300-820 Implementing Cisco Collaboration Hybrid and Cloud Technologies Exam Topics and Questions

Configuration is where the exam earns its name. This topic puts 25% of the marks on your ability to wire together the moving parts of a Cisco collaboration hybrid environment: identity, directories, gateways, calendaring, and survivability. Get a step wrong in the lab and you lose marks across multiple scenarios, because these components depend on each other. Know not just what each feature does, but the exact sequence and the parameters that make it work.

– Identity and directory integration

SSO configuration is a precision task. The exam tests whether you know which metadata files go where, which entity IDs to set, and what breaks when the IdP and Webex trust anchors do not align. A misconfigured SSO does not always produce an obvious error, so you need to know the failure modes, not just the happy path.

Directory synchronization sits alongside SSO in most real deployments, and the exam treats them together. You need to know the sync tool's role, what attributes flow from Active Directory into Control Hub, and what happens to users who fall outside the connector's scope. The distinction between a provisioned user and a claimed user matters here, and items will test whether you can tell them apart under pressure.

– Calendaring and gateway connectivity

Hybrid Calendar Service with cloud mail means connecting Microsoft 365 or Google Workspace to Webex so that @webex keywords and One Button to Push work correctly. The exam cares about the connector placement, the permissions required in the cloud mail tenant, and the conditions under which the service degrades silently rather than failing loudly.

Local gateways are split between certificate-based and registration-based models, and that split is examinable in detail. Certificate-based local gateways use a TLS trunk with a specific certificate chain requirement; registration-based gateways authenticate differently and have different dial-plan implications. Knowing which model applies to a given scenario, and what configuration each requires on both the gateway and in Control Hub, is the core skill the exam tests here.

– Survivability and Control Hub calling features

Site survivability means keeping calls working when the connection to Webex cloud is lost. The exam tests the survivability configuration on the local gateway side: what the survivability profile contains, which call flows remain available during a cloud outage, and which features drop away. Candidates who treat survivability as an afterthought consistently lose marks on scenario items that describe a partial outage.

Control Hub calling features such as hot desking and auto attendant are configured through the Control Hub interface, and the exam tests the specific steps and options for each. Hot desking has user and device prerequisites that are easy to overlook. Auto attendant configuration involves business hours, holiday schedules, and routing rules, any one of which can be the variable in a scenario item. Know the full configuration path for each feature, not just its purpose.

How Suite and Devices Configuration is tested

At 25% of the exam, this topic will appear in more items than any other. Expect scenario-based items that give you a partially built environment and ask what is wrong or what step comes next. The trap is that most of the distractors describe valid configuration steps performed in the wrong order or on the wrong component.

Items on SSO and directory sync reward knowing the exact attribute mappings and trust relationships, not a general understanding of federation. Gateway items reward the ability to distinguish certificate-based from registration-based behaviour under specific conditions. Survivability items reward knowing what fails gracefully and what fails hard.

Candidates lose marks most often by conflating on-premises Unified CM configuration with Webex cloud configuration. The exam is about the cloud side and the hybrid boundary. If your mental model defaults to on-premises CLI, slow down and re-read the scenario before committing to an answer.

After configuration comes the harder daily reality: keeping the environment healthy when things go wrong. Cloud Management shifts the focus from building to diagnosing. At 10% of the exam, the marks are concentrated on two areas that trip up candidates who have field experience but have not mapped that experience to the Webex-specific toolset: user management troubleshooting and network-layer diagnosis for cloud collaboration traffic.

– User management troubleshooting

Troubleshooting cloud user management means understanding the three mechanisms that can create or modify users in Control Hub: the Directory Connector, SCIM provisioning, and role-based access control. Each has its own failure signature. A Directory Connector problem usually shows up as a sync error or a stale attribute; a SCIM problem tends to surface as a provisioning failure from a third-party IdP; an RBAC problem appears as a user who exists in the system but cannot perform an action they should be able to.

The exam does not reward knowing that these mechanisms exist. It rewards knowing how to isolate which one is responsible for a specific symptom. That means understanding the audit log entries in Control Hub, the connector's own logging, and the sequence in which Control Hub resolves conflicts when two mechanisms attempt to manage the same user attribute. Candidates who can describe each mechanism but cannot map a symptom to a cause will lose marks on these items.

