300-740
Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT)
300-740 SCAZT Exam Guide: Blueprint, Version Choice, and Study Roadmap
Cisco 300-740, Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT), validates the ability to design and implement secure access for identities, devices, networks, applications, and cloud environments. It serves security professionals pursuing the Cisco Certified Specialist–Security Secure Cloud Access certification or the CCNP Security concentration requirement. This guide helps you decide which blueprint applies to your test date, prioritize study time, and turn the official topics into a workable preparation plan.
What does the 300-740 SCAZT exam validate?
300-740 tests whether you can apply secure-cloud-access principles across architecture, identity, endpoint posture, network controls, applications, data, visibility, and threat response. Cisco positions it as a design-and-implementation exam rather than a narrow product memorization test.
The exam’s central problem is controlled access: the right user, device, workload, or application should receive the right access under the right conditions, with security controls able to detect and respond to misuse. The v2.0 blueprint specifically emphasizes zero-trust frameworks, Cisco Duo identity management, and policy deployment through security service edge (SSE), zero-trust network access (ZTNA), and microsegmentation.
That scope makes the exam relevant to security engineers, cloud-security practitioners, network and access-control specialists, and Cisco professionals building toward CCNP Security. It also suits candidates who need to connect identity, cloud, endpoint, and application decisions instead of treating each control as an isolated technology.
What can passing 300-740 do for your certification path?
Passing 300-740 earns the Cisco Certified Specialist–Security Secure Cloud Access certification and satisfies the concentration-exam requirement for CCNP Security. Cisco also states that passing the exam can be used toward recertification.
Those outcomes matter when you are choosing between an immediate specialist credential and a broader certification plan. Confirm your personal certification requirements on Cisco’s current certification information before scheduling; the exam result alone does not replace any other requirements that may apply to your chosen path.
Which 300-740 version should you prepare for?
Your test date determines the blueprint to use. Cisco’s published schedule states that the last date to test 300-740 SCAZT v1.0 is August 26, 2026, and the first date to test v2.0 is August 27, 2026. Do not combine the v1.0 domain percentages with v2.0 topics as though they describe one blueprint.
If you test on or before August 26, 2026, use the v1.0 exam-topics document as the controlling study outline. If you test on or after August 27, 2026, use the v2.0 blueprint and its expanded topic coverage. Recheck Cisco’s official exam page and exam-topics pages before booking because schedules and delivery information are time-sensitive.
The transition is not a cosmetic revision. The v1.0 material includes Cisco Security Reference Architecture, common identity, converged multicloud policy, SASE integrations, ZTNA, and frameworks or guidance associated with NIST, CISA, DISA, SAFE, and SAFE Key. The v2.0 material adds or explicitly covers areas such as public-cloud requirements for AWS, Azure, and Google Cloud, private cloud, VMware hypervisors, Kubernetes, and eBPF-based runtime tools.
How should a candidate already studying v1.0 handle the change?
First, compare your planned exam date with Cisco’s transition schedule. If your date crosses the changeover, stop using the old blueprint as your sole checklist. Map each completed v1.0 topic to the v2.0 document, then create a separate list for v2.0 additions.
Second, avoid assuming that familiarity with a v1.0 product or framework automatically covers a v2.0 objective. Study the decision each control supports: identity assurance, cloud authorization, workload isolation, data protection, monitoring, or response. This approach is more durable than memorizing product names without understanding where a control belongs.
What are the official exam domains and weights?
The v1.0 blueprint publishes percentages for four domains, while Cisco’s exam page describes a broader six-area coverage summary that also includes visibility and assurance and threat response. Use the percentages only for v1.0 planning; the supplied evidence does not provide v2.0 domain percentages, so do not assign unofficial weights to the newer version.
For v1.0, Cisco allocates 10% to Cloud Security Architecture, 20% to User and Device Security, 20% to Network and Cloud Security, and 25% to Application and Data Security. The supplied v1.0 facts do not identify percentages for the remaining areas in the same list, so those topics still belong in your preparation even though an exact allocation is not stated here.
The practical implication is straightforward: do not spend all your time on the largest published percentage. The architecture domain can frame questions in the other areas, while visibility, assurance, and threat response help you judge whether a proposed design can be monitored and operated safely.
What does each v1.0 domain mean for study planning?
Cloud Security Architecture is the design foundation. Study how reference architectures, common identity, multicloud policy, SASE, ZTNA, and recognized security frameworks influence the placement and interaction of controls. Prepare to explain why a design choice supports a security objective.
User and Device Security requires a clear distinction between authenticating a person and establishing device trust. The v1.0 topics include certificate-based authentication, multifactor authentication, endpoint posture policies, SAML and SSO, OIDC, and SAML-based trust for mobile or web applications. Build comparison notes around identity flow, device conditions, federation, and application access.
