Cisco 300-220 CBRTHD Exam Guide: Topics, Certification Value, Technologies, and Study Plan

If you already understand basic networking and security operations and want to move beyond alert monitoring into proactive threat detection, the Cisco 300-220 CBRTHD exam is one of the more interesting specialist exams in Cisco’s cybersecurity portfolio.

CBRTHD stands for Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity. Unlike certifications that concentrate mainly on configuring firewalls, routing policies, or access controls, 300-220 asks a different question: What do you do when an attacker is already operating in an environment but your normal security controls have not raised a useful alert?

That is the central idea behind threat hunting. Instead of waiting for a security product to tell you that something is wrong, a threat hunter develops hypotheses, analyzes telemetry, correlates evidence, identifies suspicious behavior, and improves future detection.

For students and junior network engineers, this makes CBRTHD especially useful as a bridge between traditional networking knowledge and modern Security Operations Center (SOC) work. At the same time, it is important to understand that this is not really an entry-level cybersecurity exam. It rewards candidates who can connect networking, endpoint analysis, threat intelligence, scripting, and security operations into one investigative workflow.

What Is the Cisco 300-220 CBRTHD Exam?

The current 300-220 CBRTHD v1.0 exam validates knowledge related to threat hunting and defense, including threat modeling, threat actor attribution, hunting techniques, hunting processes, and the outcomes of a threat hunting investigation.

Exam Detail	Current Information
Exam Code	300-220 CBRTHD
Full Name	Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity
Version	v1.0
Duration	90 minutes
Language	English
Exam Price	US$300
Specialist Credential	Cisco Certified Specialist – Threat Hunting and Defending
Professional Certification Path	Concentration exam for CCNP Cybersecurity
Published Passing Score	Cisco does not publish a fixed passing score

One detail that can confuse people researching this exam is Cisco’s certification naming. Older training materials and forum posts may refer to the CyberOps Professional track. Cisco has since updated its cybersecurity certification naming, and current Cisco pages position 300-220 within the CCNP Cybersecurity path. The exam code remains 300-220 CBRTHD.

Candidates who want to explore additional information about the exam can also review this 300-220 CBRTHD exam resource while building their study plan.

What Certification Do You Get After Passing 300-220?

Passing Cisco 300-220 CBRTHD by itself earns the Cisco Certified Specialist – Threat Hunting and Defending credential.

That distinction matters. You do not receive the full CCNP Cybersecurity certification simply by passing 300-220.

To earn CCNP Cybersecurity, Cisco requires a professional-level core exam plus a concentration exam. The core exam is currently:

• 350-201 CBRCOR – Performing Cybersecurity Using Cisco Security Technologies

You then select a concentration exam, with 300-220 CBRTHD being the threat-hunting-focused option.

In practical terms, there are two sensible ways to approach the exam. You can take CBRTHD as a standalone specialist certification if threat hunting is the skill you want to demonstrate, or combine it with CBRCOR as part of a broader CCNP Cybersecurity plan.

Is Cisco CBRTHD Worth It?

The value of any certification depends on what you expect it to do. CBRTHD is valuable, but not because three hundred dollars and a passing score instantly turn someone into a threat hunter.

Its real value is that the blueprint forces you to study several disciplines that security analysts use together in real investigations.

You need to understand how attackers behave rather than simply memorize malware names. You need to interpret logs, network sessions, endpoint artifacts, threat intelligence, and command-and-control activity. You also need to understand how findings should lead to better detections, mitigations, runbooks, and security controls.

This makes the certification particularly relevant to roles such as:

• SOC Tier 2 analyst
• Threat hunting analyst
• Cyber threat analyst
• Network security engineer
• Detection engineer
• Security operations analyst
• Incident response professional

For a network engineer, the exam can also be a useful way to move toward cybersecurity without abandoning networking fundamentals. Packet behavior, protocols, sessions, DNS activity, network telemetry, and unusual C2 communication all make much more sense when you already understand how networks are supposed to behave.

There is also a limitation worth mentioning: CBRTHD is specialized. If you are completely new to networking and cybersecurity, a broader certification will usually give you a better foundation first. A student who cannot yet explain TCP sessions, DNS resolution, basic routing, Windows processes, logs, or common security controls will probably spend more time filling foundational gaps than learning threat hunting itself.

