EC-Council · CND
Certified Network Defender (CND) Practice Tests
Validates the ability to protect, detect, and respond to network security threats, covering network perimeter protection, endpoint security, firewall and IDS/VPN configuration, network traffic analysis, vulnerability scanning, and incident response.
Exam Details
Practice Questions
562
≈ 4 practice exams
Duration
240 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
Certified Network Defender (CND) Practice Exam Preparation
Use this CND practice exam to prepare for Certified Network Defender (CND) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 562 questions for EC-Council CND, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The EC-Council Certified Network Defender (CND) is a vendor-neutral, skills-based certification that validates a professional's ability to protect, detect, respond to, and predict network security threats. Exam code 312-38, the certification covers a broad range of network defense disciplines including network perimeter protection, endpoint security across Windows, Linux, mobile, and IoT platforms, firewall and IDS/VPN configuration, network traffic and log analysis, vulnerability scanning, and incident response. The program was updated with a v4 exam blueprint effective April 10, 2024, which introduced new topic segmentation and refreshed domain content while maintaining the same exam format and eligibility criteria.
Built on the cybersecurity education framework established by the National Initiative of Cybersecurity Education (NICE) and mapped to Department of Defense (DoD) work roles for system and network administrators, CND emphasizes real-world, job-task-aligned competencies. The certification spans 20 knowledge domains that collectively address the full lifecycle of enterprise network defense — from administrative governance and compliance to cloud security, wireless security, threat intelligence, and business continuity. It holds accreditation from ANSI, GCHQ, and is approved under the DoD 8570/8140 directive.
Who Should Take This Exam
CND is designed primarily for network and security professionals who are responsible for the day-to-day protection of enterprise network infrastructure. Core target roles include Network Administrators, Security Administrators, Network Security Engineers, Security Analysts, and Network Defense Technicians. The certification is also relevant to IT professionals transitioning into security-focused roles who already have a foundational understanding of networking.
The program is particularly well-suited for individuals working in environments requiring regulatory compliance or DoD-aligned security frameworks. Those seeking to formalize their hands-on network defense skills with a recognized credential, or professionals aiming to qualify for cybersecurity roles within U.S. government contractors and defense agencies, will find the CND especially applicable.
Prerequisites
EC-Council does not impose formal academic prerequisites for the CND exam, but candidates must meet one of two eligibility paths. The first is to complete an official EC-Council-authorized CND training course, after which candidates may sit for the exam without further application. The second path allows candidates to attempt the exam without attending official training, provided they can demonstrate at least two years of work experience in the information security domain. Self-study candidates must submit an eligibility application form along with a non-refundable $100 USD processing fee.
In terms of recommended knowledge, candidates should have a solid understanding of TCP/IP networking fundamentals, familiarity with common network devices and protocols, and basic exposure to operating system administration (Windows and Linux). Prior experience with network monitoring tools, firewall configuration, or security operations will provide a meaningful advantage when preparing for the exam.
Exam Format
The CND certification exam (312-38) consists of 100 multiple-choice questions and must be completed within 4 hours (240 minutes). The exam is delivered through the EC-Council ECC Exam Portal and is available at authorized testing centers as well as via online proctoring. The passing score is set at 70%, though EC-Council notes that cut scores can range from 60% to 85% depending on the specific exam form administered, as each form is independently calibrated by subject matter experts to ensure consistent difficulty across versions.
The exam uses multiple exam forms with varied question banks to maintain exam integrity. There are no unscored pilot questions disclosed. Candidates who do not pass may retake the exam immediately for the second attempt using an ECC Exam Center voucher; a 14-day waiting period is enforced starting from the third attempt onward. The current exam is aligned to the CND v4 blueprint, which became effective on April 10, 2024.
Skills Measured
- 1.Network Attacks and Defense Strategies: Covers the taxonomy of network attacks, attacker methodologies, and foundational principles of a defend-protect-detect-respond security approach.
- 2.Administrative Network Security: Covers regulatory compliance frameworks, security policy design and development, IT asset management, and security awareness training programs.
- 3.Technical Network Security: Covers access control principles, models, and terminologies, including redefining access control in distributed and hybrid network environments.
- 4.Network Perimeter Security: Covers configuration and management of firewalls, DMZs, routers, and other perimeter security appliances to control traffic entering and leaving the network.
- 5.Endpoint Security – Windows Systems: Covers hardening and securing Windows-based endpoints, including patch management, host-based firewall configuration, and system monitoring.
- 6.Endpoint Security – Linux Systems: Covers securing Linux environments, including privilege management, service hardening, and Linux-specific defensive configurations.
- 7.Endpoint Security – Mobile Devices: Covers mobile device management (MDM), BYOD policies, and securing Android and iOS devices within enterprise networks.
- 8.Endpoint Security – IoT Devices: Covers the unique security challenges of IoT device deployment, network segmentation for IoT, and mitigation of IoT-based attack vectors.
- 9.Administrative Application Security: Covers secure application deployment practices and administrative controls for managing application-layer security risks.
