2 | Yes, written for the original release |
| CCNP Security concentration | 300-715 SISE v1.2 | Yes, written for the original release |
| CCNP Security concentration | 300-740 SSCA v2.0 (formerly SCAZT) | None |
| CCNP Security concentration | 300-745 SDSI v1.0 | None |
| CCNP Cybersecurity core | 350-201 CBRCOR v1.2 | None |
| Retired, last test day August 26, 2026 | 300-720 SESA, 300-725 SWSA, 300-730 SVPN | Don’t buy |
Three rows have no book from Cisco Press, Packt, Sybex or another major publisher. Amazon does list self-published study guides and question banks for SSCA, SDSI and CBRCOR, but none comes from a publisher with editorial review or an errata page you can hold it to. For those exams, Cisco’s own training on Cisco U. and each exam’s topics page are the honest starting point.
We picked each book against the current topic list rather than by sales rank. A pick had to come from a publisher with editorial review, be sold new on Amazon, and cover a certification you can still earn. We read the publisher’s table of contents and companion repository where one exists, and we say plainly where a book trails the topic list.
1. CCNA Cybersecurity CCNACBR 200-201 Official Cert Guide
Omar Santos wrote the Cisco Press guide for the associate security certification, and it is the closest thing to a CCNA Security book you can still use for a live Cisco credential.
Amazon now lists it as the CCNA Cybersecurity guide, but the cover still reads “Cisco Cybersecurity Operations Fundamentals CBROPS 200-201”, and the text dates from the 2020 v1.0 topic list. That matters less than it sounds, because the five domains and their weights (20, 25, 20, 20 and 15 percent) did not change between v1.0 and v1.2. What v1.2 adds is a layer on top of the same structure:
- Container, virtual and cloud security deployments
- Threat modeling and DevSecOps
- Attribute-based access control
- CVSS temporal and environmental metrics
- Social engineering with generative AI
- Predictive AI in endpoint security tools
The update also dropped a few v1.0 topics the book still teaches (least privilege, zero trust and threat intelligence platforms in 1.3, allow-listing and sandboxing in 3.1, and comparing tampered disk images in 3.5), so you can skim those. Cisco Press covers the new material with a free v1.2 digital supplement you download after registering the book on ciscopress.com, so register it the day it arrives. The 688 pages walk through security monitoring, host-based analysis, network intrusion analysis and NIST-style incident handling, and the Pearson Test Prep engine adds two full practice exams. The CCNA Cybersecurity credential itself costs $300 to sit and is valid for three years.
Pick it up if you want the official route to a first Cisco security certification and you will actually read the supplement. Lab-first learners should start with pick 2 instead. It sold for $45 to $55 when we checked, sold by Amazon. Check the current price on Amazon.
2. Cisco Certified CyberOps Associate 200-201 Certification Guide
Glen D. Singh’s Packt guide targets the same 200-201 exam from a hands-on angle, with a lab you build yourself on a single computer.
The book’s companion repository lists the toolkit for all 16 chapters: Wireshark, Hashcalc, VirtualBox, Packet Tracer 7.3.1, an Ubuntu 20.04 desktop, FTK Imager and Kali Linux 2021.1. That is a free lab, and it is where this book earns its place next to the official guide. Reading about packet captures and host artifacts is one thing; extracting a file from a TCP stream in Wireshark yourself, which the 200-201 topic list asks for, is what makes it stick. If you need a refresher on the tool, our Wireshark book guide goes deeper.
It shares pick 1’s weakness. Packt published it in June 2021, it carries the old CyberOps name, and it has no v1.2 supplement, so the AI and cloud additions are not in it. The tool versions have aged too: use a current Kali and Ubuntu, and the exercises still work the same way.
It works as your main text if you learn best at a keyboard, or as a lab companion to pick 1. If you want one book tied to the current version, pick 1 with its supplement is the better buy. It sold for $45 to $55 when we checked, sold by Amazon. Check the current price on Amazon.
3. CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide, 2nd Edition
Santos also wrote the Cisco Press guide for SCOR, the core exam every CCNP Security candidate passes and the written qualifier for the CCIE Security lab.
