Designing and Implementing Secure Cloud Access… (300-740)

Vendor source — Designing and Implementing Secure Cloud Access for Users and Endpoints ↗ 300-740 SCAZT · ● Active · Professional · Cisco

Exam facts

Exam Code: 300-740
Official Name: Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT)
Duration: 90 minutes
Cost: $300 USD
Format: Multiple choice, simulation, drag-and-drop questions
Passing Score: ~70% (exact score not publicly disclosed)
Certification Type: CCNP Security Concentration exam
Version Current: v1.0 (v2.0 launches August 27, 2026)
Associated Certifications:
- Cisco Certified Specialist – Security Secure Cloud Access
- CCNP Security (concentration exam requirement)

About

The 300-740 SCAZT exam certifies a candidate's knowledge of designing and implementing cloud security architectures that protect users, devices, and endpoints. The exam emphasizes Zero Trust Network Access (ZTNA), Security Service Edge (SSE), identity-based access control, and cloud-delivered security services. This concentration exam is part of the CCNP Security certification track and requires no formal prerequisites, making it accessible to IT professionals at various experience levels.

The exam represents a strategic shift from theoretical security knowledge to practical implementation of Zero Trust frameworks and cloud security services, particularly using Cisco solutions like Secure Access Service Edge (SASE), Duo for MFA, and cloud-based firewall capabilities.

Domain context

Cloud Security & Zero Trust Architecture

The 300-740 SCAZT exam is positioned at the intersection of cloud adoption, remote work expansion, and Zero Trust security paradigms. Organizations are moving away from perimeter-based security to identity-centric, device-aware security models. This exam validates the ability to:

Design and implement cloud-native security architectures
Apply Zero Trust principles to user and device access
Integrate identity, device posture, and application security
Implement SASE (Secure Access Service Edge) components
Enable secure cloud application access
Provide visibility and threat response in distributed environments

The exam aligns with industry frameworks including NIST Cybersecurity Framework, CISA guidelines, and MITRE ATT&CK threat intelligence.

Topics covered

1.0 Cloud Security Architecture (10%)

Components of the Cisco Security Reference Architecture (threat intelligence, security operations, user/device security, network security, workload/application/data security)
Use cases and capabilities within integrated architectures (common identity, converged multicloud policy, SASE integrations, zero-trust network access)
Industry security frameworks (NIST, CISA, DISA)

2.0 User and Device Security (20%)

User and device authentication via identity certificates
Multifactor authentication (MFA) for users and devices via Cisco Duo
Endpoint posture policies (device compliance, security posture assessment)
Device onboarding and identity-based access control

3.0 Network and Cloud Security (20%)

Security policies for endpoints accessing SaaS applications (Office 365, Workday, Salesforce)
VPN and application-based remote access policies
Security services edge (SSE) enforcement
Cisco Secure Firewall policy and application filtering
Zero Trust Network Access (ZTNA) implementation

4.0 Application and Data Security (25%)

MITRE ATT&CK framework and attacker defense mitigation techniques
Cloud security attack tactics and mitigation strategies
Web application firewall (WAF) and DDoS attack protection
Cisco Secure Workload for lateral movement prevention
Microsegmentation and workload isolation
Application policy enforcement and anomaly detection

5.0 Visibility and Assurance (15%)

Cisco XDR (Extended Detection & Response) solution
Visibility and assurance automation use cases
SIEM, OpenTelemetry, and Cisco Secure Network Analytics
Traffic flow validation and telemetry reporting
Baseline and compliance behavior analysis
Troubleshooting user application and workload access
Application dependency mapping

6.0 Threat Response (10%)

Response automation use cases
Actions based on telemetry reports
Policy determination based on security audit reports
Response to user or application compromise (containment, reporting)

Common job-ready skills

Upon passing the 300-740 SCAZT exam, professionals are ready to:

Design Zero Trust architectures for cloud-connected organizations
Implement SASE components (ZTNA, SSE, Firewall, DLP, Web Gateway)
Configure identity and device security using Cisco Duo MFA and device posture
Deploy secure access policies for SaaS application protection
Manage endpoint security using Cisco Secure Client and endpoint detection
Implement microsegmentation using Cisco Secure Workload
Monitor and respond to cloud security threats using XDR and SIEM
Validate compliance and enforce security policies across multicloud environments
Troubleshoot cloud access issues using visibility and analytics tools
Apply MITRE ATT&CK framework to threat modeling and mitigation

Recommended courses

Official Cisco Training

Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT) - Official Cisco course available through:
- Cisco Learning Network (self-paced guided learning paths)
- Authorized Cisco Learning Partners (classroom and online instructor-led)
- Global Knowledge, Academy (Westcon Comstor), Network Binary, and other partners

Third-Party Training Options

CBT Nuggets - CCNP Security video training modules
Coursera/Udemy - Cloud security and Zero Trust courses
A Cloud Guru/Linux Academy - Cloud security fundamentals
Pluralsight - Security architecture and Cisco solutions pathways

Prerequisites/Recommended Prior Knowledge

Enterprise routing and switching fundamentals
Network security basics
Understanding of firewall concepts
Cloud computing fundamentals (IaaS, PaaS, SaaS)
Basic knowledge of PKI and certificates