– Network diagnosis for cloud collaboration

Bandwidth and QoS problems in Webex environments have a specific character: the issue is often not a total failure but a degradation that users describe vaguely as poor quality. The exam tests whether you can translate that vague description into a specific diagnosis. That means knowing the traffic types Webex generates, the DSCP markings Cisco recommends for each, and how to use the Control Hub troubleshooting tools and the Network Test in the Webex app to gather evidence.

Items in this area often describe a symptom, such as one-way audio or pixelated video on a specific endpoint type, and ask you to identify the most likely cause. The traps are usually plausible-sounding network problems that do not match the symptom pattern. Knowing that Webex media uses specific UDP port ranges, and that QoS misconfiguration produces predictable asymmetric behaviour, is what separates a strong answer from a guess.

How Cloud Management is tested

Ten percent of the exam means roughly one in ten items will come from this topic, so you cannot afford to skip it, but you also should not over-invest. The items here are diagnostic: you are given a symptom and asked to identify the cause or the next troubleshooting step.

User management items reward the ability to distinguish between a connector problem, a SCIM provisioning problem, and an RBAC configuration problem based on a described symptom. The distractor options are typically all plausible mechanisms, so the item tests specificity, not general awareness.

Network items reward knowing Cisco's recommended QoS markings for Webex traffic and understanding how to interpret Control Hub diagnostic data. Candidates lose marks by selecting generic network troubleshooting steps that are not specific to cloud collaboration environments. The exam expects Webex-specific knowledge, not general networking knowledge applied loosely to a Webex scenario.

Tied with Topic 1 at 25% of the exam, Suite and Devices Management is the troubleshooting counterpart to the configuration work you covered earlier. Where Topic 1 asked you to build, this topic asks you to fix. The breadth is significant: Webex Calling, call routing, meetings, messaging, and endpoint registration each have their own failure modes, and the exam moves between them without warning. Your weakest troubleshooting area will cost you more marks here than anywhere else.

– Webex Calling troubleshooting

Troubleshooting Webex Calling at a general level means knowing where to look when a user cannot make or receive calls. Control Hub's calling troubleshooting tools, the user's calling behaviour settings, and the device's registration status are the first three places to check, and the exam tests whether you know the right sequence. A symptom like "user cannot call externally" has a different root cause than "user cannot be reached from the PSTN", and items will test whether you can distinguish them.

Endpoint registration to the cloud has its own failure taxonomy. A device that fails to register may have a certificate issue, a network policy blocking the registration port, or a provisioning error in Control Hub. The exam rewards knowing which log or which Control Hub view surfaces each type of failure, and which configuration change resolves it. Candidates who troubleshoot registration by rebooting the device and hoping are not prepared for these items.

– Call routing in Webex Calling

Call routing troubleshooting is the most granular sub-area in the entire exam. The sub-topics span operating modes, locations, numbers, translation patterns, trunks and route groups, dial plans, and call permissions. That is seven distinct configuration layers, any one of which can be the variable in a scenario item.

Operating modes determine whether Webex Calling is the primary call control or whether it is operating alongside an on-premises system. Locations define the emergency calling behaviour and the PSTN connection. Numbers and translation patterns interact in ways that are easy to misconfigure: a translation pattern that looks correct can still produce wrong-number errors if the matching order is not what you expect. Trunks and route groups connect Webex Calling to the PSTN or to on-premises infrastructure, and the exam tests both the configuration of the trunk and the routing logic that selects it. Dial plans and call permissions are the final filters, and items often describe a call that routes correctly for one user but not another, pointing at a permissions mismatch.

– Meetings, messaging, and endpoint registration

Cloud meetings troubleshooting focuses on the conditions that cause a meeting to degrade or fail: network path issues, firewall blocking, or a host account that has not been assigned the right licence. The exam tests whether you can identify the most likely cause from a described symptom, and whether you know which Control Hub report or diagnostic tool provides the relevant data.