The second edition came out in November 2023 for SCOR v1.1, and that is the honest caveat on this whole pick. Cisco calls v2.0 the first major revision since SCOR launched in February 2020 and tells candidates to treat it as new content, and as of October 2026 Cisco Press hasn’t announced a v2.0 edition. So you’d be buying 832 pages that cover most of v2.0’s network security, cloud, endpoint and access domains (domains 2, 3, 5 and 6, weighted 25, 15, 15 and 15 percent) and none of domain 4, the 10 percent SSE domain.
The chapters that still match carry most of the configuration work. Chapters on AAA with ISE, TACACS+ and RADIUS, Layer 2 attacks and their defenses, Cisco Secure Firewall access control and intrusion policies, and Secure Endpoint all map onto v2.0 topics. The cryptography and PKI chapter covers the basics that v2.0 builds on. Where it falls short is listed in the next section, together with what to read instead.
It belongs on your desk if you are sitting SCOR v2.0 and want a structured base for the material that carried over, paired with pick 4. Waiting for a v2.0 edition is the alternative; Cisco Press reissues an Official Cert Guide when an exam changes this much, but it has not given a date. When we checked, a third-party seller held the buy box at $60 to $70 for a new copy. Check the current price on Amazon.
4. SSE, SASE, and Zero Trust
This 2026 Cisco Press book by Gustavo Medina, Oscar Ramirez and Ryan Shoemaker covers the architecture behind SCOR v2.0’s newest domain.
SCOR v2.0 added a whole domain on Security Service Edge and Secure Access Service Edge, and no major-publisher certification book covers it yet. This one comes closest. After an opening chapter on how edge security evolved, its eight chapters cover SSE capabilities and the ways users, branches and applications connect to it. They then cover SASE with SD-WAN and the middle mile, zero trust principles and maturity models, and SASE troubleshooting near the end. At 368 pages it is the shortest pick here.
Treat it as an architecture book rather than a lab guide, because it is not written to Cisco’s topic list. You won’t find click-by-click Cisco Secure Access policy setup in it, which SCOR v2.0 topics 4.2 to 4.4 ask for, so pair it with Cisco’s Secure Access documentation or the Cisco U. training when that topic comes up. What it gives you is the model those configuration steps hang on, which also carries over to the SSCA concentration.
Add it to pick 3 for SCOR v2.0, or read it on its own if you are designing a remote-access replacement for a VPN concentrator. Readers who only want exam drills can pass on it. It sold for $40 to $50 when we checked, sold by Amazon. Check the current price on Amazon.
5. CCNP Security Identity Management SISE 300-715 Official Cert Guide
Aaron Woland and Katherine McNamara, both CCIEs, wrote the Cisco Press guide for the ISE concentration exam.
Of the books written for older exam versions, this one has aged best, because SISE itself barely moved. Cisco describes SISE v1.2 as a light refresh and tells candidates already studying for it to carry on as planned. The 1,184 pages cover the same ground the topic list does: ISE architecture and deployment, policy enforcement, web authentication and guest access, profiling, BYOD, endpoint compliance and device administration with TACACS+.
The screens are the dated part. The book shipped in late 2020, and Cisco’s current SISE training covers ISE 3.4 and 3.5, so menus and some workflows in your lab won’t match the figures. The policy logic behind 802.1X, MAB and change of authorization has not changed, and that is what the questions test. If AAA itself is new to you, read our explainer on AAA, RADIUS and TACACS+ first.
Get it if you picked SISE as your concentration or you run ISE at work. For a reference that is not tied to SISE, Cisco Press has Cisco Identity Services Engine (ISE): End-to-End Access Control on preorder for November 30, 2026. It sold for $65 to $75 when we checked, sold by Amazon, with stock running thin. Check the current price on Amazon.
6. CCNP Security Cisco Secure Firewall and Intrusion Prevention System Official Cert Guide
Nazmul Rajib’s Cisco Press guide covers the firewall concentration, which now absorbs VPN configuration on Secure Firewall.
Cisco Press published it in June 2022 for SNCF 300-710, which was then called Securing Networks with Cisco Firepower. The 656 pages follow the topic list through deployment, policy configuration, integrations, management and troubleshooting on Secure Firewall Threat Defense and its management center, with two practice exams online.
Cisco calls the SNCF v1.2 exam a minor update, but it adds Security Cloud Control management, Splunk integration and AI-driven threat intelligence, and Cisco tells candidates to practice on Firepower 10, the current code. None of that is in a 2022 book. Use it for the policy and troubleshooting core, then spend lab time on a current release.
