EC-Council NDE Exam Guide: Domains, Format and Prep

What the NDE Covers#

EC-Council describes the NDE certification as verifying a candidate's knowledge and skills to protect their information assets. Candidates are introduced to computer and network security concepts such as network security controls, wireless network security, IoT security, cryptography and network traffic monitoring. The certification names the target audience directly: entry-level information security or cybersecurity careers, or people aspiring to pursue one.

That scope matters for how you study. The blueprint is a list of foundational topics across a wide range of areas, not a deep dive into any single product or technique. Your goal is to know every topic on the list well enough to recognize it, define it and tell it apart from the topics next to it.

Exam at a Glance#

Official exam documentation states that Essentials Series exams are fully proctored by EC-Council to maintain the integrity and fairness of the certification process. The exam is made available within the ECC Exam Center, which is EC-Council's own exam platform. Read the official exam policies before you book, because EC-Council reserves the right to revoke the status of candidates who do not follow them.

Two hours for 75 questions works out to about 96 seconds per question on average, a comfortable pace for a multiple-choice exam. That pacing comes straight from EC-Council's published numbers.

Who Should Take This Exam#

EC-Council's own materials describe the NDE as an introductory, foundational certificate and a stepping stone toward other entry-level certifications. It fits school students, career starters, career switchers and IT or cybersecurity professionals looking at entry-level roles. Official documentation states there are no eligibility criteria, so you do not need a previous certification or work history to register.

EC-Council also positions the NDE as the first step on a path. Official training documentation notes that the certification helps you progress to the Certified Network Defender (CND) and the Certified Cybersecurity Technician (CCT) programs and to the Certified Ethical Hacker (CEH). The Essentials Series itself consists of eight courses covering different technical foundations, and the NDE is the network-focused one.

Whether the NDE is the right first credential depends on the roles you are targeting. Read a few job postings in your area, and note which certifications they actually name. If they ask for an EC-Council certification, the NDE is a natural starting point. If they name a different vendor's entry-level certification, compare the two blueprints before you commit.

Domain-by-Domain Breakdown#

Official exam documentation lists these domain weights, which add up to 100%. The sub-domain lists are the topics the blueprint names for each domain.

Domain 1, Network Security Fundamentals (6%)#

6%

The blueprint lists two sub-domains: the fundamentals of network security and network security protocols. This is the smallest slice of the exam, but it supports everything after it. Make sure you can explain what the common security protocols do and where they sit in a network before you move on to the controls that build on them.

Domain 2, Identification, Authentication, and Authorization (8%)#

8%

This domain covers access control principles, terminologies and models, plus Identity and Access Management (IAM) concepts. Learn the vocabulary precisely. Identification, authentication and authorization are three separate steps, and the blueprint treats access control models as a topic of their own, so compare the models side by side rather than reading about each in isolation.

Domain 3, Network Security Controls, Administrative Controls (8%)#

8%

The blueprint names regulatory frameworks, laws and acts; designing and developing security policies; and conducting different types of security and awareness training. Administrative controls are the rules and processes around technology, so this domain rewards careful reading of definitions. Build a short glossary of the frameworks and policy types in your course materials and revisit it often.

Domain 4, Network Security Controls, Physical Controls (8%)#

8%

The four named topics are the importance of physical security, physical security controls, workplace security and environmental controls. A simple way to organize them is by purpose: what a control prevents, what it detects, and what protects equipment from its surroundings. Quiz yourself on which topic a given example belongs to.

Domain 5, Network Security Controls, Technical Controls (16%)#

16%

This is the largest domain on the blueprint, at twice the weight of most others. Its named topics are:

• Types of network segmentation
• Types of firewalls and their role
• Types of IDS/IPS and their role
• Types of honeypots
• Types of proxy servers and their benefits
• Fundamentals of VPNs and their importance in network security
• Security Incident and Event Management (SIEM)
• User Behavior Analytics (UBA)
• Antivirus and anti-malware software

Notice how many of these are "types of" topics. When a topic is phrased that way, you should compare the types and know what each one is for. Because this domain carries the most weight, give it the largest share of your study time, and use the other domains to round out your coverage.

Domain 6, Virtualization and Cloud Computing (8%)#

8%

The blueprint lists virtualization essential concepts and OS virtualization security, cloud computing fundamentals, and insights into cloud security and best practices. Treat it as two halves: how virtualization works and what risks it introduces, then how cloud services are delivered and secured.

