312-38
Certified Network Defender (CND)
Certified Network Defender (CND) Exam Guide
The Certified Network Defender (CND) validates practical network-security knowledge across protection, detection, response, and prediction. EC-Council positions it for system and network administrators, with alignment to global and Department of Defense job roles. This guide helps you decide whether your current experience is ready for the CND exam, choose a training route, sequence hands-on study, and schedule the assessment without treating memorized questions as a substitute for defensive skills.
What the CND certification is designed to validate
CND is a vendor-neutral, hands-on, instructor-led network-security certification program. Its purpose is to develop defensive capability across the network lifecycle rather than focus on a single security product, vendor, or isolated attack technique. EC-Council describes the approach as protect, detect, respond, and predict.
The practical implication is that preparation should connect controls to operational decisions. You should be able to reason about how a network is exposed, which defensive control addresses the exposure, what evidence indicates an incident, how responders contain it, and how intelligence or risk analysis changes the next defensive action.
The certification is therefore a better fit for candidates who want structured network-defense coverage than for candidates seeking a narrowly specialized credential in one firewall, cloud platform, or monitoring product. Use the official course description to compare the program’s scope with the responsibilities you expect to perform.
The four-part defensive model
Protect concerns preventive safeguards and secure configurations. Detect concerns monitoring, traffic analysis, logging, and indicators of suspicious activity. Respond concerns incident handling and recovery actions. Predict concerns risk awareness, attack-surface analysis, and cyber-threat intelligence that inform earlier decisions.
Treat these as connected activities while studying. For example, a logging decision is not complete when logs are enabled; you should also consider what the logs reveal, how they support incident response, and whether the information changes your understanding of risk.
Who should consider taking CND
CND primarily serves system and network administrators who need a broader defensive-security framework. EC-Council states that the certification is mapped to global job roles and Department of Defense job roles for system and network administrators. Candidates moving toward network-defense, security-operations, or infrastructure-security work may also use the syllabus to identify knowledge gaps.
Your current title matters less than your day-to-day exposure. Experience with network services, operating systems, access controls, troubleshooting, or infrastructure changes gives you useful context for the labs and scenarios. If you have little networking or systems background, plan to learn those foundations before attempting to memorize security terminology.
A sensible readiness test is whether you can explain normal network behavior before analyzing abnormal behavior. If you cannot yet distinguish a routing failure from a suspicious connection, or an authentication problem from an account-compromise indicator, begin with networking and system administration fundamentals rather than jumping directly to practice questions.
When self-study may be appropriate
Self-study can suit an experienced administrator who can build or access a controlled lab, read the official outline critically, and maintain a regular study schedule. EC-Council states that self-study students must apply for eligibility before purchasing the CND exam voucher, so confirm that process before making an exam purchase.
A self-study plan should replace passive video watching with written explanations, configuration exercises, log interpretation, and incident-response drills. If you cannot verify whether your lab work is correct, instructor-led training or structured courseware may reduce uncertainty. That is a practical recommendation, not an additional official prerequisite.
When structured training may be the better choice
Structured training is more useful when you need accountability, have limited lab access, or are learning several security areas at once. EC-Council describes CND as lab-intensive, with more than 50% of the course containing hands-on labs, and its North America page describes more than 100 labs delivered on live target machines.
Do not select training solely because it promises speed. Ask whether the delivery format lets you repeat exercises, review mistakes, and connect each activity to the exam outline. The official training pages and current enrollment terms should be checked for availability, delivery conditions, and any changes before registration.
Which skills and topics belong in your study plan
The CND course outline contains 20 modules. The supplied official description identifies coverage including network attacks, perimeter security, endpoint security, cloud security, traffic and log monitoring, incident response, disaster recovery, risk management, attack-surface analysis, and cyber-threat intelligence. Use this breadth to build a coverage map before choosing study materials.
The outline is broad enough that a single-topic study strategy creates blind spots. A candidate who spends all preparation time on attacks may still be weak on recovery, monitoring, risk decisions, or endpoint controls. Conversely, reading definitions without configuring or examining anything will not reflect the program’s lab-intensive character.
