eCDFP study guide
eCDFP · Work through your exam, one topic at a time.
The eCDFP (Certified Defense Fundamentals Professional) is a defensive-security certification listed by INE among its cybersecurity certifications. It sits alongside INE's offensive and specialist credentials, and the certification family it belongs to emphasizes hands-on, scenario-based practice rather than pure multiple-choice recall: INE describes its model as "learn by doing" with immersive labs built to resemble real working conditions. The eCDFP study guide has 5 sections and about 2,429 words.
01Defensive Security Fundamentals
Defensive Security Fundamentals is the vocabulary layer of the eCDFP. It tests whether you can reason about controls, risk and adversary models instead of reciting product names.
526 words, about 3 min02Network Defense and Traffic Analysis
This domain tests whether you can read packets and flow records, understand normal protocol behaviour and spot malicious patterns in pcaps, Zeek logs and NetFlow. Questions typically give you a capture or log excerpt and ask what the traffic proves.
488 words, about 2 min03Endpoint and Host Defense
This domain tests host-level visibility: which Windows, Linux and EDR artefacts record an action, what each event ID means, and how parent-child process lineage turns a single alert into a confirmed intrusion. 4624 successful logon with Logon Type 2 interactive, 3 network, 5 service, 10 RDP.
437 words, about 2 min04Log Analysis and Detection
This domain tests whether you can turn raw log sources into a defensible detection: choose the right telemetry, normalise fields, apply time correctly, and tune logic so it fires on attacks rather than on routine administration. Syslog severity runs 0 (emergency) to 7 (debug).
507 words, about 3 min05Incident Response and Threat Hunting
This domain tests process discipline under pressure: following the incident response lifecycle, preserving evidence in volatility order, and running hypothesis-driven hunts that end in a standing detection rather than a one-off answer. Lifecycle (NIST SP 800-61): Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity.
471 words, about 2 min