Exam Overview

The 300-220 CBRTHD exam is a concentration examination in the CCNP Cybersecurity certification path. Passing it earns the Cisco Certified Specialist - Threat Hunting and Defending certification and satisfies the concentration exam requirement for CCNP Cybersecurity.

• Exam Code: 300-220 CBRTHD v1.0
• Level: Professional-level concentration and Specialist certification exam
• Duration: 90 minutes. Available language: English.
• Passing Score: Not officially disclosed by Cisco (commonly estimated at ~825 out of 1000).
• Grading and Results: Cisco uses pass/fail grading and states that results are available online within 48 hours.

Exam Structure

The 300-220 CBRTHD exam follows six official domains covering threat hunting fundamentals, threat modeling techniques, threat actor attribution, hunting techniques, hunting processes, and threat hunting outcomes.

• Question Types: Not officially disclosed by the certification provider.
• Number of Questions: Not officially disclosed by the certification provider.
• Hands-On Questions: Not officially disclosed by the certification provider.

Exam Policies

Before completing CBRTHD exam registration, review Cisco's certification policies, Pearson VUE admission and identification rules, the Cisco candidate agreement, and the appointment terms displayed for the selected delivery method.

• Rescheduling: Online Proctored exams can be rescheduled up to 30 minutes before check-in. Test Center exams can be rescheduled up to 48 hours before the scheduled appointment.
• Cancellation: Online Proctored exams can be cancelled up to 30 minutes before check-in. Test Center exams can be cancelled up to 48 hours before the scheduled appointment.
• Retake Policy: After failing a Professional- or Specialist-level written exam, candidates must wait five calendar days, beginning the day after the unsuccessful attempt, before retaking the same exam.
• Retake Fee: Cisco states that candidates may retake an exam for the same cost unless an eligible safeguard, voucher, or promotion provides different terms. The full CBRTHD exam fee therefore normally applies to another attempt.

Certification Validity and Renewal Options

Passing the 300-220 CBRTHD exam earns the Cisco Certified Specialist - Threat Hunting and Defending certification and begins Cisco's standard active certification cycle.

• Validity: Cisco states that Specialist certifications remain active for three years from the date earned and must be recertified before expiration to remain active.
• Renewal Options: Renew the Specialist credential by earning 40 Continuing Education credits or by completing an eligible Cisco certification exam pathway under Cisco's current recertification policy.

Exam Fee

• Base Fee: The official CBRTHD exam fee is USD 300, excluding applicable taxes. Candidates may also redeem eligible Cisco Learning Credits during scheduling.
• Taxes: Local taxes, currency conversion, and regional checkout rules may affect the final CBRTHD certification cost. The payable amount is shown during registration.
• Example (India): Candidates in India are subject to 18% GST, bringing the total exam fee to USD 354 (USD 300 + USD 54 GST).

Prerequisites

Cisco publishes no formal prerequisite for the 300-220 CBRTHD exam. To earn CCNP Cybersecurity, candidates must pass the 350-201 CBRCOR core exam and one eligible concentration exam.

• Candidates should understand SOC operations, threat intelligence, endpoint and network telemetry, SIEM data, malware behavior, command-and-control traffic, threat modeling, scripting, reverse engineering, detection engineering, and security countermeasures.
• Preparation should combine the official CBRTHD syllabus with practical experience analyzing and responding to the security scenarios represented in the current blueprint.
• Cisco's official learning resources are recommended preparation for the 300-220 CBRTHD exam, but completing a specific course is not an exam prerequisite.

Exam Topics

The official CBRTHD syllabus v1.0 covers the following weighted domains:

• Threat Hunting Fundamentals - 20%: Hunting maturity, the Pyramid of Pain, threat models, detection limitations, SOC automation, adversary behavior, and threat-intelligence interpretation.
• Threat Modeling Techniques - 10%: Selecting modeling approaches, mapping adversary behavior, structured and unstructured hunts, attack prioritization, and threat-intelligence handling.
• Threat Actor Attribution Techniques - 20%: Deriving tactics, techniques and procedures from logs, distinguishing assessments from attacks, and selecting durable artifacts for advanced-persistent-threat detection.
• Threat Hunting Techniques - 20%: Scripting, cloud-native hunts, SIEM and endpoint artifacts, command-and-control analysis, protocol data, code analysis, IoT analysis, memory attacks, and detection signatures.
• Threat Hunting Processes - 20%: Memory analysis, reverse engineering, detection gaps, runbooks and playbooks, tool and deception recommendations, remediation, hunt improvement, and security mitigations.
• Threat Hunting Outcomes - 10%: Multiproduct visibility, analytical-gap diagnosis, command-and-control blocking, and advancing organizational threat hunting maturity.