Cisco 300-220 CBRTHD Exam Topics and Weighting

The official 300-220 CBRTHD exam blueprint is divided into six domains.

Domain	Weight
1.0 Threat Hunting Fundamentals	20%
2.0 Threat Modeling Techniques	10%
3.0 Threat Actor Attribution Techniques	20%
4.0 Threat Hunting Techniques	20%
5.0 Threat Hunting Processes	20%
6.0 Threat Hunting Outcomes	10%

The percentages tell an important story. This is not an exam where one technology dominates. Four different domains each represent 20 percent of the blueprint. A candidate who is excellent with SIEM queries but weak in threat modeling, attribution, or investigation methodology can still have serious gaps.

1. Threat Hunting Fundamentals – 20%

This section establishes the vocabulary and reasoning model that the rest of the exam depends on.

You should understand the Threat Hunting Maturity Model and how an organization’s data collection, tools, processes, and hunting capabilities affect the kinds of hunts it can perform.

The Pyramid of Pain is another important concept. At a high level, the model helps defenders think about which indicators are easy for an attacker to change and which defensive discoveries create more operational pain for the adversary.

A simple file hash can be useful, but an attacker may replace the file and immediately invalidate that indicator. Detecting a repeatable technique or behavioral pattern is often harder for the attacker to evade because changing behavior can require changing the attack workflow itself.

You should also be comfortable with threat-modeling frameworks and methodologies including:

• MITRE ATT&CK
• MITRE CAPEC
• TaHiTI
• PASTA
• Cyber Kill Chain concepts

Do not study these frameworks as disconnected vocabulary lists. Learn what problem each framework is trying to solve and when one model may be more useful than another.

The fundamentals domain also touches on artificial intelligence and machine learning in SOC operations. The important lesson is not that AI magically solves detection. Automation can process large volumes of data and identify patterns quickly, but analysts still need to understand context, false positives, data quality, and the limitations of the underlying detection logic.

2. Threat Modeling Techniques – 10%

Threat modeling gives a hunt structure.

A common mistake among beginners is to start with a tool: open the SIEM, search a few IP addresses, look at some graphs, and hope something suspicious appears.

A mature threat hunt starts with a reason for looking.

For example, imagine threat intelligence suggests that an adversary targeting your industry frequently abuses PowerShell after gaining initial access. Instead of searching randomly, you can build a hypothesis around abnormal PowerShell execution, map it to relevant MITRE ATT&CK techniques, identify the telemetry required to test the hypothesis, and then investigate exceptions.

For CBRTHD, you should understand structured versus unstructured hunting, attack prioritization, MITRE ATT&CK mapping, CAPEC, Cyber Kill Chain concepts, and the lifecycle of threat intelligence data.

3. Threat Actor Attribution Techniques – 20%

Attribution does not simply mean naming a hacking group.

In an operational investigation, attribution often means understanding the characteristics of the activity well enough to determine what type of actor or campaign you may be dealing with.

The exam expects you to work with tactics, techniques, and procedures (TTPs), timelines, payloads, logs, and other artifacts.

You should be able to distinguish meaningful behavioral evidence from weak indicators. You should also understand that multiple attackers can use the same tools. Finding PowerShell, Mimikatz, a particular user-agent string, or a public penetration-testing framework does not automatically prove that a specific threat actor is responsible.

Context matters.

A useful exercise is to take a sample incident and ask:

• What was the likely initial access method?
• What actions followed initial access?
• Which techniques map to MITRE ATT&CK?
• What evidence is unique and what evidence is common?
• Does the timeline resemble a penetration test or unauthorized activity?
• Which artifacts would still be useful if the attacker changed IP addresses or file hashes?

That style of reasoning is much closer to real threat hunting than memorizing threat group names.

4. Threat Hunting Techniques – 20%

This is one of the most technical parts of the Cisco 300-220 CBRTHD exam.

The official blueprint includes both Python and PowerShell. You do not need to become a full-time software developer, but you should understand why scripting is useful for analysts: parsing logs, normalizing data, extracting indicators, automating repetitive checks, enriching events, and performing basic analytics.

The domain also covers:

• Cloud-native threat hunting
• SIEM data analysis
• Endpoint artifacts
• Command-and-control communications
• Session and protocol analysis
• Traffic-based identification of infection stages
• Code-level analysis
• IoT analysis concepts
• Memory-resident attacks
• Detection signatures
• Attack-vector assessment

This is where networking knowledge becomes especially valuable.