Network and Cloud Security covers enforcement paths and traffic controls. Its v1.0 topics include URL filtering, advanced application control, network-protocol blocking, direct internet access for trusted applications, web application firewalls, reverse proxies, SaaS access policies, VPN or application-based remote access, SSE, and Cisco Secure Firewall.
Application and Data Security should be studied as a protection problem that follows data and application exposure. Connect application access, encryption, inspection, policy enforcement, and availability protections to the asset and threat being addressed. Do not treat a web application firewall, a data-loss-prevention control, and an access policy as interchangeable.
Visibility and assurance and threat response deserve their own study notes even where the published v1.0 percentages supplied here do not specify an allocation. For each architecture decision, ask what telemetry proves that the policy is working, what condition would trigger an investigation, and what response action would limit damage.
What changed in the v2.0 topic landscape?
V2.0 broadens the study surface from secure access design into cloud-native platforms, runtime enforcement, modern identity, and security controls for emerging application patterns. The most efficient response is not to read every topic with equal depth; group them by the design decisions they support and verify each group against the official v2.0 PDF.
Public-cloud security requirements cover AWS, Azure, and Google Cloud. The blueprint includes authentication and access control, cloud-native constructs, posture and compliance, and the shared-responsibility model. Prepare to explain which security responsibility belongs to the cloud provider, which belongs to the customer, and how identity or posture affects access.
The blueprint also covers private cloud, VMware hypervisors, and Kubernetes container orchestration. For Kubernetes-related study, connect workload identity, segmentation, policy scope, and runtime visibility rather than learning container terminology in isolation.
Cisco’s v2.0 blueprint names eBPF-based tools such as Cilium and Tetragon for runtime security observability and enforcement. Treat these as part of a runtime-security design conversation: what is observed, where enforcement occurs, and how the control relates to workload behavior.
Other v2.0 areas include Cisco Duo multifactor authentication, encryption in cloud environments, IPS, DLP, malware protection, AI Defense, AI Access, AI Guardrails, and web-application-firewall protection against DDoS attacks. Create a purpose-and-placement card for each item so you can distinguish preventive, detective, and response functions.
How can you organize the v2.0 additions without losing the core?
Use five study buckets: identity and access, cloud and workload platforms, network and application protection, data and threat controls, and visibility or response. Place every official objective into one bucket, then note dependencies between buckets.
For example, a cloud posture decision can influence access policy; an identity signal can influence ZTNA; a Kubernetes runtime event can require a response workflow; and encryption can protect data without proving that the requesting identity is authorized. These relationships are the reasoning layer that turns a topic list into exam preparation.
How should you study the blueprint instead of memorizing a product list?
Read each objective as a task you must perform: design, select, integrate, apply, compare, or troubleshoot. For every task, write the protected asset, the trust signal, the enforcement point, the evidence produced, and the likely failure or attack condition. This method exposes gaps that product-name flashcards hide.
Begin with the official blueprint for your version and turn every bullet into a checklist item. Mark each item as unfamiliar, partly understood, or explainable without notes. Then study the unfamiliar items first, because broad passive reading often creates the illusion of coverage.
Build a control map with columns such as user, device, workload, network, application, data, and operations. Add controls such as MFA, posture policy, ZTNA, segmentation, WAF, DLP, IPS, encryption, malware protection, and logging where the official topics support them. The purpose is not to invent an architecture; it is to practice selecting a control for a stated requirement.
Use short scenario prompts rather than isolated definitions. Ask: a user is authenticated but the endpoint fails posture checks—what should change? A trusted application needs direct internet access—what policy boundaries are required? A workload moves into Kubernetes—what identity, segmentation, and runtime-observability questions follow? Answer in terms of conditions and enforcement, not slogans.
When a topic names a framework, protocol, or control family, compare its role with adjacent concepts. SAML, OIDC, SSO, and MFA can all appear in an identity discussion but answer different questions. A reverse proxy, WAF, SSE control, and VPN can all affect access paths but are not substitutes in every design.
A useful note format for difficult topics
For each item, write four lines: purpose, signal or input, enforcement location, and limitation. For MFA, the purpose is stronger identity assurance; the signal is an additional authentication factor; enforcement occurs in the identity or access flow; and the limitation is that successful authentication alone does not establish every device or workload condition.
Use the same format for cloud posture, microsegmentation, DLP, WAF, and runtime observability. If you cannot name the limitation, your understanding may be too dependent on a definition and not yet ready for scenario-based decision-making.
What is a practical 6-week study roadmap?
