CND study guide
CND · Work through your exam, one topic at a time.
The Certified Network Defender (CND), exam code 312-38, is a vendor-neutral network security certification from EC-Council built around defensive, "blue team" work rather than offensive testing. Its framing is a continual/adaptive security cycle - protect, detect, respond, and predict - and it targets IT and systems administrators, network administrators, security analysts, and network engineers who need to configure and operate networks with a security-first mindset rather than just build connectivity. The CND study guide has 8 sections and about 3,122 words.
01Network Attacks and Defense Strategies
A candidate should be able to place any attack in two dimensions: the phase of the intrusion (reconnaissance, scanning/enumeration, exploitation, privilege escalation, lateral movement, persistence, exfiltration) and the security objective it violates (confidentiality, integrity, availability). Reconnaissance splits into passive (OSINT, whois, DNS lookups, sniffing) and active (port scanning, banner grabbing, enumeration).
304 words, about 2 min02Administrative and Technical Network Security
Administrative security is the paperwork and process layer: policies (management intent), standards (mandatory specifics such as AES-256), procedures (step-by-step), and guidelines (recommended). Supporting programs include security awareness training, acceptable use, BYOD, data classification, onboarding/offboarding, background checks, separation of duties, job rotation, and mandatory vacation.
279 words, about 1 min03Network Perimeter Security
Perimeter defense is built from firewalls, DMZs, ACLs, NAT, proxies, VPN gateways, IDS/IPS, honeypots, and bastion hosts. Firewall generations matter: packet-filtering (stateless, header-only), stateful inspection (tracks connection state), application proxy (breaks the client-server connection, deep inspection, slower), and NGFW (application identification, user awareness, IPS integration).
304 words, about 2 min04Endpoint Security (Windows, Linux, Mobile, IoT)
Core controls are Active Directory and Group Policy (precedence order Local, Site, Domain, OU - LSDOU), AppLocker or WDAC for application control, BitLocker for full-disk encryption, Windows Defender/Defender for Endpoint, LAPS for local admin password rotation, Windows Firewall, patch management (WSUS), and audit policy. Registry, service, and scheduled-task permissions are common privilege-escalation paths, so hardening means removing unnecessary rights, disabling legacy protocols such as SMBv1 and NTLMv1, and restricting local administrators.
290 words, about 1 min05Application and Data Security
Application security starts in the SDLC: threat modeling, secure coding standards, code review, SAST/DAST, and secure deployment. The recurring flaw families are injection (SQL, command, LDAP), broken authentication and session management, cross-site scripting (stored, reflected, DOM), cross-site request forgery, insecure direct object references and broken access control, security misconfiguration, sensitive data exposure, insecure deserialization, and vulnerable components.
326 words, about 2 min06Enterprise Virtual, Cloud, and Wireless Network Security
Know the hypervisor split: Type 1 (bare metal, e.g. ESXi/Hyper-V) versus Type 2 (hosted).
335 words, about 2 min07Network Traffic and Log Monitoring and Analysis
Monitoring depends on knowing what each source can and cannot tell you. Full packet capture (SPAN port or network TAP) gives payload and is the deepest but most storage-intensive option; flow records (NetFlow/IPFIX, sFlow) give metadata - source, destination, ports, bytes, timestamps - but no payload; logs (syslog, Windows Event Forwarding, application logs) give host and service context.
315 words, about 2 min08Incident Response, Forensics, Business Continuity, Risk and Threat Assessment
Use the six-phase model: Preparation (plan, playbooks, tools, training, tabletop exercises, contact lists, jump bag); Identification/Detection (triage, validation, scoping, severity classification); Containment (short-term isolation to stop spread, long-term segmentation until eradication); Eradication (remove malware, close the root cause, patch, reset credentials); Recovery (restore from known-good backups, verify, monitor closely); Lessons Learned (post-incident review, control gaps, playbook updates). Incident categories worth naming: malware/ransomware, phishing, unauthorized access, insider misuse, DoS, data leakage, web defacement, and policy violation.
969 words, about 5 min