Suppose a workstation connects to an external host every 60 seconds. Each connection transfers only a few hundred bytes. The destination has little business relevance, and the pattern continues throughout the night.

None of those facts alone proves compromise. Together, however, they give a threat hunter a reason to investigate possible beaconing or command-and-control behavior.

You should therefore become comfortable looking at DNS activity, TCP sessions, TLS connections, protocol metadata, process relationships, network flows, and endpoint evidence as pieces of the same investigation.

Memory-Resident Attacks

Fileless and memory-resident techniques deserve particular attention. Traditional file scanning is less useful when malicious code executes primarily in memory or abuses trusted operating-system components.

The blueprint specifically references memory-analysis concepts and tools such as Volatility. The goal is not just to memorize a few commands. Understand what investigators are trying to recover: suspicious processes, injected code, unusual parent-child relationships, network connections, loaded modules, or other artifacts that may not exist on disk.

Code-Level Analysis

The blueprint also references tools and approaches used for code-level analysis, including examples such as PE analysis, Burp Suite, and Semgrep.

For a network-focused student, this can feel like unfamiliar territory. Start with the purpose rather than the tool syntax. Learn what static analysis, dynamic analysis, web request inspection, and source-code scanning can tell an investigator.

5. Threat Hunting Processes – 20%

A good threat hunter is not someone who occasionally finds an interesting IP address. Threat hunting needs a repeatable process.

This domain covers how to identify compromises, analyze detection gaps, interpret memory-analysis results, construct runbooks and playbooks, select defensive techniques, recommend remediation, and improve the efficiency of future hunts.

The distinction between a runbook and a playbook is worth understanding in context. Terminology varies between organizations, but both concepts are ultimately about making security operations repeatable. When an analyst detects a particular scenario, the team should know what evidence to collect, what systems to query, what decisions to make, and when to escalate or contain the incident.

You also need to think beyond the immediate alert.

If a hunt finds malicious PowerShell execution, deleting one script is not a complete outcome. An analyst should ask how the activity entered the environment, whether credentials were compromised, whether other hosts show the same behavior, what detection failed, and what security controls should change.

That mindset is central to CBRTHD.

6. Threat Hunting Outcomes – 10%

The hunt is not finished when the analyst finds something malicious.

A useful investigation should improve the environment.

The final domain includes analytical gaps, C2 mitigation, maturity improvements, detection methodology, multi-product visibility, and communicating findings.

Consider a simple example. A threat hunt discovers that an attacker used DNS tunneling for command-and-control traffic.

A weak outcome would be:

“We found suspicious DNS traffic and blocked the domain.”

A stronger outcome would include:

• Containing affected hosts
• Blocking known malicious infrastructure
• Identifying similar activity across historical telemetry
• Developing or improving DNS analytics
• Adding detections for abnormal query patterns
• Reviewing endpoint activity associated with the connections
• Documenting the investigation
• Updating the SOC playbook
• Measuring whether the new detection works

That is the difference between responding to one event and improving security capability.

Important Technologies Behind the CBRTHD Exam

MITRE ATT&CK

MITRE ATT&CK is one of the most important frameworks to understand for this exam. Learn how tactics describe an adversary’s objectives while techniques describe ways those objectives may be achieved.

More importantly, practice mapping actual log evidence to ATT&CK behavior. A technique name is much easier to remember once you have seen the corresponding process execution, authentication event, network session, or registry modification.

SIEM and Security Analytics

A Security Information and Event Management platform gives analysts a place to aggregate and correlate telemetry from multiple systems.

For CBRTHD preparation, focus on analytical thinking rather than becoming dependent on one query language. You should know how to filter events, correlate timestamps, pivot between indicators, identify outliers, and combine data from different sources.

Endpoint Telemetry

Network telemetry can show that a host communicated with a suspicious server. Endpoint telemetry can help explain which process created the connection, which user launched it, what command executed, what files were touched, and what happened immediately before and after the network activity.

Strong investigations usually combine both perspectives.

Threat Intelligence

Threat intelligence is useful when it changes a defensive decision.