Practice exams

Official & Authorized Resources

Cisco Learning Network - Official practice questions and exam simulator
NWExam.com - Comprehensive practice questions, sample tests, and exam syllabus
Global Knowledge - Practice exams and study materials
Cisco Pearson VUE Testing - Official exam registration with exam readiness tools

Third-Party Practice Resources

Spoto - CCNP dumps and practice tests
CiscoFreeDumps - Free practice questions and exam guides
PassQuestion - CCNP Security practice questions
Quizlet - Community-created flashcards and study sets
Marks4sure - Practice exam materials with demo versions

Books

Primary Study Resources

"Cisco 300-740 SCAZT Designing and Implementing Secure Cloud Access for Users and Endpoints Study Guide" by Anand Vemula
- Available on Amazon Kindle, Barnes & Noble, and e-book retailers
- Comprehensive coverage of all exam domains
- Practical examples and implementation guidance

Related Reference Books

"Cisco Secure Access Service Edge (SASE) Design Guide" - Cisco Design Zone
"Zero Trust Architecture User and Device Security Design Guide" - Cisco Design Zone
"Cisco Zero Trust Architecture Guide" - Cisco Solutions Architecture
"Enterprise Network Security Design" - Cisco Press series
Official Cisco CCNP Security Learning Path documentation

Job titles

Professionals holding the 300-740 SCAZT certification typically pursue roles such as:

Cloud Security Engineer
Network Security Engineer
Network Security Architect
Security Operations Analyst (SOC Analyst)
Senior Network Engineer
Cisco Security Specialist
Zero Trust Architect
SASE Implementation Engineer
Cloud Access Security Engineer
Security Infrastructure Engineer
IT Security Manager
Network Security Specialist
Senior Security Operations Engineer

Salary (USD / ZAR×18 / GBP / EUR / AUD)

CCNP Security Salaries (General)

United States: $92,000–$120,000+ USD annually (average)
Network Security Specialist (CCNP-track role): $161,000–$228,000 USD annually
Cleared/Government positions: $152,773–$205,000+ USD annually (higher due to security clearance premium)

Regional Conversions (as of May 2026)

USD $110,000:
- ZAR ≈ 1,980,000 (×18 multiplier)
- GBP ≈ 87,000
- EUR ≈ 100,000
- AUD ≈ 165,000

Experience-Based Variance

Entry-level Cloud Security Engineer: $80,000–$100,000 USD
Mid-level (3–5 years): $110,000–$150,000 USD
Senior/Architect (5+ years): $140,000–$200,000+ USD

Skills validated

The 300-740 SCAZT exam validates mastery of:

Zero Trust Architecture Design & Implementation
- Zero Trust principles and frameworks
- Identity-centric security models
- Device posture assessment
- Conditional access policies
Cisco SASE Implementation
- Secure Access Service Edge architecture
- ZTNA (Zero Trust Network Access) deployment
- SSE (Security Service Edge) configuration
- Cloud firewall policies
Identity & Access Management
- Cisco Duo MFA implementation
- Multi-factor authentication policies
- Identity certificates and PKI
- Device identity and trust
Cloud Application Security
- SaaS application access policies (Office 365, Workday, Salesforce)
- Cloud Access Security Broker (CASB) functions
- Web application firewall (WAF) deployment
- API security and DLP
Threat Detection & Response
- MITRE ATT&CK framework application
- XDR (Extended Detection & Response) deployment
- SIEM integration and log analysis
- Incident response automation
- Threat telemetry analysis
Cisco Secure Workload
- Microsegmentation design
- Lateral movement prevention
- Workload-to-workload policy enforcement
- Container and VM security
Visibility & Monitoring
- Network analytics and telemetry
- OpenTelemetry implementation
- Traffic flow validation
- Compliance monitoring and reporting
- Application dependency mapping
Cloud Network Security
- SD-WAN integration with security
- Encrypted DNS (Umbrella, Cisco DNS Layer Security)
- Network segmentation
- Bandwidth and application control

Related certs

Certification Path

Prerequisite/Related: CCNP Security core exams (or CCNA Security)
Part of: CCNP Security certification track
Concentration: One of several concentration options for CCNP Security

Related Cisco Certifications

CCNP Security (core certification; 300-740 is one concentration option)
Cisco Certified Specialist – Security Secure Cloud Access (earnable upon passing 300-740)
Cisco Certified Specialist – Security Cloud Identity and Access Management
CCNA Security (foundational)
CCNP Enterprise (complementary networking focus)
Cisco Certified Specialist – Security Firewall (related domain)

Complementary Vendor Certifications

CompTIA Security+ (foundational security)
AWS Certified Security – Specialty
Azure Security Engineer Associate
Google Cloud Professional Cloud Security Engineer
Palo Alto Networks Certified Associate (PCPA)
(ISC)² CISSP (advanced security management)

Sources

Official Cisco Resources

Study & Preparation Resources

Career & Salary Information

Exam Details & Updates

Note: v2.0 of the exam launches August 27, 2026, with significant updates including MITRE ATT&CK, MFA, endpoint posture, AI defense, SSE/SD-WAN, and cloud visibility tools. Current v1.0 retires August 26, 2026.