The Cisco 300-220 CBRTHD exam is a 90-minute exam that costs US$300 and tests whether you can hunt for and defend against threats using Cisco technologies. A pass earns the Cisco Certified Specialist - Threat Hunting and Defending certification and counts as a concentration exam toward CCNP Cybersecurity.
This guide is built for the way the exam actually thinks. Threat hunting is not a list of product screens to memorize; it is a loop that starts with a hypothesis and ends with a decision. The questions follow that loop. Below you will find the facts Cisco publishes, the five content areas the exam names, a five-week plan, a worked hunt written from scratch, and the mistakes that cost people the most. Every exam fact here was checked on Cisco's own pages on 5 November 2026.
What is the 300-220 CBRTHD exam?
CBRTHD stands for Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity. It is one of the concentration exams a candidate can use to build the CCNP Cybersecurity certification, and passing it on its own earns the Cisco Certified Specialist - Threat Hunting and Defending badge.
The official Cisco 300-220 CBRTHD exam page describes it as a 90-minute exam that certifies your knowledge of threat modeling techniques, threat actor attribution, threat hunting techniques, threat hunting processes, and threat hunting outcomes. The facts Cisco states are short:
- Exam time: 90 minutes.
- Cost: US$300, or Cisco Learning Credits.
- Language: English.
- Certification earned: Cisco Certified Specialist - Threat Hunting and Defending.
- Counts toward: CCNP Cybersecurity, as a concentration exam.
Notice the track name. Cisco lists the professional track for this exam as CCNP Cybersecurity, not CCNP Security. If an older study guide still calls it a CCNP Security concentration exam, it predates the renaming. Check the current certification requirements on Cisco's site before you plan your path.
How many questions are on the exam, and what is the passing score?
Here is where honest preparation beats guesswork. Cisco does not publish a fixed number of questions or a fixed passing score for the 300-220 CBRTHD exam. Cisco scores its written exams on a scaled system and sets the bar per form, so no single pass mark is printed anywhere official. Anyone quoting an exact number of questions or a precise percentage is repeating an unofficial figure.
What you can rely on is the time and the style. You have 90 minutes, and the questions are scenario driven: you read a situation and choose the hunt, the data source, or the next step that fits. Plan your pace around 90 minutes rather than a question count, and treat every answer as worth the same.
What topics does the 300-220 CBRTHD exam cover?
Cisco names five content areas, and they map cleanly onto the hunt loop. The exact percentage weight for each area is published on the Cisco Learning Network, so read the live blueprint before you book.
- Threat modeling techniques. Describe the models that turn an environment into a set of likely attacks, so a hunt has a target instead of a hunch.
- Threat actor attribution techniques. Tie observed activity to known tactics, techniques, and groups, and understand what attribution can and cannot prove.
- Threat hunting techniques. Form a hypothesis, pick the data, and search for the evidence that would confirm or kill it.
- Threat hunting processes. Run the hunt as a repeatable process: scope, collect, analyze, and document, so the work survives one analyst leaving.
- Threat hunting outcomes. Turn a finding into something useful: a new detection, a tuned rule, a report, or an input to incident response.
You can see the verbs at work in the Cisco Learning Network exam topics for 300-220, which lists each task and the weight of its domain. Most tasks are about doing and deciding, not reciting, so study with a dataset open rather than only a slide deck.
How does threat hunting differ from alert triage?
This difference is the heart of the exam, and it is the thing candidates most often blur. Alert triage is reactive: a tool fires, and you decide whether it matters. Threat hunting is proactive: you assume something has slipped past the tools, form a hypothesis about what it would look like, and go searching before any alert fires.
The 300-220 questions reward the hunting mindset. When a scenario gives you a quiet environment and a worry, the exam wants a hypothesis and a data source, not a request to wait for an alarm. When it gives you a finding, it wants an outcome, a new detection or a hand-off to response, not just a note that the hunt is over. If you have mostly worked a SOC queue, this reframing is the single most valuable thing to practise.
What is a good five-week study plan?
Five weeks suits someone with some security operations background. If hunting is new to you, stretch each week to two. The plan follows the loop, so each week builds on the last.
- Week 1: Threat modeling. Learn two or three modeling approaches well enough to apply them to your own network. For each asset, write down what an attacker would want and how they would get it. This list becomes your hunt backlog.
- Week 2: Attribution and techniques. Study how activity is mapped to known tactics and groups, and where attribution gets shaky. Then practise the technique step: take one item from your week 1 backlog and write the exact search you would run.
- Week 3: The hunting process. Run three full hunts end to end on real or lab data. Scope each one, collect the data, analyze it, and write a short report. The report matters as much as the search.
- Week 4: Outcomes and defending. For each week 3 hunt, produce an outcome: a detection rule, a tuning change, or a response action. Connect the hunt to what Cisco technologies would do with the result.
