- Exam 312-38 has 100 multiple-choice questions and a four-hour limit, delivered via ECC Exam Center or RPS.
- Self-study eligibility costs $650 total: a $100 nonrefundable application fee plus the $550 RPS exam voucher.
- Passing cut scores vary by form, from 60% to 85%, so there is no single fixed number to memorize.
- Endpoint Protection is the heaviest domain at 20%; three domains tie at 15% each.
Exam Format at a Glance
The Certified Network Defender credential is validated through EC-Council exam 312-38. It is a proctored, multiple-choice exam - not a lab-based practical - delivered through the ECC Exam Center or the EC-Council Exam Portal. You take it either at an authorized testing center or remotely through EC-Council's Remote Proctoring Services (RPS).
- Question count: 100 multiple-choice questions
- Time limit: four hours
- Delivery: ECC Exam Center / Exam Portal, onsite testing center or RPS
- Question format: multiple choice only - the hands-on labs live in the training, not on the graded exam
Because the exam itself is entirely multiple choice, your prep should emphasize scenario recognition and terminology precision over live tool manipulation. For a deeper breakdown of how difficult that four-hour window actually feels in practice, see How Hard Is the CND Exam? Complete Difficulty Guide 2026.
Fees and Eligibility Snapshot
Money and eligibility questions trip up more candidates than the domain content does. Here is the mechanic, stripped to numbers:
- RPS exam voucher: $550 USD, valid for one year from purchase
- Self-study eligibility-application fee: $100, nonrefundable
- Total for self-study route: $650 before you've spent a dollar on study material
- Work experience requirement: two years of documented information-security experience for eligibility-application approval
- Alternative route: completing recognized official training, whose price already incorporates the eligibility-application fee
Standalone courseware - study guides or video content sold separately - does not include the exam voucher or satisfy the eligibility-application fee on its own. Budget for these as separate line items. For the full pricing breakdown, including how the training route compares to the self-study route, read CND Certification Cost 2026: Complete Pricing Breakdown. If you're unsure which eligibility path applies to your background, CND Requirements 2026: Eligibility, Prerequisites & How to Qualify walks through both routes in detail.
Key Takeaway
If you're going self-study, plan for $650 minimum before courseware: $100 eligibility fee plus $550 exam voucher, and have your two years of experience documentation ready before you apply.
Passing Score Reality
EC-Council uses form-specific cut scores for 312-38, ranging from 60% to 85% depending on which exam form you receive. This is a passing threshold, not a published pass rate - the two numbers get confused constantly. A cut score tells you how many questions you need right on your specific form; it says nothing about how many candidates historically succeed.
Because the threshold moves with the form, don't fixate on hitting an exact percentage. Instead, aim to overprepare across all eight domains so you clear the upper end of that range comfortably. For the complete explanation of how cut scores are calculated and what they mean for your prep, see CND Passing Score 2026: Exactly What You Need to Pass. If you want context on how candidates actually perform against these thresholds, CND Pass Rate 2026: What the Data Shows covers what the available data shows.
The Eight Domains, Ranked by Weight
The certification exam maps to the CND Exam Blueprint v4.0, hosted on the official certification page since April 2024. This blueprint defines eight domains - a different structure from the 20 modules taught in CND v3 training, and different from the Protect/Detect/Respond/Predict framework you may see referenced elsewhere. Memorize the domain names below; they are what the exam blueprint actually uses.
Domain 3: Endpoint Protection - 20%
The single largest domain. Covers securing individual devices - workstations, mobile endpoints, servers - against compromise.
- Highest-yield domain for study time allocation
Domain 5: Enterprise Virtual, Cloud, and Wireless Network Protection - 15%
Spans virtualization security, cloud environment protections, and wireless network defense controls together in one domain.
- Tests breadth across three distinct technology areas
Domain 8: Incident Prediction - 15%
Focuses on proactive identification of threats before they escalate into incidents.
- Ties with Domain 5 for second-highest weight
Domains 1, 2, 4, 6, 7 - 10% each
Network Defense Management, Network Perimeter Protection, Application and Data Protection, Incident Detection, and Incident Response each carry equal weight at 10% apiece.
- Together these five domains still make up half the exam - don't neglect them just because no single one leads
Notice that Endpoint Protection, plus the two 15% domains, already account for half of the exam by themselves. That's a useful prioritization signal when your study time is limited. For a full walkthrough of every domain with example topics and subtopics, see CND Exam Domains 2026: Complete Guide to All 8 Content Areas.
Blueprint v4.0 vs. CND v3 Training
A common source of confusion: the current training program is branded CND v3, but the certification exam follows Exam Blueprint v4.0. These are not the same document, and they don't map one-to-one.