Intended Audience

The 300-220 CBRTHD exam is designed for professionals who investigate, operate, automate, and improve enterprise cybersecurity capabilities, including:

• Security Operations Center Staff
• SOC Tier 2 Analysts
• Threat Hunters
• Cyber Threat Analysts
• Threat Intelligence Analysts
• Threat Managers
• CCNP Cybersecurity Candidates

Career Opportunities

Passing the 300-220 CBRTHD exam supports specialist roles aligned with the knowledge and operational skills in the current blueprint, including:

• Threat Hunter
• Senior SOC Analyst
• Cyber Threat Analyst
• Detection Engineer
• Threat Intelligence Analyst
• Cyber Defense Specialist

Average Salary (Approximate)

Cisco does not publish salary data for CBRTHD credential holders. The ranges below use current employment-market estimates for Cybersecurity Analysts or closely related roles. Salaries vary by experience, employer, location, job role, and industry.

• U.S.: Approximately USD 66,794-164,853 per year for Cybersecurity Analysts (Indeed, July 2026).
• India: Approximately INR 432,000-985,000 per year for Cyber Security Analysts (Glassdoor, July 2026).
• United Kingdom: Approximately GBP 25,150-72,898 per year in total pay for Cyber Security Analysts (Glassdoor, July 2026).
• UAE: Approximately AED 180,000-300,000 per year in total compensation for Cybersecurity Analysts in the Greater Dubai area (Levels.fyi, July 2026).

Exam Delivery Options

During CBRTHD exam registration, candidates can review the delivery methods available for the 300-220 appointment and their location.

• Pearson VUE Test Center - Take the exam in a proctored environment at an authorized Pearson VUE test center, subject to local availability.
• Online Proctored Exam (OnVUE) - Cisco written certification exams, including 300-220, can be taken online, subject to country availability, system requirements, and the appointment options shown during scheduling.
• Online Exam Rules: Run the required system test, use an approved computer with webcam and microphone, present acceptable identification, maintain a clear private workspace, and remain under live-proctor supervision.
• Test Center Rules: Arrive according to the appointment instructions, bring the required identification, store prohibited items, accept Cisco's candidate agreement, and follow all check-in and proctor directions.

Exam Registration

Follow these steps to complete CBRTHD exam registration:

• Open Cisco's official exam scheduling portal and sign in with the Cisco account linked to the certification profile.
• Select the 300-220 CBRTHD exam and choose an available Pearson VUE test center or OnVUE online-proctored appointment, where offered.
• Confirm the exam language, date, time, delivery method, identification requirements, and the rescheduling and cancellation terms shown with the booking.
• Pay the CBRTHD exam fee, apply an eligible voucher, or redeem Cisco Learning Credits, then save the appointment confirmation.

After Passing the Exam

After passing the 300-220 CBRTHD exam, review the pass/fail result and certification record in Cisco CertMetrics.

• Passing earns the Cisco Certified Specialist - Threat Hunting and Defending certification and satisfies the concentration requirement for CCNP Cybersecurity.
• Use Cisco CertMetrics to access exam history, score reports, certificates, transcripts, certification logos, and the credential's expiration information.
• To earn CCNP Cybersecurity, also pass the current 350-201 CBRCOR core exam within Cisco's applicable written-exam validity window.

Why the 300-220 CBRTHD Exam Is Worth It

• Earns the Cisco Certified Specialist - Threat Hunting and Defending certification
• Satisfies the concentration requirement for CCNP Cybersecurity
• Validates current Cisco cybersecurity operations expertise
• Demonstrates focused knowledge aligned with the official CBRTHD syllabus