A six-week sequence works when you need a repeatable plan rather than an open-ended reading list. Adjust the pace to your background and exam date, but preserve the order: identify the applicable blueprint, establish architecture concepts, study identity and enforcement, cover cloud-native and protection topics, then validate decisions with mixed review.
Week 1: establish scope and baseline. Download the correct official exam-topics document, record the version that applies to your test date, and mark every objective by confidence. Read the Cisco exam page for the certification outcome and current scheduling information. Do not begin with practice questions from an unverified source; first make sure your topic list is authoritative.
Week 2: build the architecture and identity foundation. Study cloud security architecture, zero-trust principles, common identity, federation, MFA, certificate-based authentication, endpoint posture, SAML, SSO, and OIDC as applicable to your version. Draw access flows that show the identity provider, device signal, policy decision, application, and audit trail.
Week 3: work through network, cloud, and access enforcement. Cover ZTNA, SSE, microsegmentation, application control, URL filtering, protocol blocking, trusted-application internet access, remote-access approaches, reverse proxies, WAF, SaaS access policies, and Cisco Secure Firewall where they appear in your blueprint. For v2.0, include the public-cloud and private-cloud requirements rather than relying on v1.0 notes.
Week 4: study applications, data, workloads, and runtime security. Review encryption, DLP, IPS, malware protection, AI Defense, AI Access, AI Guardrails, and DDoS-related WAF protection where listed in v2.0. Add VMware, Kubernetes, and Cilium or Tetragon topics if you are preparing for v2.0. Relate each control to a threat, asset, and enforcement point.
Week 5: connect visibility, assurance, and response to the design. For every major control, identify the telemetry it should generate, the condition that would indicate policy failure or attack, and the action that should follow. Then complete mixed scenario reviews in which the answer depends on more than one domain.
Week 6: close gaps and rehearse decisions. Revisit only the objectives still marked uncertain, redraw the control map from memory, and explain competing designs aloud or in writing. Review the official blueprint again so that your final study days are driven by documented objectives rather than a third-party topic list. Schedule only when your preparation and the applicable version are aligned.
How should the roadmap change for an experienced security professional?
Reduce time spent defining familiar fundamentals, but do not skip blueprint verification. Experienced candidates often lose points through assumption: they know what a control generally does but overlook the specific cloud, identity, application, or runtime context in which the objective places it.
Spend more time on Cisco-specific architecture relationships and on v2.0 additions that are outside your daily environment. A network specialist may need extra work on identity federation or Kubernetes runtime controls; an identity specialist may need extra work on cloud-native constructs, segmentation, and traffic enforcement.
What practical lab or review activities are worth doing?
The best activities force you to make and defend a security decision. Use diagrams, configuration reasoning, and documented scenarios to connect an access request with identity signals, device posture, policy evaluation, enforcement, logging, and response. A lab is useful when it tests that chain, not merely when it produces a successful login.
Create a reference scenario involving a user, managed endpoint, SaaS application, public-cloud workload, and private-cloud or containerized service. For each access request, specify the identity method, device requirement, network path, application control, data safeguard, and evidence that an operator would review.
For v1.0, use the published network and cloud topics to vary the path: direct internet access for a trusted application, a reverse-proxy route, a SaaS access policy, application-based remote access, or a Cisco Secure Firewall decision. Explain why the selected path fits the requirement and what risk remains.
For v2.0, add AWS, Azure, and Google Cloud as comparison contexts without assuming that one provider’s construct maps perfectly to another’s. Examine authentication and access control, cloud-native constructs, posture and compliance, and shared responsibility. Then add a Kubernetes workload and ask where runtime observation or enforcement belongs.
Keep an error log with three fields: mistaken assumption, correct design principle, and blueprint objective. Review the log at the end of each study session. This is more valuable than repeatedly rereading material you already recognize.
How can you use practice questions responsibly?
Use practice questions to test reasoning, not to predict or reproduce live exam content. A good review question should lead you back to an official objective and explain why one design satisfies the stated requirement better than the alternatives.
Avoid exam dumps and leaked-question collections. Memorizing unauthorized material does not establish the skills Cisco is testing and cannot guarantee a passing result. If an explanation cannot be tied to the official blueprint or credible Cisco documentation, treat it as a lead for further verification rather than as an authority.
What are the evidenced delivery details?
Cisco’s v2.0 exam-topic information lists a 90-minute exam, English delivery, a US$300 price, pass/fail results typically available online within 48 hours, and performance-based, multiple-choice, and drag-and-drop question formats. Cisco’s exam page also lists 300-740 at US$300 or Cisco Learning Credits and English as the available language.
These details are useful for scheduling, but confirm them on Cisco’s current exam page before payment. The supplied evidence does not establish every possible delivery arrangement or testing-site condition, so this guide does not assume a particular test center, online-proctoring setup, appointment process, or identification procedure.