Domain 7, Wireless Network Security (8%)#

8%

Four topics: wireless network fundamentals, wireless network encryption mechanisms, types of wireless network authentication methods, and implementing wireless network security measures. Study the encryption mechanisms and authentication methods as a pair, because the blueprint lists them separately and a question can target either.

Domain 8, Mobile Device Security (8%)#

8%

The blueprint names mobile device connection methods, mobile device management concepts, common mobile usage policies in enterprises, the security risks and guidelines associated with those policies, enterprise-level mobile security management solutions, and general security guidelines and best practices on mobile platforms. This is a policy-heavy domain, so connect each risk to the policy or management control that addresses it.

Domain 9, IoT Device Security (8%)#

8%

Two named topics: IoT devices, application areas and communication models, and security in IoT-enabled environments. Learn what the communication models are and which kinds of devices fall into which application areas, then study the security measures for each environment the course materials describe.

Domain 10, Cryptography and PKI (8%)#

8%

The blueprint covers cryptographic techniques, cryptographic algorithms, cryptography tools and Public Key Infrastructure (PKI). Algorithms are a place where precise recall pays off: know which algorithms are symmetric and which are asymmetric, what each is used for, and how the pieces of a PKI relate to each other.

Domain 11, Data Security (8%)#

8%

Four topics: data security and its importance, security controls for data encryption, data backup and retention, and data loss prevention concepts. Link this domain to Domain 10, since the encryption controls here rely on the algorithms you studied there.

Domain 12, Network Traffic Monitoring (6%)#

6%

The blueprint lists the need and advantages of network traffic monitoring, determining baseline traffic signatures for normal and suspicious network traffic, and performing network monitoring for suspicious traffic. The idea running through all three is the baseline: you can only call traffic suspicious if you know what normal looks like.

How to Prepare#

Start with the official blueprint. EC-Council publishes the NDEv1 Exam Blueprint as a three-page PDF. Use it as your checklist and mark each sub-domain once you can explain it without notes. Since every domain except Technical Controls is 6% or 8%, there is no domain you can safely skip.

Use the official course if you want guided material. EC-Council's NDE course offering costs $299. Official training documentation states it includes:

• 1,100+ pages of eCourseware
• 33 lab activities in a simulated lab environment
• A CTF-style capstone project with real-world CTF challenges
• 1-year access to the eCourseware and 6-month access to the labs
• A proctored exam voucher with 1-year validity

Practice with questions. The NDE practice question bank at CertCompanion covers the 12 domains with an explanation for each answer. Start with the 30 free questions to see which domains need work, then revisit your weak domains first. This is our practice content, not an EC-Council product, so treat it as a way to test recall and not as a description of the live exam.

Keep these official resources open:

• Official exam certification information for exam details and renewal
• The official exam blueprint for the domain and topic list
• Official exam policies, so you know your options before you book
• The EC-Council exam catalog on our provider hub, if you are comparing NDE with other EC-Council credentials

What Trips Candidates Up#

Treating all domains as equal. Technical Controls is 16% while Network Security Fundamentals and Network Traffic Monitoring are 6% each. Spread your time in proportion to the weights, not evenly.

Memorizing a topic without its neighbors. Many blueprint items are "types of" something. If you can name a firewall type but cannot say how it differs from another, you are only half prepared. Build comparison notes.

Skipping the lowest-weight domains. At 6% each, Domains 1 and 12 are small, but together they make up 12% of the exam. That is a lot of points to give away.

Leaving the proctoring setup to the last minute. The exam runs in the ECC Exam Center under EC-Council proctoring. Read the official exam policies and check the technical requirements well before your booking, so that a setup problem does not cost you an attempt.

Ignoring cross-domain links. Cryptography (Domain 10) underpins data security (Domain 11) and wireless encryption (Domain 7). A question can touch two domains at once, and studying them together makes recall easier.

A Worked Example#

A good way to use practice questions is to treat each one as a test of a blueprint topic. After you answer, name the domain it belongs to, then explain why each wrong option is wrong. The question below sits in Domain 5, Network Security Controls: Technical Controls, under the topic of firewall types and network segmentation.