Cloud messages troubleshooting is narrower. The most common exam scenarios involve a user who cannot see a space, cannot receive messages from an external domain, or has messages that are not being retained or deleted according to the organisation's compliance policy. Knowing the external communication settings and the compliance officer role in Control Hub is the relevant knowledge here.

Endpoint registration failures tie back to Webex Calling but have their own dedicated items. The exam tests both the network prerequisites for registration and the Control Hub configuration that must be in place before a device can register successfully.

How Suite and Devices Management is tested

At 25%, this topic produces as many items as Topic 1, but the cognitive demand is different. Configuration items test recall of steps; troubleshooting items test reasoning under constraints. You will be given a described environment, a symptom, and a set of plausible causes. The items reward isolating the most specific and proximate cause rather than the most general one.

Call routing items are the hardest in this topic. They reward knowing how Webex Calling's routing layers interact, not just what each layer does in isolation. A dial plan item where the symptom is an unexpected route selection will have distractors that each point at a different routing layer, and only one matches the symptom.

Candidates lose marks by applying on-premises Unified CM troubleshooting logic to Webex Calling scenarios. The tools, the terminology, and the configuration objects are different. If you have a strong CUCM background, invest time specifically in the Webex Calling routing model before the exam.

Administration sits between management and strategy. This topic covers what an administrator does in Webex day-to-day: managing users and organisations through Control Hub, understanding the AI features available in the platform, and knowing the options for migrating an on-premises deployment to the cloud. At 10% of the exam, the items here tend toward "describe" and "identify" rather than "configure" or "troubleshoot", which changes the preparation strategy.

– Control Hub administration functions

User management in Control Hub covers adding, removing, and modifying users, but the exam goes further than the basic mechanics. It tests whether you understand the difference between a manually added user and a directory-synced user, and what constraints apply to each. Removing a directory-synced user from Control Hub without addressing the sync source, for example, produces a result that surprises many candidates.

Organisation management covers domain claiming, security settings, and integrations with third-party services. The domain claiming process has specific DNS requirements, and the exam tests whether you know the steps and their order. Security settings include the options for enforcing MFA, session controls, and data residency choices. Integrations connect Webex to external platforms, and the exam tests which integration types are configured at the organisation level versus the user level.

Site management covers adding multiple Webex sites to a Control Hub organisation, enabling features per site, and applying common settings. Candidates who have only managed a single-site deployment often have gaps here.

– AI features and migration tooling

AI features in cloud collaboration solutions are a growing part of the Cisco exam syllabus. The exam tests at the descriptive level: which AI features are available in Webex, which licence tier enables them, and what each feature does in a meeting or messaging context. Noise removal, real-time translation, automated summaries, and gesture recognition are among the features in scope. You do not need to configure them, but you do need to know their prerequisites and their scope.

The Control Hub migration tool options for moving from on-premises to cloud cover the pathways Cisco supports and the conditions under which each is appropriate. The exam tests whether you can identify the right migration approach given a described on-premises environment. This connects directly to Topic 5, but at the administration level the focus is on the tooling available inside Control Hub rather than the hybrid configuration steps. Know what the migration tool assesses, what it automates, and what it leaves for the administrator to handle manually.

How Suite and Device Administration is tested

Items in this topic are more likely to be knowledge-recall or scenario-match than the deep diagnostic items you find in Topics 1 and 3. The "describe" framing in the sub-topics signals that the exam is testing whether you know what something is and when it applies, rather than how to build it from scratch.

AI feature items reward knowing the specific feature names and their licence prerequisites. Distractors often describe a feature that exists but at the wrong licence tier, or a feature that is available in meetings but not in messaging. Reading each option carefully against the scenario's stated licence level is the discipline that wins these items.

Migration tool items reward knowing the distinction between what Control Hub automates and what requires manual intervention. Candidates lose marks by overstating what the migration tool handles, assuming it performs steps that are actually administrator responsibilities. The scope of the tool is the examinable detail, not the migration concept in general.

Moving an organisation from on-premises to cloud is one of the most consequential decisions in collaboration architecture, and this topic tests whether you can execute it correctly. At 10% of the exam, the scope is tighter than Topics 1 and 3, but the items are not easier. Hybrid configurations require you to hold two models in your head simultaneously: the on-premises behaviour and the cloud behaviour, and the boundary between them where things go wrong.