Indicators, adversary reports, malware behavior, infrastructure information, and TTPs can all provide context for a hunt. However, intelligence should guide investigation rather than replace it.

An old malicious IP address may no longer be relevant. A behavioral pattern can sometimes remain useful much longer.

Python and PowerShell

If programming is not your strongest area, do not ignore this part of the blueprint.

Start small. Learn how to read a text file, parse JSON or CSV data, search for patterns, work with timestamps, count events, extract IP addresses, and make simple API requests in a lab environment.

A 30-line script that removes an hour of repetitive analysis is more relevant to a security analyst than an unnecessarily complex application.

Cisco Technologies You May Encounter While Studying CBRTHD

The exam is broader than a single Cisco product. In fact, Cisco’s official CBRTHD training combines Cisco platforms with third-party and open-source technologies.

The current official training includes hands-on activities involving technologies such as:

• Cisco Secure Firewall
• Cisco Secure Network Analytics
• Cisco XDR
• Splunk
• ELK Stack
• PowerShell
• MITRE ATT&CK Navigator
• MITRE Caldera
• Velociraptor
• Network packet analysis
• Windows event logs
• OSINT techniques

That is a healthy approach to threat hunting because real SOC environments are rarely built around one vendor. Analysts have to correlate evidence across network devices, endpoints, cloud platforms, identity systems, SIEM platforms, and threat intelligence sources.

What Background Knowledge Should You Have?

Cisco’s professional cybersecurity certification has no formal prerequisite, but that does not mean every candidate starts from the same place.

The official CBRTHD course expects general networking and network-security knowledge. Cisco points learners toward foundational material such as CCNA, cybersecurity operations fundamentals, and CBRCOR-related training.

Before seriously preparing for 300-220, I would want a beginner to be comfortable with at least the following:

• TCP/IP and common network protocols
• DNS, HTTP/HTTPS, DHCP, and basic routing
• Firewalls and access-control concepts
• Basic Linux and Windows administration
• Windows processes and event logs
• Common attack techniques
• Basic packet analysis
• Security logs and SIEM concepts
• Endpoint security concepts
• Basic Python or PowerShell

You do not need expert-level knowledge in every category before starting. You do need enough foundation to understand the evidence you are looking at.

Is CBRTHD Suitable for Beginners and Students?

It can be, with the right expectations.

If you are a student who already has CCNA-level networking knowledge and has spent some time studying cybersecurity operations, CBRTHD can be an excellent advanced project. It gives you a reason to build a lab, analyze real telemetry, write small scripts, and think like an investigator.

If you are completely new to IT, I would not make 300-220 your first Cisco exam.

A more practical progression could look like this:

1. Learn networking fundamentals.
2. Build basic Linux and Windows administration skills.
3. Study CCNA-level networking.
4. Learn cybersecurity and SOC fundamentals.
5. Practice packet and log analysis.
6. Learn basic Python and PowerShell.
7. Move into CBRTHD threat hunting topics.

This path may take longer, but the concepts will make much more sense.

An 8-Week Cisco 300-220 CBRTHD Study Plan

When organizing your preparation, it can be useful to keep a dedicated Cisco CBRTHD study resource alongside the official blueprint so that your review remains focused on the current 300-220 objectives.

Week 1: Networking, Logs, and Threat Hunting Fundamentals

• Review TCP/IP, DNS, HTTP, TLS, and common network services.
• Review Windows and Linux logging.
• Learn the threat hunting lifecycle.
• Study the Threat Hunting Maturity Model.
• Understand the Pyramid of Pain.

Week 2: MITRE ATT&CK and Threat Modeling

• Learn ATT&CK tactics and techniques conceptually.
• Practice using ATT&CK Navigator.
• Study CAPEC, Cyber Kill Chain, TaHiTI, and PASTA.
• Create several threat-hunting hypotheses.

Week 3: Threat Intelligence and Attribution

• Read several public threat intelligence reports.
• Extract TTPs and indicators.
• Map observed behavior to ATT&CK.
• Practice distinguishing strong evidence from weak attribution.

Week 4: Network-Based Threat Hunting

• Analyze packet captures.
• Review DNS, HTTP, TLS, and session metadata.
• Look for periodic beaconing.
• Practice identifying suspicious outbound connections.
• Study C2 behavior.