- 10.Data Security: Covers data classification, encryption, data loss prevention (DLP) strategies, and securing data at rest and in transit.
- 11.Enterprise Virtual Network Security: Covers securing virtualized infrastructure including hypervisor security, virtual switches, and software-defined networking (SDN) environments.
- 12.Enterprise Cloud Security: Covers cloud security models (IaaS, PaaS, SaaS), shared responsibility frameworks, and securing cloud-based network resources.
- 13.Enterprise Wireless Network Security: Covers wireless protocols, rogue access point detection, WPA3 configurations, and enterprise Wi-Fi security best practices.
- 14.Network Traffic Monitoring and Analysis: Covers packet capture, protocol analysis, signature-based and anomaly-based detection, and tools such as Wireshark for identifying malicious traffic.
- 15.Network Logs Monitoring and Analysis: Covers SIEM integration, log collection and correlation, and identifying indicators of compromise (IoCs) through log analysis.
- 16.Incident Response and Forensics Investigation: Covers the incident response lifecycle, containment and eradication procedures, evidence collection, and basic network forensics.
- 17.Business Continuity and Disaster Recovery: Covers BCP/DR planning, backup strategies, RTO/RPO objectives, and maintaining network availability during and after disruptions.
- 18.Risk Anticipation with Risk Management: Covers risk identification, assessment methodologies, risk treatment strategies, and integrating risk management into network security operations.
- 19.Threat Assessment with Attack Surface Analysis: Covers vulnerability scanning, attack surface mapping, penetration testing concepts, and prioritizing remediation of identified weaknesses.
- 20.Threat Prediction with Cyber Threat Intelligence: Covers threat intelligence types (tactical, operational, strategic), IoCs, Indicators of Attack (IoAs), threat hunting methodologies, and consuming intelligence feeds for proactive defense.
Study Tips
- Download and study the official CND v4 Exam Blueprint (available at cert.eccouncil.org) to understand the exact domain structure and ensure your preparation aligns with the April 2024 update — do not rely solely on v3 materials.
- Use the EC-Council CodeRed platform or authorized iClass training for hands-on labs, as the CND program is explicitly lab-intensive; passive reading alone is insufficient for mastering the practical skills tested.
- Focus dedicated time on the traffic analysis and log monitoring domains using free tools like Wireshark and Splunk's free tier, as these topics require tool-level familiarity that cannot be gained through theory alone.
- Map your study plan across all 20 domains systematically rather than focusing only on familiar topics — the 100-question format draws from all domains, and gaps in areas like IoT security or cloud network security can cost passing marks.
- Practice with EC-Council's official CND Assessment tool (eccouncil.org/train-certify/cnd-assessment/) to familiarize yourself with question style and identify weak areas before the exam.
- Review NIST SP 800-series publications relevant to network security (e.g., SP 800-41 for firewalls, SP 800-94 for IDS/IPS), as CND content is aligned to industry-standard frameworks and these documents reinforce the administrative and technical security domains.
- For the threat intelligence and incident response domains, study the MITRE ATT&CK framework alongside CND courseware — understanding attacker TTPs will help contextualize both the threat assessment and prediction modules.
Career Benefits
The CND certification qualifies holders for network defense and security operations roles in both private industry and government sectors. Common job titles pursued after earning CND include Network Security Engineer, Security Operations Center (SOC) Analyst, Network Administrator (security-focused), and Information Systems Security Officer (ISSO). The certification satisfies DoD 8570.01-M/DoD 8140 requirements for IAT Level II roles, making it directly applicable for personnel seeking positions with U.S. federal agencies or defense contractors. The average salary for a network security engineer in the United States is approximately $125,000 per year.
Compared to alternatives such as CompTIA Security+ (broader but less network-defense-specific) or the Cisco CyberOps Associate (more SOC-focused), CND occupies a distinct niche in hands-on, defender-oriented network security. It complements offensive certifications like CEH and is often pursued alongside or as a precursor to more advanced credentials such as CISSP or CCNP Security. The certification's ANSI accreditation and GCHQ endorsement give it international recognition beyond the U.S. market.
Sample Questions
5 sample questions with answers and explanations. The full bank has 562 questions, enough for 4 full-length practice exams.
Preview — answers shown1. A company implements RADIUS authentication for network access control on wireless access points and VPN concentrators. The security team needs to separate authentication, authorization, and accounting for granular control and compliance reporting. Which authentication protocol should they use instead of RADIUS? (Select one!)
AKerberos with Active Directory integration
BLDAP with SSL/TLS encryption
CTACACS+ with Cisco ACS server
D802.1X with EAP-TLS certificates
Explanation
TACACS+ provides separated authentication, authorization, and accounting (AAA) functions, unlike RADIUS which combines authentication and authorization. TACACS+ uses TCP for reliable delivery, encrypts the entire packet (not just passwords), and is ideal for device administration with per-command authorization. Kerberos provides authentication but not authorization or accounting separation. LDAP is a directory protocol, not an AAA protocol. 802.1X is a network access control framework that typically uses RADIUS as the backend AAA protocol.