– Cloud Connected UC and Control Hub integration

Cloud Connected UC is the pathway that lets an existing on-premises Unified CM deployment gain cloud management visibility and features without a full migration. The exam tests the specific prerequisites for enabling Cloud Connected UC: the software versions required, the network connectivity that must exist between the on-premises cluster and the Cisco cloud, and the Control Hub configuration that activates the service. Candidates who understand Cloud Connected UC only as a concept will struggle with scenario items that describe a partially configured environment and ask what is missing or wrong.

Control Hub's role in hybrid configuration is to act as the management plane for both cloud and on-premises components. The exam tests the registration of on-premises nodes to Control Hub, the visibility that registration provides, and the conditions under which Control Hub loses sight of an on-premises component. Knowing the heartbeat mechanism and its failure behaviour is more useful here than a general understanding of what Control Hub is.

– Advanced dial plans in hybrid environments

Advanced dial plans in a hybrid context mean dial plans that span both the on-premises system and Webex Calling. The exam tests your ability to trace a call from a Webex Calling user through a local gateway into an on-premises environment, and vice versa. That trace requires knowing how route patterns and translation patterns interact across the boundary, how the dial plan on the Webex Calling side hands off to the gateway, and how the on-premises side receives and routes the call.

The most common trap in advanced dial plan items is treating the two systems as independent. In a hybrid deployment, a misconfiguration on one side can produce a failure that looks like a problem on the other side. Items that describe an unexpected call routing result in a hybrid environment are testing whether you can identify which side of the boundary the fault lies on, and that requires knowing both sides well enough to reason about their interaction.

How Hybrid and Migration to the Cloud is tested

This topic's items are scenario-heavy and boundary-focused. The exam constructs scenarios that describe a hybrid environment in transition: an organisation partway through a migration, or a Cloud Connected UC deployment that is not behaving as expected. Items reward the ability to identify the configuration step or the network condition that is blocking the next phase of the migration or causing the hybrid feature to fail.

Advanced dial plan items reward knowing the routing logic at the hybrid boundary in detail. Distractors typically describe a valid configuration for either a pure on-premises or a pure cloud environment, but not for the hybrid case. Recognising why a configuration that works in one model fails in the other is the key skill.

Candidates lose marks by treating Cloud Connected UC and a full cloud migration as interchangeable. The exam distinguishes them carefully, and items will test whether you know which features and which management capabilities are available at each stage of the journey from on-premises to cloud.

Security in Webex is not a single control but a layered architecture, and this topic tests whether you understand the architecture well enough to implement and defend it. At 10% of the exam, the items span three levels: the operational controls you configure for users and endpoints, the cloud security architecture that underpins the Webex platform, and the hybrid data security model that lets organisations keep encryption keys on-premises.

– Operational security controls

Security administration for Webex covers the controls available for meetings, messaging, endpoints, and compliance. Meeting security controls include lobby settings, recording permissions, and end-to-end encryption options. Endpoint security covers the certificate and authentication requirements for devices. Compliance controls include the legal hold and eDiscovery capabilities available through the compliance officer role in Control Hub.

The exam tests whether you know which control applies to which context and what its prerequisites are. A candidate who knows that end-to-end encryption exists but does not know the conditions under which it disables certain meeting features will lose marks on scenario items that describe a meeting environment where a feature is unexpectedly unavailable. The interaction between security settings and feature availability is the examinable detail, not the existence of the settings themselves.

– Webex cloud security architecture

The Webex cloud security architecture is built around five services: identity, key management, indexing, compliance, and content. The exam tests what each service does and, more importantly, how they interact to protect data in transit and at rest.

The identity service handles authentication tokens and trust relationships. The key management service generates and stores the encryption keys used to protect message and meeting content. The indexing service enables search without exposing plaintext content to the server. The compliance service provides the hooks that allow a compliance officer to access content for legal purposes. The content server stores the encrypted data. Items will describe a scenario involving one of these services behaving unexpectedly and ask you to identify the cause or the affected capability. Knowing the function of each service in isolation is not enough; knowing what breaks when one service is unavailable or misconfigured is what the exam rewards.