Week 5: Endpoint and Memory Analysis

• Review Windows processes and parent-child relationships.
• Analyze endpoint artifacts.
• Study fileless and memory-resident attacks.
• Practice basic memory-forensics workflows.

Week 6: SIEM, Python, and PowerShell

• Query security events in Splunk, ELK, or another SIEM.
• Write simple Python scripts for log parsing.
• Practice PowerShell-based endpoint inspection.
• Correlate endpoint and network evidence.

Week 7: Threat Hunting Processes and Playbooks

• Design a hunt from hypothesis to conclusion.
• Create a simple SOC playbook.
• Document evidence collection steps.
• Identify detection gaps.
• Recommend mitigations.

Week 8: Review and Scenario Practice

• Review all six blueprint domains.
• Focus on weak areas rather than rereading everything.
• Practice explaining why an answer is correct.
• Run one complete threat hunt in your lab.
• Write a short investigation report.

How to Build a Small CBRTHD Practice Lab

You do not need an enterprise SOC to learn threat hunting.

A useful student lab can be built with a few virtual machines and freely available tools.

A simple design might include:

• One Windows endpoint
• One Linux system
• A SIEM or log-search platform
• A packet-analysis tool
• Python
• PowerShell
• MITRE ATT&CK Navigator
• A memory-analysis tool

Generate safe, controlled activity in the lab and then try to reconstruct what happened from the evidence.

For example, run a PowerShell command that creates a network connection, capture the traffic, record the endpoint events, send the logs to your SIEM, and then investigate the activity as if you did not already know what happened.

The technical action itself may be simple. The useful part is learning to move between data sources.

Ask:

• What does the network see?
• What does the endpoint see?
• What does the SIEM see?
• Which events provide context?
• What ATT&CK technique best describes the behavior?
• What detection could identify the behavior next time?

Repeat that process often enough and the exam objectives stop feeling like isolated bullet points.

Common Mistakes When Preparing for Cisco CBRTHD

1. Memorizing MITRE ATT&CK Without Using It

Knowing technique names is useful. Knowing how to map evidence to a technique is much more useful.

2. Ignoring Networking Fundamentals

You cannot reliably identify abnormal traffic if normal TCP/IP, DNS, HTTP, and routing behavior is still confusing.

3. Studying Only Cisco Products

This certification is from Cisco, but threat hunting is a methodology, not a product feature. The official training itself uses Cisco, third-party, and open-source technologies.

4. Avoiding Scripting

You do not need to become a Python developer, but analysts who can automate basic data handling are considerably more effective.

5. Treating Every IOC as Proof

An IP address, hash, filename, or tool name rarely tells the entire story. Always examine context and behavior.

6. Skipping Hands-On Practice

Reading about threat hunting and performing a threat hunt are very different experiences.

7. Relying Only on Memorization

Memorizing isolated answers does not teach you how to correlate logs, analyze C2 traffic, understand TTPs, or write a useful investigation report. Use any 300-220 CBRTHD preparation material as a supplement to hands-on study rather than as a replacement for understanding the technologies behind the exam.

How Difficult Is the 300-220 CBRTHD Exam?

I would classify CBRTHD as challenging for beginners and reasonable for candidates who already work with networking or security telemetry.

The difficulty comes from breadth rather than one extremely deep technology.

You move from threat intelligence to MITRE ATT&CK, from packet behavior to endpoint artifacts, from Python to memory analysis, and from detection logic to remediation strategy.

That makes purely memorization-based preparation unreliable.

A good test of readiness is whether you can take a short security scenario and explain the entire investigation:

1. What is suspicious?
2. What hypothesis would you test?
3. Which telemetry would you collect?
4. How would you query or analyze it?
5. Which TTPs are present?
6. What additional evidence would you need?
7. How would you contain the threat?
8. How would you improve detection afterward?

If you can answer those questions consistently, you are studying at the right level.

CBRTHD vs. Traditional Network Security Certifications

Traditional network security study often emphasizes configuring preventive controls: firewalls, VPNs, identity policies, segmentation, secure access, and infrastructure hardening.

CBRTHD approaches security from another direction.

It assumes prevention may fail.

An attacker may have valid credentials. Malware may evade an endpoint product. A cloud workload may be misconfigured. A C2 session may resemble legitimate encrypted traffic. A malicious administrator may use tools already present in the operating system.