Make a matrix with one row for each official module or topic grouping. Add columns for concept knowledge, hands-on evidence, scenario reasoning, and review status. Mark a topic as ready only when you can explain it and perform or interpret a related defensive task in a controlled environment.
Network and perimeter defense
Start with the network behaviors that defensive controls are intended to govern: addressing, routing, common services, segmentation, trust boundaries, remote access, and exposure at the perimeter. Then connect those behaviors to network attacks and perimeter-security controls.
Your notes should answer operational questions rather than list product features. What is the asset or trust boundary? What traffic is expected? Which control would reduce the exposure? What evidence would show that the control is working? These questions create reusable reasoning patterns across different vendor environments.
Endpoint, cloud, and infrastructure protection
Endpoint security and cloud security require you to think beyond the perimeter. Review identity, configuration, software, access, telemetry, and recovery considerations for systems that may be on-premises, remote, or hosted in cloud environments.
Avoid treating cloud security as a separate vocabulary exercise. Compare the responsibility for the operating system, network controls, identities, logs, and recovery data in each environment you study. The goal is to recognize which defensive decision belongs to the administrator, the service provider, or a shared operating model.
Monitoring, response, recovery, and intelligence
Traffic and log monitoring, incident response, disaster recovery, risk management, attack-surface analysis, and cyber-threat intelligence form the operational side of the syllabus. Study them as a sequence: establish normal activity, identify an indication, validate the event, contain the impact, restore dependable service, and use the findings to improve future decisions.
Create short scenario notes for each area. Record the evidence you would collect, the immediate action you would avoid, the escalation point, and the longer-term control change. This prevents a common mistake: choosing an action because it sounds forceful without considering evidence preservation, business impact, or recovery.
What the published exam details say
The current EC-Council North America CND page lists the exam as 100 questions with a four-hour duration. The page also states that the exam uses a cut-score range of 60% to 85%. Treat the cut score as an official exam detail, not as a target for careless preparation; the variable range means you should confirm the current terms for your testing context.
The supplied research does not provide a domain-by-domain percentage blueprint. Do not infer weights from the 20-module course outline, and do not compare bare percentages without official domain labels. Instead, give every module enough attention to demonstrate understanding, then use your own diagnostic results to decide where additional study time belongs.
The exam prefix listed by EC-Council is 312-38. Verify the current exam identification and registration information through the official CND page before scheduling, particularly if a training provider or voucher page uses different product wording.
How to interpret the cut-score information
A cut-score range of 60% to 85% does not mean that every candidate should plan around the lowest figure. It indicates that the published passing threshold can vary. Prepare for reliable performance across the blueprint rather than trying to calculate a guaranteed pass mark from unofficial practice results.
Use practice work diagnostically. When you miss a question, classify the reason: unfamiliar concept, incorrect interpretation of a scenario, confusion between controls, or careless reading. A score without this analysis tells you less than a smaller set of reviewed questions.
How the exam may fit into your scheduling decision
The official North America page lists 100 questions and four hours, while the voucher page describes the RPS option as an online exam remotely proctored by the RPS team. These are the evidenced details supplied for exam format and duration. Confirm the current delivery rules, regional availability, identification requirements, and technical conditions before booking.
The voucher page lists the RPS CND exam voucher at $550 and states that the voucher is non-transferable and valid for one year from its release date. Because purchase terms and availability can change, check the live official store listing before paying. A voucher purchase should follow an eligibility check and a realistic readiness review, not precede them.
The store also states that self-study students must apply for eligibility before purchasing the voucher. This is an official process requirement for that route. Candidates using a training provider should confirm whether the provider handles any part of eligibility or scheduling rather than assuming that enrollment alone authorizes the exam.
Remote-proctored exam planning
Remote delivery changes the preparation task from knowledge alone to knowledge plus administrative readiness. Review the official provider’s current instructions, check your equipment and connection under the permitted conditions, and resolve account or identity questions before the appointment window.