A security architect designs a network placing web servers in a separate network segment between two packet-filtering routers. The exterior router connects to the internet while the interior router connects to the internal corporate network. This architecture creates an isolated zone for public-facing services. Which firewall architecture has been implemented? (Select one!)

• A. Screened subnet architecture with DMZ isolation
• B. Three-legged firewall with separate interfaces
• C. Dual-homed firewall with two network interfaces
• D. Bastion host with hardened single system

Show the answer and the reasoning

Correct answer: A. Screened subnet architecture with DMZ isolation

Screened subnet architecture uses two routers creating a demilitarized zone between them where public-facing servers reside isolated from both the internet and internal network, providing defense in depth through multiple filtering points. Dual-homed firewalls use a single device with two network interfaces where all traffic passes through one firewall rather than using two separate routers. Bastion hosts are single hardened systems exposed to untrusted networks but do not inherently create the multi-router segmented architecture described. Three-legged firewalls use a single firewall device with three interfaces for internet, DMZ, and internal connections rather than two separate routers.

The point of the exercise is the method: identify the domain, read the requirement in the question, and eliminate options that fail it. The same approach works for every domain on the blueprint.

Exam Day and Retakes#

You book the exam through EC-Council's ECC Exam Center. The exam is proctored, so plan for a quiet, suitable environment and follow the instructions EC-Council gives you when you schedule.

EC-Council's retake policy is published in its official exam documentation:

• If you do not pass on the first attempt, no waiting period is required before the first retake
• Before the third, fourth and fifth attempts, a 14-day waiting period applies after each failed attempt
• You cannot take a given exam more than five times in a 12-month period, and a 12-month waiting period applies before a sixth attempt
• Candidates who pass cannot attempt the same version of the exam again
• Retake vouchers can be bought at a discounted price from the ECC Exam Center

EC-Council also strongly advises candidates who fail a third time to attend official hands-on training that covers the certification objectives.

After You Pass#

Your NDE certification is valid for three years from the date you pass. Official documentation states that members may recertify by passing the NDE exam again. EC-Council states that there are no continuing education fees and no continuing education credits required to maintain the credential during the three-year term, and that the NDE is not part of its Continuing Education Scheme.

For next steps, EC-Council points to the Certified Network Defender (CND) for deeper network security skills and to the Certified Ethical Hacker (CEH) for ethical hacking, with the Certified Cybersecurity Technician (CCT) as another progression named alongside them. Check each program's current prerequisites and exam details in official EC-Council documentation before you plan your path.

Frequently Asked Questions#

How many questions are on the NDE exam? 75 multiple-choice questions, with a 2-hour time limit and a 70% passing score, per official exam documentation.

What are the NDE exam domains? The official blueprint has 12 domains: Network Security Fundamentals (6%), Identification, Authentication, and Authorization (8%), Administrative Controls (8%), Physical Controls (8%), Technical Controls (16%), Virtualization and Cloud Computing (8%), Wireless Network Security (8%), Mobile Device Security (8%), IoT Device Security (8%), Cryptography and PKI (8%), Data Security (8%), and Network Traffic Monitoring (6%).

Are there prerequisites for the NDE? No. Official documentation states there are no eligibility criteria for the NDE program.

Does the NDE expire? The certification is valid for three years from the date you pass. To recertify, you pass the NDE exam again. No continuing education fees or credits are needed during the three-year term.

What is the NDE retake policy? No waiting period before the first retake. A 14-day wait applies before each of the next three attempts, and you may not take the exam more than five times in a 12-month period.

How much does the NDE cost? EC-Council's course offering is $299 and includes eCourseware, labs and a proctored exam voucher valid for one year. Check official EC-Council documentation for current pricing before you buy.

Is the NDE exam proctored? Yes. Official documentation states that Essentials Series exams are fully proctored by EC-Council, and the NDE exam is available within the ECC Exam Center.

What can I take after the NDE? Official EC-Council training documentation names the Certified Network Defender (CND), the Certified Cybersecurity Technician (CCT) and the Certified Ethical Hacker (CEH) as progression options.

The NDE is a broad, foundational exam with a published blueprint. Use the official domain weights to plan your time, give Technical Controls the most attention, and test each domain with practice questions before you book.

Start with 30 free practice questions and see which domains need work: CertCompanion NDE practice questions.

Checked against official EC-Council NDE exam documentation and current candidate reports. Last verified 2026-11-01.