CNDA study guide
CNDA · Work through your exam, one topic at a time.
The CNDA is a cybersecurity certification offered by Mile2 Cybersecurity Institute, a training and certification body based in Tampa, Florida. The credential sits in Mile2's certification catalog alongside its other role-based and foundational programs, and its subject matter is network defense: the practices and controls used to protect networks, hosts, and boundaries against intrusion, and to detect and respond when defenses are tested. Candidates who pursue it are typically security analysts, network or systems administrators, SOC staff, and IT professionals moving into a defensive security role, as well as students in academic programs that use Mile2 materials. Mile2 markets its certifications to individuals and to organizations, and publishes a role-based certification roadmap, detailed course outlines, learning material samples, exam prep guides, and cyber range labs that candidates can use to plan study. The CNDA study guide has 5 sections and about 2,324 words.
01Network Defense Fundamentals
This domain tests whether you can reason about defense as an engineering discipline rather than a product list. Expect questions on control classification, segmentation, trust boundaries, and how risk is expressed and reduced.
439 words, about 2 min02Perimeter and Boundary Defense
Questions here focus on what separates trusted from untrusted networks, and on the configuration details that decide whether a boundary actually holds: rule order, statefulness, DMZ design, remote access, and egress. Firewall generations differ.
484 words, about 2 min03Endpoint and Host Defense
This domain tests hardening and the telemetry endpoints produce. Expect items on baselines, patching, privilege, application control, and which event source would actually show a given behaviour.
441 words, about 2 min04Monitoring, Detection, and Analysis
This domain tests whether you can turn raw telemetry into a defensible conclusion: which source to consult, how to baseline, how to tune, and how to separate a true positive from noise. Coverage before alerting.
487 words, about 2 min05Incident Response and Defense in Depth
This domain tests the response lifecycle and the layering principle that keeps a single control failure from becoming a breach. Expect questions on phase ordering, evidence handling, containment choices, and which layer closes a gap.
473 words, about 2 min