- CND is EC-Council's exam 312-38: 100 multiple-choice questions in a four-hour window.
- Passing cut scores range from 60% to 85% depending on the exam form you receive.
- Self-study eligibility costs $100 (nonrefundable) plus a $550 RPS voucher - $650 total before study materials.
- Endpoint Protection is the heaviest domain at 20%; three other domains carry 15% each.
What Is the CND Certification?
The Certified Network Defender (CND) credential is EC-Council's exam-based certification for professionals who build, monitor, and defend enterprise networks. It's validated through a single proctored exam, code 312-38, delivered through the ECC Exam Center or the EC-Council Exam Portal at an authorized testing center or via EC-Council's Remote Proctoring Services (RPS). Current official training is branded CND v3, but the certification exam itself is scored against the CND Exam Blueprint v4.0, published on EC-Council's certification site in April 2024.
That distinction matters. The blueprint's eight domains - not the training curriculum's twenty modules, and not the older Protect/Detect/Respond/Predict framework you may see referenced elsewhere - are what determine exam content weighting today. If you're mapping study time against anything else, you're studying against the wrong document. For a full breakdown of what "CND" means as a credential versus other unrelated acronyms sharing the same letters, see What Is CND? and CND Meaning.
Exam Format, Delivery, and Cost
The 312-38 exam consists of 100 multiple-choice questions with a four-hour time limit - roughly two-and-a-half minutes per question if you use the full window, though most candidates finish well before time expires. Passing isn't a fixed percentage across every candidate; EC-Council uses form-specific cut scores ranging from 60% to 85%, meaning the exact bar depends on which version of the exam you're assigned. For a deeper look at how that scoring model works in practice, read CND Passing Score 2026: Exactly What You Need to Pass.
On cost: candidates who qualify through the self-study/experience route pay a $100 nonrefundable eligibility-application fee plus a $550 RPS exam voucher, for a combined $650 before any study materials are purchased. That voucher is valid for one year from purchase. If you instead go through official training, the eligibility-application fee is already folded into the training price - you don't pay it separately. Standalone courseware (self-paced materials not bundled with official training) is a distinct purchase from both the training and the exam voucher, so budget for it separately if that's your path. A full pricing walkthrough, including how these pieces stack, is available in CND Certification Cost 2026: Complete Pricing Breakdown.
Key Takeaway
Know your eligibility route before you budget. Self-study candidates pay $650 upfront ($100 + $550); training candidates absorb the $100 into their course fee instead.
The Eight CND Exam Domains
Everything on the 312-38 exam maps to eight domains defined in the CND Exam Blueprint v4.0. Weighting is uneven - one domain carries double the weight of several others - so allocating study time by percentage, not by page count in a textbook, is the smart approach. For the complete topic-by-topic breakdown of each domain, see CND Exam Domains 2026: Complete Guide to All 8 Content Areas.
Domain 1: Network Defense Management (10%)
Covers governance-level concepts: security policy design, risk management processes, and how a defense program is structured and reported on.
- Security policy lifecycle and enforcement
- Risk assessment fundamentals
Domain 2: Network Perimeter Protection (10%)
Firewalls, IDS/IPS, and the architecture decisions that define where a network's trust boundaries sit.
- Firewall types and deployment topologies
- Intrusion detection/prevention placement
Domain 3: Endpoint Protection (20%) - the largest domain
The single heaviest domain on the exam, covering host-level hardening across operating systems, devices, and administrative controls.
- OS, mobile, and IoT device hardening
- Data encryption and administrative endpoint controls
Domain 4: Application and Data Protection (10%)
Focuses on securing the application layer and the data it processes, including data-loss prevention concepts.
- Application security principles
- Data classification and protection controls
Domain 5: Enterprise Virtual, Cloud, and Wireless Network Protection (15%)
A tied-for-second-largest domain spanning virtualization security, cloud service models, and wireless network defense - three environments in one domain.
- Virtual network and hypervisor security
- Cloud security shared-responsibility concepts
- Wireless encryption and access control
Domain 6: Incident Detection (10%)
Log management, monitoring, and the technical mechanics of spotting anomalous activity before it escalates.
- Log sources and correlation basics
- Indicators of compromise
Domain 7: Incident Response (10%)
What happens after detection: containment, forensic handoff, and recovery procedures.
- Incident response process steps
- Business continuity and disaster recovery tie-ins
Domain 8: Incident Prediction (15%)
Tied with Domain 5 for second-highest weight. Covers proactive threat intelligence, risk forecasting, and vulnerability management used to anticipate attacks.
- Threat intelligence sources and application
- Vulnerability and risk assessment methodology
| Domain | Weight |
|---|---|
| 1. Network Defense Management | 10% |
| 2. Network Perimeter Protection | 10% |
| 3. Endpoint Protection | 20% |
| 4. Application and Data Protection | 10% |
| 5. Enterprise Virtual, Cloud, and Wireless Network Protection | 15% |
| 6. Incident Detection | 10% |
| 7. Incident Response | 10% |
| 8. Incident Prediction | 15% |
Notice that Domains 3, 5, and 8 together account for half the exam's weight. If your prep time is limited, that's where marginal study hours pay off most. For a candid assessment of where candidates typically struggle across these domains, see How Hard Is the CND Exam? Complete Difficulty Guide 2026.
