Cloud security is no longer a separate discipline that network engineers can safely leave to another team. Applications have moved to SaaS platforms, users connect from almost anywhere, workloads are distributed across multiple clouds, and identity has become just as important as the IP address or network segment. Cisco’s 300-740 SCAZT exam sits directly in the middle of this transition.
Officially named Designing and Implementing Secure Cloud Access for Users and Endpoints, the Cisco 300-740 SCAZT exam focuses on securing users, devices, applications, workloads, and cloud access. It is particularly relevant to network engineers who want to move beyond traditional perimeter security and understand technologies such as Zero Trust, Security Service Edge (SSE), Zero Trust Network Access (ZTNA), Cisco Duo, Cisco Secure Access, microsegmentation, cloud security policy, and security telemetry.
There is also an important reason to pay attention to SCAZT in 2026. Cisco is introducing SCAZT v2.0 on August 27, 2026, significantly modernizing the blueprint. The new version places much more emphasis on operational cloud security, identity, SSE, ZTNA, cloud-native environments, Cisco Secure Access, XDR, Splunk, and even security controls for AI-enabled applications.
This guide explains what the 300-740 exam is, what technologies you should understand, how it fits into CCNP Security, what is changing in SCAZT v2.0, and how I would approach the exam if I were studying for it today.
What Is Cisco 300-740 SCAZT?
The Cisco 300-740 SCAZT exam is a professional-level Cisco security concentration exam focused on secure access to cloud applications, private applications, workloads, and data. Candidates preparing for the certification may also want to review a dedicated 300-740 SCAZT study resource alongside Cisco’s official exam blueprint.
Passing the exam earns the Cisco Certified Specialist – Secure Cloud Access certification. It also satisfies the concentration exam requirement for CCNP Security.
That second point is important. Passing 300-740 by itself does not give you the complete CCNP Security certification. To earn CCNP Security, candidates must also satisfy Cisco’s core exam requirement. SCAZT represents the specialization side of that path.
Conceptually, SCAZT answers a question that modern network teams deal with every day:
How do we give the right user, using the right device, secure access to the right application while continuously evaluating identity, device posture, network conditions, application policy, and security telemetry?
That is a much broader problem than configuring an ACL or terminating a VPN tunnel. It crosses networking, identity, endpoint security, cloud security, application security, and security operations. This is one of the reasons SCAZT is an interesting certification for engineers who want to develop beyond traditional routing, switching, and firewall administration.
Cisco 300-740 SCAZT Exam Facts
| Item | Details |
|---|---|
| Exam Code | 300-740 |
| Exam Name | Designing and Implementing Secure Cloud Access for Users and Endpoints |
| Short Name | SCAZT |
| Exam Duration | 90 minutes |
| Language | English |
| Exam Price | US$300, or Cisco Learning Credits where applicable |
| Specialist Certification | Cisco Certified Specialist – Secure Cloud Access |
| CCNP Path | Counts as a concentration exam toward CCNP Security |
| Major Technology Areas | Cloud security, Zero Trust, identity, SSE, ZTNA, Secure Access, Duo, application security, workload security, and security operations |
Candidates should always verify the latest exam price and blueprint on Cisco’s official certification website before scheduling, because Cisco can update certification policies and exam topics over time.
How Valuable Is the SCAZT Certification?
The value of a certification should not be measured only by the badge. What matters more is whether the skills behind the certification match problems that organizations actually need engineers to solve. SCAZT performs reasonably well by that standard.
1. It Connects Traditional Networking with Modern Cloud Security
Many network engineers understand routing, switching, NAT, firewalls, and VPNs very well. The problem is that modern access architecture increasingly extends outside the enterprise network.
A user might be working from home, authenticating through a cloud identity provider, connecting through a security service edge, accessing a SaaS application, and generating telemetry that is analyzed by a SOC platform. There may never be a traditional enterprise perimeter in that traffic path.
SCAZT forces a network engineer to think about the entire access architecture instead of only the packet’s journey through a router or firewall.
2. It Provides a Clear Cloud Security Specialization
Passing 300-740 earns a standalone Cisco Specialist certification. This can be useful for engineers who want to demonstrate a specific security specialization without treating every certification as an all-or-nothing path toward a larger credential.
For engineers already pursuing CCNP Security, SCAZT can also serve as the concentration exam that demonstrates deeper expertise in secure cloud access.
3. The Technologies Are Increasingly Relevant
The SCAZT blueprint covers technologies and architectural ideas that appear repeatedly in modern enterprise security designs:
- Zero Trust
- Zero Trust Network Access (ZTNA)
- Security Service Edge (SSE)
- Secure Access Service Edge (SASE) concepts
- Multifactor authentication
- Identity and device trust
- DNS security
- Secure Web Gateway
- Cloud Access Security Broker (CASB)
- Data Loss Prevention (DLP)
- Microsegmentation
- Cloud workload protection
- Security telemetry
- Extended Detection and Response (XDR)
Even if you eventually work with security products from vendors other than Cisco, understanding these concepts is still useful because many of them are architectural rather than vendor-specific.
4. It Is Particularly Useful for Network Engineers Moving into Security
SCAZT is a logical bridge for someone who already understands networking but wants to develop a cloud-security mindset.
Typical candidates may include:
- Network engineers
- Network security engineers
- Security engineers
- Cloud security engineers
- Network architects
- Security architects
- Presales or solutions engineers
- CCNP Security candidates
SCAZT v1.0 vs. SCAZT v2.0: The Important 2026 Change
Anyone studying for Cisco 300-740 in 2026 needs to pay close attention to the version of the blueprint. Cisco announced that SCAZT v2.0 goes live on August 27, 2026.