Choose it if SNCF is your concentration. Skip the paperback if the listing price spikes: when we checked, a third-party seller held the buy box at $65 to $75 with thin stock, while the Kindle edition was sold by Amazon for less. Check the current price on Amazon.
Find the Gaps in the SCOR Book
Comparing the second edition’s table of contents with Cisco’s v2.0 topic list shows exactly where the gaps are. Some chapters teach material v2.0 dropped, and some v2.0 topics have no chapter at all:
| Area | 2nd edition (SCOR v1.1) | SCOR v2.0 topic list |
|---|---|---|
| Web and email security | Chapter 10 on Secure Web Appliance, Secure Email and the management appliance | Replaced by domain 4 (SSE, Secure Access, DLP, AI guardrails) and topic 5.7 Email Threat Defense |
| VPN | Chapter 8 configures VPNs on IOS routers, ASA and Secure Firewall | Describe VPN types including DMVPN, FlexVPN and GETVPN (1.6); configure and troubleshoot VPN on Secure Firewall (2.9, 2.10) |
| Programmability | Chapter 3 on SDN and DNA Center APIs | Python scripts that call security APIs (1.10), plus NETCONF, RESTCONF and APIs for secure device management (2.7) |
| AI security | Not covered | AI and LLM vulnerabilities: prompt injection, system prompt leakage, vector and embedding weaknesses (1.3) |
| Cryptography | Chapter 2 on cryptography and PKI | Adds post-quantum cryptography, QUIC and MASQUE (1.5) |
| Telemetry | Chapter 5 on NetFlow and Secure Network Analytics | Splunk ingest, SIEM and SOAR (3.5, 6.6, 6.8) |
| Workloads and identity | Secure Workload in chapter 9, ISE in chapter 4 | Adds eBPF (3.6), CIS benchmarks (2.5) and Cisco Duo zero trust (6.7) |
Pick 4 handles the SSE rows. For the AI security topics, Cisco Press’s 2026 book Securing AI Using Zero Trust Principles covers the subject at book length. At 704 pages it is more than one exam topic needs, so the OWASP Top 10 for LLM applications is the faster read for topic 1.3. Splunk and Duo are product skills, so a trial account and the vendor’s own tutorials will teach you more than a chapter would. Cisco says a SCOR practice exam lands on Cisco U. by the end of 2026, which is the first v2.0 practice test from Cisco itself.
Skip These Retired-Exam Books
Several Cisco security books for retired exams are still sold new, and their titles look current at a glance. We haven’t linked them:
| Book | Published | Why to skip it |
|---|---|---|
| CCNA Security 210-260 Official Cert Guide | 2015 | The certification retired in February 2020 |
| CCNA Cyber Ops SECFND 210-250 and SECOPS 210-255 Official Cert Guides | 2016 to 2017 | Replaced by 200-201 in May 2020 |
| SCOR 350-701 Official Cert Guide, 1st Edition | 2020 | Superseded by the 2nd edition, then by SCOR v2.0 |
| CCNP Security SVPN 300-730 Official Cert Guide | 2021 | Last SVPN test day was August 26, 2026, with no replacement exam |
The SVPN guide is the one to think about twice. SVPN itself is gone, but Cisco kept the SVPN training because people still configure VPNs by hand, so a cheap used copy can still serve as a VPN reference. Just don’t buy it as exam prep. We also passed on a wave of 2026 self-published 200-201 study guides; one runs just over 100 pages, and none has a publisher you can hold to an errata page.
Choose What to Buy First
Most readers who land here need one or two books, not six. This is the order we’d buy them in for each path:
- No Cisco certification yet and a networking job in mind: a CCNA 200-301 study set, and practice the port security and DHCP snooping labs early.
- Headed for a SOC: pick 1 plus its v1.2 supplement, then pick 2 for the lab.
- Going for CCNP Security: pick 3 and pick 4 for SCOR v2.0, then one concentration book (pick 5 or pick 6).
- Comparing vendors first: our Security+ book guide and general cybersecurity book list cover the vendor-neutral side.
For the enterprise routing side of CCNP, the CCNP book guide covers ENCOR and ENARSI. Whatever you buy, check the topic version printed in the book’s introduction against Cisco’s exam page before you start reading, because in 2026 that single line tells you how much of the book still applies.