Do not treat a practice session as evidence that the live environment will be identical. The official source confirms remote proctoring for the RPS voucher, but the supplied facts do not establish every technical or room requirement. Follow the current instructions issued during registration.
A preparation sequence that matches the certification
Use a four-stage sequence: establish foundations, map the 20-module scope, perform defensive labs, and finish with timed scenario review. This order prevents two weak habits—trying to memorize unfamiliar terms at the end and using practice questions before you understand the underlying systems.
Keep a study log with three separate measures: topics read, tasks performed, and decisions explained. Reading completion is not the same as skill readiness. A topic should move to your final-review list only after you can describe its purpose, recognize relevant evidence, and explain a defensible next action.
Stage one: establish the technical baseline
Review the networking and systems knowledge needed to interpret security events. Focus on addressing and routing, common protocols and services, authentication, access control, operating-system behavior, basic packet and log concepts, and the difference between availability, integrity, confidentiality, and accountability.
This stage does not require learning every implementation detail. It requires enough fluency to ask useful questions about a defensive event. If a later lab uses a firewall rule, endpoint setting, cloud identity, or log entry, you should understand what the control changes and what normal behavior looks like.
Stage two: build the official topic map
Organize the official topics into study blocks that follow the work of a defender: attacks and exposure, perimeter and endpoint controls, cloud and infrastructure protection, monitoring, response and recovery, then risk and intelligence. Keep the original module names in your notes so you can trace each study block back to the official outline.
For every block, write a one-sentence purpose statement and list the practical artifacts you should be able to handle. Examples include a network diagram, a rule set, endpoint configuration, traffic sample, log set, incident timeline, recovery decision, risk statement, or threat-intelligence assessment. These are study aids, not claims about the exact exam content.
Stage three: turn labs into evidence
The official course is described as having more than 50% hands-on labs, and the North America page describes more than 100 labs on live target machines. Your preparation should therefore include deliberate practice, not only reading. Use authorized, isolated environments and document what you changed, what you observed, and how you would reverse the change.
Repeat important exercises after a delay. On the first attempt, follow the instructions. On the second, explain the purpose of each step before performing it. On the third, troubleshoot a controlled failure or interpret the resulting evidence. This approach builds understanding without relying on unauthorized exam material.
Stage four: consolidate with scenarios
In the final study phase, use scenario questions to test judgment across domains. Read the situation, identify the asset and risk, separate facts from assumptions, select the most appropriate immediate action, and then consider verification and follow-up.
Review every answer, including correct answers. A correct choice based on a wrong rationale is a future failure point. Keep an error register that records the misleading clue, the control or process you confused, and the rule you will use next time.
A practical six-week study roadmap
A six-week roadmap is a planning recommendation, not an EC-Council requirement. Adjust it to your experience, lab access, and available study time. The sequence matters more than the calendar: diagnose first, practice throughout, and reserve the final period for weak areas and exam administration.
At the beginning, record your baseline by reviewing the official outline and attempting representative knowledge checks from a legitimate study source. Do not use leaked questions or exam dumps. They cannot establish genuine defensive capability and may expose you to inaccurate or unauthorized material.
Week one: baseline and network fundamentals
Inventory your experience with networks, systems, monitoring, and incident handling. Review the foundational concepts that you use least often. Draw a simple environment showing users, endpoints, network zones, important services, administrative paths, and external connections.
End the week by explaining how a normal connection is established and what evidence might appear at different points in the path. If that explanation is uncertain, keep foundation review active during the following weeks instead of postponing it.
Week two: attacks, exposure, and perimeter controls
Study the official coverage of network attacks, perimeter security, and attack-surface analysis. Build a table connecting an exposure to an affected asset, likely evidence, a preventive control, and a detection opportunity.
Perform controlled configuration exercises involving segmentation, access rules, or service exposure where your lab permits them. Record both the intended effect and the unintended availability impact. Defensive decisions should account for service function, not only the desire to block traffic.
Week three: endpoint and cloud security
Work through endpoint and cloud-security concepts using environments you are authorized to manage. Compare identity, configuration, access, telemetry, and recovery responsibilities across local and hosted systems.