This is not a small terminology update. The structure of the exam changes substantially.
SCAZT v1.0 Blueprint
| Domain | Weight |
|---|---|
| Cloud Security Architecture | 10% |
| User and Device Security | 20% |
| Network and Cloud Security | 20% |
| Application and Data Security | 25% |
| Visibility and Assurance | 15% |
| Threat Response | 10% |
SCAZT v2.0 Blueprint
| Domain | Weight |
|---|---|
| Concepts | 10% |
| Identity | 20% |
| Policies | 30% |
| Access | 30% |
| Operations | 10% |
The change tells us something important about Cisco’s direction. The v2.0 blueprint concentrates 60% of the exam in Policies and Access, meaning identity-driven access control becomes the core focus.
It also introduces modern topics such as Zero Trust frameworks, cloud-native security, Kubernetes, eBPF, AI security, Cisco Secure Access, XDR, Splunk integration, and more.
Understanding the Cisco SCAZT v2.0 Exam Domains
Domain 1: Concepts – 10%
The Concepts domain provides the architectural foundation for everything else in the exam. Candidates must understand Zero Trust, cloud models, shared responsibility, and modern security frameworks such as NIST SP 800-207 and CISA Zero Trust maturity models.
It also introduces cloud-native topics like Kubernetes and eBPF-based observability.
Domain 2: Identity – 20%
Identity is a core control plane in modern security. Candidates must understand MFA, Cisco Duo, SAML, SSO, SCIM, certificates, and endpoint posture evaluation.
Domain 3: Policies – 30%
This domain focuses on enforcement: encryption, IPS, DLP, CASB, WAF, malware protection, and AI security controls such as Cisco AI Defense.
Microsegmentation and workload security are also key topics.
Domain 4: Access – 30%
This is the practical core of SCAZT: DNS security, SWG, CASB, ZTNA, Secure Access, VPN-as-a-Service, private access, and digital experience monitoring.
Domain 5: Operations – 10%
Focuses on telemetry, dashboards, XDR, Splunk integration, and incident analysis across Cisco Secure Access environments.
Important Technologies Behind SCAZT
ZTNA, SSE, SASE, Cisco Duo, CASB, SWG, DNS security, DLP, microsegmentation, Kubernetes security, and cloud-native observability all form the foundation of the exam.
The key is understanding how these technologies work together in a full access lifecycle: identity → policy → access → telemetry → response.
What Should You Know Before Studying?
Strong CCNA-level networking knowledge is recommended, including IP addressing, routing, DNS, VPNs, and basic security concepts. Familiarity with cloud platforms like AWS, Azure, or GCP is also helpful.
8-Week Study Plan
Weeks 1–2: Zero Trust, cloud architecture, SASE/SSE
Weeks 3: Identity (Duo, SAML, MFA, SCIM)
Weeks 4: SSE services (SWG, CASB, DLP, DNS security)
Weeks 5: ZTNA and Secure Access
Weeks 6: Workload security and microsegmentation
Weeks 7: Operations, XDR, Splunk, telemetry
Weeks 8: Review and weak-area focus
Hands-On Practice
Focus on identity-based policies, ZTNA flows, CASB behavior, DNS filtering, and telemetry analysis. Even without full lab access, diagramming traffic flows is highly effective.
Exam Strategy
Focus on understanding workflows rather than memorizing features. Always think in terms of cause and effect across identity, policy, and access layers.
Is SCAZT Worth It?
Yes, especially for CCNP Security candidates or engineers transitioning into cloud security roles. It is less suitable as a first certification but highly valuable as a specialization.
FAQ
What is SCAZT? Cisco 300-740 Secure Cloud Access exam.
Does it count for CCNP Security? Yes, as a concentration exam.
Is it difficult? Yes, it is professional-level.
Does it cover Zero Trust? Yes, extensively.
Final Thoughts
SCAZT reflects the shift from perimeter-based security to identity-driven cloud access. Understanding identity, policy, and telemetry is more important than memorizing individual tools.
Once you understand the full access lifecycle, the exam becomes much more logical and practical.
Editorial Note: Always verify the latest Cisco exam blueprint and updates before taking the exam.
Official References and Further Reading
For candidates preparing for the Cisco 300-740 SCAZT exam, the following official Cisco and industry resources provide authoritative information about secure cloud access, Zero Trust architecture, identity security, Security Service Edge (SSE), Zero Trust Network Access (ZTNA), cloud security, visibility, and threat response.
- Cisco 300-740 SCAZT – Official Exam Page
– Cisco’s official page for the Designing and Implementing Secure Cloud Access for Users and Endpoints exam, including exam details, certification requirements, and preparation resources. - Cisco Secure Access – Security Service Edge (SSE)
– Cisco’s official resource for Secure Access, covering cloud-delivered security, Zero Trust Network Access, secure internet access, SaaS protection, and modern Security Service Edge architctures. - Cisco Duo Documentation
– Official technical documentation for Cisco Duo, including multi-factor authentication, identity verification, device trust, single sign-on, and Zero Trust access controls. - NIST SP 800-207 – Zero Trust Architecture
– An authoritative National Institute of Standards and Technology publication describing Zero Trust Architecture principles, logical components, deployment models, access policies, and security considerations. - MITRE ATT&CK Framework
– A widely used cybersecurity knowledge base for understanding attacker tactics, techniques, and procedures across enterprise, cloud, identity, and other environments.
