CND case studies
CND · Put your knowledge to work in context.
The Certified Network Defender (CND), exam code 312-38, is a vendor-neutral network security certification from EC-Council built around defensive, "blue team" work rather than offensive testing. Its framing is a continual/adaptive security cycle - protect, detect, respond, and predict - and it targets IT and systems administrators, network administrators, security analysts, and network engineers who need to configure and operate networks with a security-first mindset rather than just build connectivity. The CND case studies are 6 cases and about 4,512 words.
1Egress That Doesn't Add Up
At 02:40 on Tuesday, the IPFIX feed from your core switch shows host 10.20.14.87 - a finance analyst's laptop on a DHCP lease - moving 4.3 GB to an external address over TCP/443 in 32 minutes. The forward web proxy logged only 280 MB for that host all day.
776 words, about 4 min2The Vendor Split-Tunnel Request
A storage vendor needs remote access to 14 Windows servers in a segmented OT-support VLAN for a six-week firmware project. They propose an IPsec VPN with split tunnelling enabled, because their management agent streams telemetry to their own SaaS and 'the tunnel breaks it.' Your concentrator enforces MFA with push notifications; last quarter produced three push-fatigue incidents, one of which a help-desk analyst approved.
772 words, about 4 min3Sixty-Two Quarantines at Shift Change
Over 30 minutes your EDR console quarantines 62 of 4,100 endpoints for 'Suspicious PowerShell execution.' All 62 are running a scheduled task IT deployed two days ago: a signed maintenance script calling powershell.exe -enc. Detections are still firing.
749 words, about 4 min4Encrypted Backups, Eight-Hour RTO
Ransomware has encrypted 38 of 210 servers, including the server hosting the backup catalog. You have three recovery sources: nightly incrementals to an on-prem NAS; weekly fulls to tape, offsite, with four-day recall; and an object-storage bucket with 30-day immutability.
766 words, about 4 min5The Bucket That Wasn't Public
A GuardDuty finding flags an IAM access key used from an unfamiliar ASN, followed by 12,000 S3 GetObject calls in four minutes against the bucket holding customer statements. The key belongs to a CI/CD service account whose policy is AdministratorAccess; it was stored as a Jenkins credential, and two developers hold admin rights on that Jenkins instance.
908 words, about 5 min6The Wireless Guest VLAN That Wasn't
Users report intermittent slowness on the corporate WLAN in a branch office. Surveying the RF environment shows a rogue AP broadcasting the same SSID with a stronger signal in the east wing.
541 words, about 3 min