What should you confirm before booking?
Confirm the applicable blueprint version, the current price or Learning Credits eligibility, the available language, and the delivery options shown by Cisco for your location. Check the published transition schedule if your intended date is near the v1.0-to-v2.0 changeover.
Plan around the stated 90-minute exam duration by practicing concise evaluation of scenarios. Do not turn that into an unofficial question-count or pacing formula; the supplied evidence does not state a question count, and different item formats can require different reading and decision time.
If the result timing matters to an employment or certification deadline, treat the stated typical online availability within 48 hours as a planning reference rather than a guaranteed personal result time.
How should you manage time and uncertainty during the exam?
Read the requirement before focusing on the technology names. Identify the asset, requester, trust condition, desired access, and security outcome. Then eliminate answers that solve a neighboring problem but fail the stated condition.
For multiple-choice items, compare the complete design rather than selecting the familiar product. For drag-and-drop or performance-based items, first establish the policy flow and then place or configure the elements that enforce it. If an item is uncertain, record the competing principles in your head, make the best supported choice, and preserve time for later review if the interface permits it.
Watch for hidden scope changes. A question may shift from user authentication to endpoint posture, from network access to application authorization, or from prevention to visibility and response. The correct control depends on that scope. Avoid adding requirements that the scenario does not state, but do not ignore a condition that changes the trust decision.
Use your final review to check for category errors: authentication mistaken for authorization, network reachability mistaken for application access, encryption mistaken for data-loss prevention, or monitoring mistaken for enforcement. These distinctions are more useful than trying to recall a bare product definition under pressure.
Which preparation mistakes create avoidable risk?
The most damaging mistakes are usually planning errors: studying the wrong version, treating the blueprint as a vocabulary list, ignoring lower-profile domains, and relying on unsupported practice material. Correct these before increasing study hours.
Using v1.0 percentages to plan v2.0 preparation is a version error. The published v1.0 allocation gives 10% to Cloud Security Architecture, 20% to User and Device Security, 20% to Network and Cloud Security, and 25% to Application and Data Security; the supplied evidence does not provide equivalent v2.0 percentages. Keep the two planning models separate.
Studying only familiar network controls creates a coverage gap. 300-740 also involves identity, devices, applications, data, visibility, assurance, and threat response, while v2.0 adds cloud-provider, private-cloud, container, and runtime-security topics.
Memorizing acronyms without drawing an access flow produces weak scenario performance. Explain where a decision is made, what signal informs it, and how the result is enforced. If you cannot place the control in a flow, return to architecture rather than collecting more flashcards.
Treating all cloud providers as identical is another risk for v2.0. Study the shared-responsibility model and the listed AWS, Azure, and Google Cloud requirements as related but distinct contexts. Avoid inventing feature equivalences that the official blueprint does not state.
Finally, do not let unofficial question banks define the syllabus. The official Cisco blueprint should control your checklist, and any external explanation should be checked against it. Unauthorized dumps are not a substitute for understanding and do not guarantee a pass.
What should you do next?
Start with the date, not the study material: determine whether your appointment falls under v1.0 or v2.0, then download that version’s official topics. Build a confidence checklist, map the objectives into architecture and control categories, and schedule your first review session around the weakest foundational area.
If you are preparing for v1.0, preserve the published domain labels when allocating study time and include the framework, identity, SASE, ZTNA, network, application, data, visibility, and response material. If you are preparing for v2.0, give explicit space to public-cloud, private-cloud, VMware, Kubernetes, eBPF runtime-security, Duo, AI-security, encryption, IPS, DLP, malware, and WAF-related objectives listed in the blueprint.
Before booking, verify Cisco’s current price, language, delivery information, result guidance, and version schedule. Before sitting the exam, make sure you can explain a complete secure-access design from identity signal through enforcement, telemetry, and response. That final capability is the practical measure behind the topic list.
Conclusion
300-740 preparation is a version-management and design-reasoning exercise. Use the official blueprint that matches your test date, keep v1.0 percentages separate from v2.0 coverage, and study each control in relation to identity, device posture, cloud or workload context, enforcement, visibility, and response. Confirm current scheduling details with Cisco, then use your checklist and error log to decide when your preparation is ready for booking.
Related exams
- Securing Networks with Cisco Firepower (300-710 SNCF)
- Implementing and Configuring Cisco Identity Services Engine (SISE) v4.0 (300-715 SISE)
- Securing Email with Cisco Email Security Appliance (300-720 SESA)
- Securing the Web with Cisco Web Security Appliance (300-725 SWSA)
- 300-730 exam — Implementing Secure Solutions with Virtual Private Networks (SVPN)
- Automating and Programming Cisco Security Solutions (300-735 SAUTO)