The job of the threat hunter is to detect meaningful evidence despite those complications.

That is why CBRTHD pairs well with networking knowledge. Prevention tells you how a secure network should be designed. Threat hunting teaches you how to investigate when reality does not match that design.

Career Value for Network Engineers

For network engineers, the biggest benefit of studying CBRTHD may not be the certification badge itself. It is learning to view network telemetry as security evidence.

A traditional network engineer may see:

• A DNS query
• A TLS session
• An unusual port
• A routing change
• A spike in outbound traffic

A threat hunter asks an additional question: Could this behavior represent attacker activity?

Networking professionals already possess an advantage because they understand protocols, expected traffic flows, addressing, segmentation, and infrastructure behavior. Adding threat intelligence, endpoint analysis, SIEM skills, scripting, and ATT&CK knowledge can turn that foundation into a strong security profile.

Frequently Asked Questions About Cisco 300-220 CBRTHD

What does CBRTHD stand for?

CBRTHD refers to Cisco’s Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity exam and training track.

What is the exam code for Cisco CBRTHD?

The exam code is 300-220.

How long is the Cisco 300-220 exam?

The current exam duration is 90 minutes.

How much does 300-220 CBRTHD cost?

Cisco currently lists the exam price as US$300.

What language is the exam available in?

The current Cisco exam page lists English.

What certification do I receive after passing CBRTHD?

Passing 300-220 earns the Cisco Certified Specialist – Threat Hunting and Defending certification.

Does passing CBRTHD earn CCNP Cybersecurity?

No. CBRTHD satisfies the concentration-exam portion of the CCNP Cybersecurity path. You must also satisfy Cisco’s current core-exam requirement, which is 350-201 CBRCOR.

Does Cisco publish the 300-220 passing score?

No fixed passing score is publicly published. Cisco states that passing scores are determined statistically and may change between exams.

How long is the Cisco certification valid?

Cisco’s current Professional and Specialist certifications are generally valid for three years and can be maintained through Cisco’s recertification options.

Is CBRTHD a good first cybersecurity certification?

Usually not. It is more useful after you understand networking, network security, operating-system basics, security monitoring, and log analysis. Students with CCNA-level networking and introductory SOC knowledge are in a much better position to benefit from it.

Do I need Python for CBRTHD?

You should understand basic scripting. The official blueprint explicitly includes Python and PowerShell as ways to augment detection and analytics.

Should I memorize every MITRE ATT&CK technique?

No. Learn the structure of ATT&CK and become comfortable mapping real activity to tactics and techniques. Understanding how and why the framework is used is more valuable than trying to memorize the entire matrix.

Where can I find more information for 300-220 CBRTHD preparation?

In addition to Cisco’s official blueprint and training materials, you can review this Cisco 300-220 CBRTHD preparation page for additional exam-focused information.

Final Thoughts

The Cisco 300-220 CBRTHD exam is an unusually practical certification topic because it focuses on what defenders do after traditional prevention and alerting are no longer enough.

For network engineers, it provides a path into detection and security operations. For SOC analysts, it adds structure to investigations. For students, it offers a roadmap for learning technologies that are difficult to understand when studied separately.

The most productive way to prepare is to avoid treating CBRTHD as a list of definitions. Build a small lab. Read threat reports. Analyze packets. Search logs. Investigate endpoint activity. Write Python scripts. Map behavior to MITRE ATT&CK. Document what you find. Then ask how your detection could be improved.

When you reach the final review stage, combine the official Cisco blueprint with focused 300-220 Cisco CBRTHD exam preparation and hands-on practice. This gives you a better balance between understanding the technology and becoming familiar with the scope of the certification exam.

If you study that way, you are preparing for more than the 300-220 exam. You are developing the analytical habits that threat hunters actually need.

Official Cisco Resources

• Cisco 300-220 CBRTHD Exam Page
  
• Cisco CBRTHD Official Training
  
• CCNP Cybersecurity Exams and Training
  
• Official Cisco 300-220 CBRTHD v1.0 Exam Topics
  

Additional 300-220 CBRTHD Resource

For more exam-focused information, visit our Cisco 300-220 CBRTHD exam preparation resource.

Exam objectives, pricing, certification names, and Cisco policies can change. Always verify the latest details on Cisco’s official certification website before scheduling an exam.