Eligibility and Registration Paths
There are two ways into the exam. The first is self-study eligibility: you submit an application documenting two years of information-security work experience, pay the $100 nonrefundable application fee, and - once approved - purchase the $550 RPS voucher separately. The second path is completing recognized official training, where the eligibility-application fee is already built into the course price, removing the separate $100 step.
Either way, the exam itself is identical: same 100 questions, same four-hour limit, same blueprint-based scoring. Training changes how you qualify to sit the exam, not what's tested. A detailed comparison of both routes, including documentation requirements, lives at CND Requirements 2026: Eligibility, Prerequisites & How to Qualify. If you're weighing formal coursework against self-study, CND Training covers what official CND v3 training actually includes.
Who Hires CND-Certified Professionals
CND is positioned as a defensive, hands-on-network-operations credential rather than a purely theoretical or purely offensive one. Employers hiring for network administration, SOC analyst, network security engineer, and network defense technician roles use it as evidence a candidate understands perimeter architecture, endpoint hardening, and incident handling from the defender's seat - not just the attacker's. Because the blueprint spans firewalls, cloud, wireless, and incident prediction in one exam, it signals breadth across a network security operations role rather than depth in one narrow specialty.
If you're evaluating whether the credential lines up with your career goals, CND Jobs walks through typical job titles and responsibilities tied to the certification, and CND Salary Guide 2026: Complete Earnings Analysis discusses earning expectations. For a broader return-on-investment view weighing cost against career payoff, see Is the CND Certification Worth It? Complete ROI Analysis 2026.
Preparing for the 312-38 Exam
Because the exam is 100 multiple-choice questions covering eight unevenly weighted domains, the most efficient prep sequences study time by domain weight rather than by chapter order in a textbook. A simple four-week structure built around the blueprint's weighting looks like this:
Heaviest domain first
- Endpoint Protection (20%) - OS hardening, device controls, encryption
- Build a quick-reference sheet of endpoint hardening checklists
The two 15% domains
- Enterprise Virtual, Cloud, and Wireless Network Protection
- Incident Prediction - threat intelligence and vulnerability assessment concepts
The four 10% domains
- Network Defense Management, Network Perimeter Protection
- Application and Data Protection, Incident Detection, Incident Response
Full-length practice and gap review
- Timed 100-question practice runs under the four-hour limit
- Revisit weak domains identified during practice
Spaced repetition on terminology (protocol names, device classifications, response frameworks) helps retention, but it's only useful if applied against the actual weighted domains above - generic flashcard decks not aligned to the blueprint waste time. For a structured, day-by-day plan and first-attempt strategy, see CND Study Guide 2026: How to Pass on Your First Attempt. A condensed one-page reference of must-know facts across all eight domains is available at CND Cheat Sheet 2026: One-Page Review of Must-Know Facts.
Running full-length, timed practice questions modeled on the real 100-question, four-hour format is one of the highest-leverage prep activities available - it's where our practice test platform is built to help, letting you rehearse domain-weighted question sets under realistic exam conditions before you spend the $550 voucher. You can also review outcome data and score patterns in CND Pass Rate 2026: What the Data Shows to calibrate how much practice is typically needed.
Maintaining Your CND Credential
Passing the exam isn't the end of the obligation. The certificate initially carries one-year validity, which is extended through annual fee payment combined with continuing-education compliance. Specifically, EC-Council requires 120 continuing-education (CE) credits per three-year cycle and an $80 annual continuing-education fee - totaling $240 across the three-year cycle. Skipping either the credits or the fee puts renewal at risk, so it's worth tracking CE activity from the day you certify rather than scrambling near the deadline.
Key Takeaway
Budget $80 every year after certifying, and log CE credits continuously - 120 credits over three years averages to 40 per year, which is far easier to hit gradually than in a last-minute push.
Frequently Asked Questions
The 312-38 exam has 100 multiple-choice questions with a four-hour time limit.
There isn't one fixed number - form-specific cut scores range from 60% to 85% depending on which exam version you receive. See CND Passing Score 2026 for details.
Self-study candidates pay a $100 nonrefundable eligibility-application fee plus a $550 RPS exam voucher, totaling $650 before study materials. Training candidates have the $100 fee built into their course price instead.
Endpoint Protection, at 20%, is the single largest domain. Enterprise Virtual, Cloud, and Wireless Network Protection and Incident Prediction follow at 15% each - together these three domains cover half the exam.
Under the self-study eligibility route, yes - two years of documented information-security work experience is required for application approval. Completing recognized official training is the alternative path.
You need 120 continuing-education credits per three-year cycle plus an $80 annual continuing-education fee ($240 total per cycle) to maintain the credential beyond its initial one-year validity.