CNCDP study guide
CNCDP · Work through your exam, one topic at a time.
The Certified Network and Cyber Defense Professional (CNCDP) is an independent, vendor-neutral credential aimed at practitioners who defend networks rather than build them: SOC analysts moving beyond tier-one triage, network security engineers, incident responders, and threat hunters. It tests whether you can reason across the whole defensive lifecycle, from architecture decisions and threat intelligence through vulnerability management, detection engineering, incident handling, forensics, hunting, and the governance context that constrains all of it. The CNCDP study guide has 8 sections and about 3,957 words.
01Network Security Architecture and Design
This domain tests whether you can convert business and threat requirements into a layered topology and justify every control placement. Items typically hand you a scenario - a public web application, a branch office, an OT plant - and ask which design preserves least privilege and defense in depth without breaking availability.
533 words, about 3 min02Threat Landscape and Threat Intelligence
This domain tests whether you can characterize adversaries and turn raw indicators into decisions. Expect items on actor types, intelligence levels, analytic frameworks, sharing standards, and the difference between an indicator sweep and behavior-based detection.
468 words, about 2 min03Vulnerability Assessment and Management
This domain tests the full loop: discover assets, scan them safely, score and contextualize findings, prioritize against real exploitation, remediate, and verify. Questions frequently hinge on why raw scanner severity is the wrong sole sorting key.
473 words, about 2 min04Security Monitoring, Detection, and Analysis
This domain tests whether you can build a detection pipeline and reason from evidence. Items ask which telemetry proves an activity, why an alert is noisy, or how to distinguish a benign anomaly from an intrusion.
469 words, about 2 min05Incident Response and Handling
This domain tests the lifecycle and the judgment calls inside it: what to do first, what not to destroy, who to notify, and how to prove the incident is closed. Expect scenario items where a plausible-sounding action (pulling the power cord) is the wrong answer.
495 words, about 2 min06Digital Forensics and Evidence Handling
This domain tests whether your collection and analysis would survive scrutiny in a hearing. Items ask what to capture first, how to prove integrity, and which artifact answers a question such as "was this file executed?" Order of volatility (RFC 3227): CPU registers and cache → memory → network state (ARP cache, connections, routing) → running processes → disk → remote logs and monitoring data → backups and archival media.
496 words, about 2 min07Cyber Defense Operations and Threat Hunting
This domain tests proactive defense: how hunts are framed, executed and converted into durable detection, and how deception and adversary emulation sharpen a defensive program. Items distinguish hunting from alert triage and from IOC sweeps.
487 words, about 2 min08Governance, Risk, and Compliance
This domain tests whether you can connect security activity to business risk, choose the right framework for the question, and evidence compliance. Items often ask which framework, which risk treatment, or which policy tier a given statement belongs to.
536 words, about 3 min