At the end of the week, write two short cases: one in which a control failure begins at an endpoint and one in which an identity or cloud configuration creates exposure. For each, identify what you would verify before containment.
Week four: monitoring and incident response
Practice reading traffic and log information as evidence. Start with expected activity, then identify anomalies, establish a timeline, and distinguish an indicator from proof of compromise. Move from observation to response only after stating what the evidence supports.
Use an incident worksheet with fields for scope, affected assets, evidence, containment, communication, eradication or remediation, recovery, and lessons learned. The worksheet forces you to consider process and sequencing rather than choosing an isolated technical action.
Week five: recovery, risk, and threat intelligence
Review disaster recovery, risk management, cyber-threat intelligence, and the relationship between current findings and future controls. Practice prioritizing actions when resources or time are limited.
For each scenario, state the business or operational consequence, the likelihood or uncertainty you are acknowledging, the control decision, and the information that would change your priority. Avoid presenting a risk label without explaining the evidence and decision behind it.
Week six: diagnose, repair, and schedule
Use mixed review to locate persistent weaknesses, then revisit the relevant lab or concept rather than simply repeating the same questions. Complete at least one realistic review session under the published four-hour exam duration if your preparation materials support that exercise; this is a pacing recommendation, not an additional exam rule.
Before scheduling, verify eligibility, voucher terms, delivery instructions, and the current official exam information. Schedule only when your readiness evidence is stable across the topic map, your lab notes show understanding, and your weak areas have a specific correction plan.
How to study labs without turning them into button memorization
A lab is valuable when you understand the security decision it represents. For every exercise, write the objective, starting condition, action, observable result, security meaning, and rollback method. If you cannot explain why a step matters, repeat the concept before moving to the next exercise.
More than 50% of the course is described as hands-on labs, so passive review is an inefficient primary method. Still, do not assume that completing a lab once proves mastery. Change one variable, predict the result, and test whether your interpretation remains correct.
Use only systems, traffic, accounts, and data you are authorized to handle. CND preparation should improve defensive practice, not encourage scanning or exploitation of third-party environments. The purpose of a controlled lab is to make cause and effect visible without creating real-world harm.
A lab record that supports revision
Keep one page or digital note per exercise. Include the relevant module, security objective, prerequisites, commands or settings in general terms, evidence collected, error encountered, and the lesson that transfers to another environment.
Separate vendor-specific syntax from the underlying principle. A particular command may change between platforms, while the reason for segmentation, logging, access restriction, or evidence preservation remains useful across implementations.
How to use practice questions responsibly
Practice questions should reveal reasoning gaps, not supply a script for reproducing the exam. Use them after studying a topic, answer without immediately checking the explanation, and write why the selected option best fits the stated facts.
Do not rely on exam dumps, leaked questions, or claims that memorization guarantees a pass. Such material can be inaccurate, unauthorized, and disconnected from the hands-on defensive skills the program emphasizes. Legitimate practice is most useful when it explains the underlying control, process, or trade-off.
When two answers appear plausible, identify the question’s priority: prevention, detection, immediate containment, recovery, risk reduction, or evidence preservation. Then check whether the answer is proportionate to the facts. This habit is more transferable than memorizing the position of an option.
The error register method
Record the question topic, your initial reasoning, the correct principle, and the clue you overlooked. Group repeated errors by concept rather than by question number. For example, several misses involving logs may point to a monitoring or evidence problem even when the scenarios use different technologies.
Review the register at the start and end of each study session. Remove an error only after you can explain the principle in a new scenario or demonstrate it in a lab.
Common preparation mistakes to avoid
The most damaging mistake is treating CND as a vocabulary test. The official description emphasizes a skills-based, lab-intensive program, so preparation should include configuration, observation, interpretation, and response reasoning. A glossary can support study, but it should not be the study plan.
Another mistake is over-specializing. Spending all available time on perimeter controls while ignoring endpoints, cloud security, monitoring, recovery, risk, and intelligence leaves gaps across the stated outline. Use your diagnostic results to prioritize, but maintain a minimum review pass over every official topic.