2. An incident response team investigates a compromised Active Directory environment where attackers have maintained persistence for several weeks. Forensic analysis reveals the attackers forged Kerberos Ticket Granting Tickets with 10-year validity periods. Which attack technique was used and what is the complete remediation procedure? (Select one!)
ASilver Ticket attack; reset all service account passwords and revoke existing service tickets
BGolden Ticket attack; reset the KRBTGT account password twice with 10-hour intervals between resets
CPass-the-Hash attack; enable Credential Guard on all domain-joined systems
DKerberoasting attack; implement strong passwords for service accounts and enable AES encryption
Explanation
Golden Ticket attacks involve forging Ticket Granting Tickets by compromising the KRBTGT account hash, allowing attackers to create tickets with arbitrary validity periods and privileges. Complete remediation requires resetting the KRBTGT password twice with at least 10 hours between resets to ensure all existing tickets expire, as the domain controller maintains two password versions. Silver Ticket attacks forge service tickets for specific services, not TGTs, and require compromising individual service account hashes. Kerberoasting extracts and cracks service account passwords offline but does not involve ticket forgery. Pass-the-Hash attacks use NTLM hashes directly without involving Kerberos ticket manipulation.
3. An enterprise security team discovers that an attacker obtained a Kerberos TGT and is using it to access multiple services across the Active Directory domain without re-authenticating. The security team needs to invalidate all existing Kerberos tickets and prevent the attacker from continuing to use stolen credentials. Which action completely mitigates this Golden Ticket attack? (Select one!)
ADisable all user accounts and force password resets across the domain
BReset the KRBTGT account password twice with 10+ hour interval between resets
CReset the KRBTGT account password once and wait 24 hours for replication
DRestart all domain controllers and clear the Kerberos ticket cache
Explanation
Golden Ticket attacks involve forging Kerberos TGT tickets using the KRBTGT account hash which encrypts all TGTs. Resetting the KRBTGT password twice with 10+ hour interval is required because Active Directory maintains password history and the current plus previous password hash remain valid. The first reset invalidates the oldest hash, the waiting period allows replication across all domain controllers, and the second reset invalidates the original current hash. This ensures all forged tickets created with either hash become invalid. Resetting KRBTGT password only once leaves the previous password hash valid for ticket decryption, allowing attackers to continue using tickets forged with the old hash. Disabling user accounts does not invalidate TGT tickets which are already issued and valid until expiration typically 10 hours. Restarting domain controllers only clears cached tickets on those servers but does not invalidate tickets held by clients or attackers which remain valid until the KRBTGT password is reset twice.
4. A security team analyzes a suspected Golden Ticket attack where an attacker has compromised the KRBTGT account hash and forged Kerberos Ticket Granting Tickets with arbitrary privileges. To completely invalidate all existing Golden Tickets, what action must the domain administrator perform? (Select one!)
AReset the KRBTGT password twice with a 10-hour gap between resets
BDisable all compromised user accounts and force password changes
CReset the KRBTGT password once and wait 10 hours
DRestart all domain controllers simultaneously
Explanation
The KRBTGT account maintains two password versions in Active Directory to allow seamless key rotation. Resetting the password twice with at least a 10-hour gap ensures both the current and previous KRBTGT hash versions are changed, invalidating all existing Golden Tickets regardless of which hash was used. Resetting once only changes the current password, leaving tickets created with the previous version valid. Disabling user accounts does not invalidate forged tickets that grant arbitrary access. Restarting domain controllers does not change the KRBTGT hash that was compromised.
5. A security team investigates a potential Pass-the-Hash attack in a Windows Active Directory environment. Which combination of Windows Security Event IDs would indicate an attacker using stolen NTLM hashes to authenticate without knowing plaintext passwords? (Select one!)
AEvent ID 4672 followed by Event ID 4720 account creation
BEvent ID 4768 with encryption type RC4 followed by Event ID 4769
CEvent ID 4776 with authentication package NTLM followed by Event ID 4624 logon type 3
DEvent ID 4625 followed by Event ID 4740 account lockout
Explanation
Pass-the-Hash attacks use NTLM authentication rather than Kerberos. Event ID 4776 records NTLM authentication attempts showing the authentication package. Event ID 4624 with logon type 3 indicates a network logon, which is how Pass-the-Hash typically manifests when accessing resources. Event IDs 4768 and 4769 relate to Kerberos authentication, not NTLM-based attacks. Event ID 4625 with 4740 indicates failed login attempts and account lockout, suggesting password guessing rather than hash reuse. Event IDs 4672 and 4720 show privilege assignment and account creation, not authentication attacks.
More EC-Council Practice Exams
Certified EC-Council Instructor (CEI)
CEI · 611 questions
Computer Hacking Forensic Investigator (CHFI)
CHFI · 589 questions
Certified Cloud Security Engineer (CCSE)
CCSE · 624 questions
Certified Cybersecurity Technician (CCT)
CCT · 630 questions
Certified DevSecOps Engineer (ECDE)
ECDE · 609 questions
Digital Forensics Essentials (DFE)
DFE · 626 questions
$17.99
One-time access to this exam
562 questions (4 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available