CND
EC-Council Certified Network Defender (CND)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Certified Network Defender (CND), exam code 312-38, is a vendor-neutral network security certification from EC-Council built around defensive, "blue team" work rather than offensive testing. Its framing is a continual/adaptive security cycle - protect, detect, respond, and predict - and it targets IT and systems administrators, network administrators, security analysts, and network engineers who need to configure and operate networks with a security-first mindset rather than just build connectivity.
The exam is 100 multiple-choice questions delivered over 4 hours through the EC-Council exam portal. EC-Council states candidates need a passing score of 60% to 85%. Coverage is broad: attack techniques and defense-in-depth strategy, administrative controls such as policy and compliance, technical controls including access control, IAM and cryptography, perimeter devices (firewalls, IDS/IPS, routers, switches), endpoint hardening across Windows, Linux, mobile and IoT, application and data security, virtual, cloud and wireless security, network traffic and log monitoring, incident response and forensics, business continuity and disaster recovery, risk management, attack surface analysis, and cyber threat intelligence.
Preparation options include a 5-day instructor-led program, self-paced iLearn, live online iWeek, and in-person training partners. EC-Council describes over 100 labs on live target machines, with more than half the course delivered as hands-on practice - so lab time matters as much as reading.
What you'll study
About CND preparation
How long is the CND exam and how many questions does it have?
Exam 312-38 contains 100 multiple-choice questions and runs 4 hours, delivered through the EC-Council exam portal. That works out to roughly 2.4 minutes per question, so most candidates have time to read carefully and flag anything uncertain for review rather than rushing.
What score do I need to pass?
EC-Council states that candidates must obtain a passing score of 60% to 85%. The source does not explain why the range is expressed this way or how the cut score is set for a specific exam form, so treat it as a reported range rather than a fixed guarantee and confirm current scoring guidance with EC-Council before booking.
How much does CND training and certification cost?
EC-Council lists training at $1,699 for a single on-demand course, $2,499 for a single live online course, and $3,999 for unlimited on-demand courses. The standalone exam voucher fee and any retake pricing are not stated in the material reviewed, so check the official site for current exam costs.
Is CND hard? What level is it pitched at?
EC-Council describes CND as an intermediate-level professional program rather than an entry point. It expects fundamental knowledge of networking concepts to start, and it is genuinely broad - 20 modules spanning perimeter, endpoint, cloud, wireless, monitoring, incident response, risk, and threat intelligence - so shallow reading usually is not enough.
Do I need prerequisites or work experience before sitting it?
EC-Council's guidance says students should have at least fundamental knowledge of networking concepts, and its FAQ mentions an educational background in IT or cybersecurity plus working experience in the field. In practice, comfort with IP addressing, common protocols, and basic Windows and Linux administration makes the technical modules far easier.
What is the best order to study the CND domains?
Follow the module sequence: attacks and defense strategy first, then administrative and technical security, perimeter security, the four endpoint modules, application and data security, virtual/cloud/wireless, and finally monitoring, incident response, continuity, risk, attack surface, and threat intelligence. The later monitoring and response modules assume you already know what normal perimeter and endpoint configuration looks like.
How much hands-on lab work is involved?
EC-Council says the program includes over 100 labs delivered on live target machines, and that more than 50% of the course is hands-on. Labs cover tools such as pfSense, iptables, Suricata, Wazuh, Wireshark, tcpdump, and MDM and cloud IAM configurations. Candidates who skip labs often struggle with configuration-flavoured questions.
Where do candidates most often lose marks?
Three recurring weak spots: monitoring and log analysis, where candidates cannot map a symptom in Windows, Linux, firewall or web server logs to the right conclusion; perimeter device configuration and the difference between IDS and IPS behaviour; and incident response sequencing, including first-responder steps and RTO/RPO distinctions. These are the modules worth revisiting with labs.
How does CND compare with CCNA or Network+?
Per EC-Council, CND focuses on network security, is vendor-neutral, and teaches defending networks and operating environments with countermeasure strategies, while CCNA and Network+ focus mainly on networking with only basic security content. CCNA is Cisco vendor-specific; Network+ and CND are vendor-neutral. EC-Council notes this comparison reflects its own view.
What jobs does the certification prepare me for?
EC-Council lists roles including network administrator, network security administrator, network engineer, data security analyst, network security engineer, network defense technician, security analyst, security operator, and cybersecurity engineer. The source also states CND maps to DCWF (DoD 8140) work roles 511 Cyber Defense Analyst, 521 Cyber Defense Infrastructure Support Specialist, and 531 Cyber Defense Incident Responder.