– Hybrid data security deployment

Hybrid data security is the deployment model in which an organisation runs the Webex key management service on its own infrastructure rather than using Cisco's cloud-hosted version. The exam tests the configuration of the hybrid data security node: where it is deployed, how it registers to the Webex cloud, and how the key management traffic flows between Webex clients and the on-premises node.

The critical exam knowledge here is what changes when hybrid data security is enabled and what does not. Not all Webex features are available in hybrid data security mode, and the exam will test whether you know the specific limitations. Candidates who understand hybrid data security as a concept but have not studied its operational constraints will be caught by items that describe a feature that stops working after hybrid data security is enabled and ask why.

How Security is tested

Security items in this exam are architecture-aware. The exam does not ask you to recall the name of a security feature; it asks you to reason about what happens when a security control is applied, removed, or misconfigured in a specific environment.

Architecture items on the five cloud security services reward knowing the role of each service in the data protection chain. Distractors will describe the function of a different service or a plausible but incorrect interaction between two services. The items are designed to catch candidates who have memorised the service names without understanding what each one actually does.

Hybrid data security items reward knowing the operational constraints of the deployment model. The trap is assuming that hybrid data security is a transparent overlay that changes only where keys are stored. It is not, and items will test the feature limitations directly.

Candidates lose marks most often by conflating Webex's end-to-end encryption option with the hybrid data security model. They are different things with different scopes and different implications.

The final topic asks a different kind of question. Where earlier topics tested configuration and troubleshooting depth, this one tests whether you can navigate the Webex developer ecosystem and construct API calls for the right resource type. At 10% of the exam, the scope covers the portals and tools available to developers, device-level programmability through macros, and the Webex REST API surface across messaging, meetings, calling, people, and events.

– Developer portals and device macros

App Hub, the Developer Portal, and the Room OS Portal serve distinct purposes, and the exam tests whether you know which one to use for a given task. App Hub is the marketplace for Webex integrations and bots. The Developer Portal is where you register applications, obtain access tokens, and find API documentation. The Room OS Portal is specific to Cisco room devices and provides access to device configuration, macros, and xAPI documentation.

Macros on Cisco room devices allow custom logic to run on the device itself, triggered by user actions or system events. The exam tests what macros can and cannot do: they can respond to button presses, modify the user interface, and call external services via HTTP, but they run in a sandboxed environment with specific constraints. Knowing the macro runtime's capabilities and its limits is more useful than knowing the JavaScript syntax, because the exam tests the architectural understanding rather than the code.

– Webex API construction

Constructing Webex API calls means knowing the resource types, the required parameters, and the authentication method for each. The five resource areas in scope are messaging, meetings, calling, people, and events. Each has its own endpoint structure and its own set of required versus optional parameters.

The exam tests construction, which means you need to know enough about each API resource to identify a correct or incorrect call. For messaging, the key parameters are the room ID and the message body. For meetings, the host email and the start time are required fields. For calling, the from and to numbers must be in E.164 format. People API calls use the person ID or email as the primary identifier. Events API calls retrieve audit records and require the correct scope on the access token.

Items reward knowing which parameter is required versus optional, and which authentication scope is needed for a given API call. The trap is selecting a call that looks syntactically plausible but uses the wrong resource endpoint or a scope that does not cover the requested operation.

How APIs and Programmability is tested

Items in this topic reward precision over breadth. You do not need to be a developer to pass these items, but you do need to know the Webex API surface at the level of resource types, required parameters, and authentication scopes.

Portal and macro items reward knowing which tool serves which purpose. Distractors will describe a task and offer portals or tools that are plausible but incorrect for that specific task. The Room OS Portal versus the Developer Portal distinction is the most common source of confusion.

API construction items reward knowing the difference between a valid and an invalid call for a specific resource. The exam does not ask you to write code, but it does ask you to identify what is wrong with a described API call, or which API resource to use for a described automation task. The scope of the access token is a frequent variable in these items, because many Webex API calls fail not because the endpoint is wrong but because the token lacks the required scope.

Candidates lose marks by treating all Webex APIs as interchangeable. Each resource area has specific requirements, and the exam exploits that specificity.