Candidates also schedule too early because they confuse course completion with readiness. Completion proves that material was presented; it does not prove that you can troubleshoot a control, interpret evidence, or choose the next action. Set a readiness checkpoint before purchasing or activating a voucher.
Finally, do not assume that a current price, delivery mode, validity period, training date, or exam detail will remain unchanged. Use the official store, course, and certification pages as the final authority before payment or scheduling.
A quick self-audit before booking
You are closer to scheduling when you can explain the protect, detect, respond, and predict model; trace each official topic to notes or a lab; interpret basic traffic and logs; describe an incident sequence; and identify where your confidence is still based only on recognition.
If any answer is no, turn that gap into a task with an observable result. “Study cloud security” is vague. “Compare identity and logging responsibilities in two authorized environments and explain the resulting monitoring decision” is actionable.
What to verify before you buy or schedule
Confirm the current exam identification, eligibility path, delivery option, duration, question count, cut-score information, voucher price, transfer rules, and validity terms directly with EC-Council. The supplied official pages provide these details for the referenced listings, but exam and store information is time-sensitive.
For the RPS voucher, the official store describes online delivery with remote proctoring, lists the price as $550, and states that the voucher is non-transferable and valid for a year from its release date. Treat those as listing-specific terms and recheck them before purchase.
If you are self-studying, complete the eligibility step before buying the voucher. If you are using training, ask the provider which actions remain your responsibility. Save confirmation messages, account details, and the current official instructions in one place so an administrative issue does not disrupt your study plan.
Questions worth asking a training provider
Ask which official course version and outline the training follows, how lab access works, whether exercises can be repeated, how eligibility is handled, and what support exists for scheduling. Also ask which claims are provider recommendations rather than EC-Council requirements.
Be cautious when a provider focuses on guaranteed outcomes, recalled exam content, or memorization packages. A credible preparation route should help you understand and perform defensive tasks, not imply access to live questions.
Planning beyond the initial certification
CND preparation can become a durable operating framework if you keep the lab notes, incident worksheets, and error register after the exam. Revisit them when your environment changes: new cloud services, altered trust boundaries, additional telemetry, or revised recovery priorities can all change defensive decisions.
The CND Candidate Handbook states that credential renewal requires updating the EC-Council Continuing Education credit account in the Aspen portal and submitting proof of earned credits for another three-year period. Confirm the current handbook and renewal process when planning maintenance of the credential.
Do not confuse renewal administration with ongoing competence. Continuing education may satisfy a credential process, while practical capability also depends on maintaining current systems knowledge, practicing authorized defensive work, and learning from real or simulated incidents. The former is an official requirement described in the handbook; the latter is a practical recommendation.
Your next actions
Begin with the official CND course outline and write a topic map covering all 20 modules. Mark your experience in networking, systems, monitoring, response, cloud, and recovery. Then select one controlled lab environment and one legitimate practice source that let you test reasoning rather than memorize answers.
Next, confirm whether you need the self-study eligibility process, review the current exam and voucher pages, and choose a scheduling window only after your diagnostic work identifies manageable gaps. Keep the official links available because delivery, pricing, and administrative terms can change.
The strongest final check is not a single impressive practice score. It is consistent performance across the stated subject areas, supported by lab notes that show what you did and why, plus a clear plan for handling uncertainty during the assessment.
Conclusion
CND preparation is most effective when it mirrors defensive work: understand the environment, protect it, detect meaningful change, respond in sequence, and use risk and intelligence to improve the next decision. Use EC-Council’s official requirements for eligibility, exam delivery, and voucher terms; use the 20-module outline to control coverage; and use labs and reviewed scenarios to test whether knowledge has become usable skill. Schedule when your evidence supports readiness, not when memorization merely feels familiar.
Related exams
- 312-50 exam — Certified Ethical Hacker Exam
- 312-75 exam — Certified EC-Council Instructor (CEI)
- 312-76 exam — Disaster Recovery Professional Practice Test
- EC0-350 exam — Ethical Hacking and Countermeasures V8