- Week 5: Review and gaps. Re-read the five content areas line by line and mark each task done, shaky, or never tried. Spend the week on the shaky and never-tried items, then stop the day before the exam.
Keep a single hunt notebook across all five weeks. On a scenario-based exam, the candidate who has actually written hunts reads the questions faster than the one who only revised definitions.
What does a real threat hunt look like?
Here is a hunt written for this guide, not taken from any exam. It shows how the five areas connect, which is how the exam likes to test them.
Start with a model. Your crown-jewel asset is a finance database, and a plausible attack is credential theft followed by quiet data access at odd hours. That is threat modeling: it gives the hunt a target.
Now the hypothesis and technique. You suppose that a compromised account would read the database outside its owner's normal pattern. You pick two data sources, authentication logs and database access logs, and you search for accounts that logged in from a new location and then queried the finance database between midnight and 5 a.m.
Then the process. You scope the hunt to the last 30 days, collect both logs, and analyze them together, joining on the account. One service account stands out: a new source IP, then a burst of after-hours reads. You document what you found and how, so the next analyst can repeat it.
Finally the outcome. The finding becomes two things: a new detection that fires on after-hours finance reads from a first-seen IP, and a hand-off to incident response to check the account. Attribution comes last, matching the pattern to a known technique rather than naming a group you cannot prove. If you can walk that chain yourself, you have touched all five content areas in one exercise.
Which certification does the exam count toward?
A pass gives you the Cisco Certified Specialist - Threat Hunting and Defending certification right away. The same pass also counts as a concentration exam toward CCNP Cybersecurity, which you complete by combining a core security exam with one concentration exam.
Because the professional certification needs two pieces, plan the order that suits you. Some candidates clear the core exam first and add 300-220 as their concentration; others earn the specialist badge from 300-220 first and schedule the core exam later. If you are new to Cisco's networking exams, our Cisco 800-150 FLDTEC exam guide on this blog shows how a single-exam Cisco certification is structured, which is a gentler starting point before a two-exam track.
How do you register for the 300-220 CBRTHD exam?
You schedule Cisco exams through Pearson VUE, at a test center or online with remote proctoring. Create or sign in to your Cisco account, then book the exam by its code so the version on the screen matches the blueprint you studied.
You can review delivery options and locations on Pearson VUE's Cisco exam page. Pick your date after week four of the plan above, not before you begin. A fixed date keeps you honest, but one set too early tends to push people into the exam with the process and outcomes areas only half done.
Which mistakes cost candidates the most?
These are the patterns that hurt most on a 90-minute, scenario-based exam.
- Studying triage instead of hunting. The exam wants hypotheses and proactive searches. If every answer you reach for is "wait for the alert," you will lose the hunting questions.
- Chasing a fake question count or pass mark. Cisco publishes neither. Time yourself against 90 minutes and read each scenario fully instead of rushing to hit an imagined number.
- Skipping the process and outcomes areas. Many candidates over-study techniques and under-study how a hunt is scoped, documented, and turned into a detection. Give those areas real lab time.
- Confusing attribution with certainty. Know what attribution can suggest and what it cannot prove; the exam tests the limits as well as the method.
- Using an outdated track name. It is CCNP Cybersecurity now. Confirm the current requirements on Cisco's site so you plan the right core exam.
How can you check your readiness?
You are close when you can explain each of the five content areas in your own words and walk a full hunt from model to outcome without notes. If you want timed, scenario-style practice organized by these areas, the NWExam 300-220 CBRTHD practice test collects questions for this code so you can rehearse pacing before the real 90 minutes.
Is there a video overview of the 300-220 exam?
Yes. This short NWExam overview walks through what the Cisco 300-220 certification involves and how to approach it, which is a useful picture before you open the blueprint. Take the specific facts, the 90 minutes and US$300, from the list above.
Frequently asked questions
1. How many questions are on the 300-220 CBRTHD exam?
Cisco does not publish a fixed number of questions for the 300-220 CBRTHD exam. It is a 90-minute exam with scenario-based questions, so plan your pace around the time rather than a question count.
2. What is the passing score for the 300-220 CBRTHD exam?
Cisco uses scaled scoring and does not publish a fixed passing score for this exam. Any exact percentage you see quoted is unofficial.
3. How much does the 300-220 CBRTHD exam cost?
The exam costs US$300, or you can use Cisco Learning Credits. It is delivered in English.
4. Which certification does passing 300-220 CBRTHD give you?
A pass earns the Cisco Certified Specialist - Threat Hunting and Defending certification, and it counts as a concentration exam toward CCNP Cybersecurity.
5. Do I need experience before taking the 300-220 CBRTHD exam?
Cisco lists no formal prerequisite to sit the exam, but the content assumes hands-on security operations and threat hunting experience, so practise on real or lab data before you book.