- CND v3 training is organized into 20 modules with hands-on labs.
- The exam blueprint condenses tested content into the eight domains listed above.
- Some training modules will map cleanly to a single domain; others will contribute pieces to multiple domains.
When you sit down to plan study time, plan against the blueprint's eight domains and their weights - not against the training's module count. The CND Study Guide 2026: How to Pass on Your First Attempt goes deeper into reconciling training content with the tested blueprint.
Who Hires CND-Certified Professionals
CND is a network-defense-focused credential, positioned toward defensive operations roles rather than offensive/red-team work. It's commonly relevant to network administrators moving into security-focused responsibilities, SOC analysts handling detection and response duties, and security operations roles centered on endpoint, perimeter, and cloud/wireless protection - the exact domain areas the exam tests.
Because the domain list spans management, perimeter defense, endpoints, applications, cloud/wireless environments, detection, response, and prediction, the certification signals broad defensive coverage rather than a single narrow specialty. If you're evaluating whether this breadth translates to opportunity in your market, CND Jobs looks at the roles that reference the credential, and CND Salary Guide 2026: Complete Earnings Analysis examines earnings context. For a broader cost-versus-benefit view before you commit the $650+, read Is the CND Certification Worth It? Complete ROI Analysis 2026.
One-Week Domain Priority Plan
If you only have a handful of weeks left before your test date, allocate study blocks proportionally to domain weight rather than evenly across all eight. Here's a compressed example using a single review week, front-loading the heaviest domains first.
Domain 3: Endpoint Protection (20%)
- Review endpoint hardening and protection concepts most heavily, since this domain alone carries the largest single weight on the blueprint.
Domain 5 & Domain 8 (15% each)
- Split the day between Enterprise Virtual, Cloud, and Wireless Network Protection and Incident Prediction, since together they equal Endpoint Protection's weight.
Domains 1, 2, 4, 6, 7 (10% each)
- Rotate through Network Defense Management, Network Perimeter Protection, Application and Data Protection, Incident Detection, and Incident Response - half a day per domain.
Full Review & Practice Questions
- Run timed practice sets covering all eight domains, mimicking the 100-question, four-hour format, then revisit your weakest domain from the results.
Practicing under real exam conditions matters as much as reviewing content. You can run timed, domain-weighted question sets on our practice test platform to see exactly where you stand before exam day.
Keeping the Certification Active
Passing 312-38 isn't the finish line - CND has ongoing maintenance requirements you should budget for from day one.
- Initial validity: one year from certification
- Continuing education requirement: 120 CE credits per three-year cycle
- Annual CE fee: $80 per year
- Total per three-year cycle: $240
- Renewal mechanic: validity is extended through annual fee payment combined with CE compliance
Factor this recurring $240-per-cycle cost into your total cost-of-ownership when comparing CND against other paths - it's separate from, and in addition to, your initial $650 (or training-route) exam cost.
Quick Reference Table
| Item | Detail |
|---|---|
| Exam code | 312-38 |
| Question count | 100 multiple choice |
| Time limit | 4 hours |
| Delivery | ECC Exam Center / RPS, authorized testing center |
| RPS voucher cost | $550 (valid 1 year) |
| Self-study eligibility fee | $100 (nonrefundable) |
| Total self-study route | $650 |
| Experience requirement | 2 years information security |
| Passing cut score | 60%-85%, form dependent |
| Training brand | CND v3 |
| Blueprint version | v4.0 (hosted April 2024) |
| Largest domain | Endpoint Protection, 20% |
| Certificate initial validity | 1 year |
| CE requirement | 120 credits / 3-year cycle |
| Annual CE fee | $80 ($240 per cycle) |
Keep this table bookmarked alongside your scheduling plan. For details on booking your actual test slot and managing voucher expiration timing, see CND Exam Dates 2026: Testing Windows, Deadlines & Scheduling. And if your training decision is still open, CND Training compares the official training route against standalone courseware and self-study.
FAQ
The 312-38 exam has 100 multiple-choice questions with a four-hour time limit, delivered through the ECC Exam Center, an authorized testing center, or EC-Council's Remote Proctoring Services.
Self-study applicants pay a $100 nonrefundable eligibility-application fee plus the $550 RPS exam voucher, for $650 total before any courseware costs. The official training route instead bundles the eligibility fee into its price.
Passing cut scores are form-specific and range from 60% to 85%. There is no single fixed passing number - your exact required score depends on which form you receive on test day.
Endpoint Protection carries the largest single weight at 20%. Enterprise Virtual, Cloud, and Wireless Network Protection and Incident Prediction follow at 15% each, so those three domains together make up half the exam.
Yes. The certificate initially has one-year validity, extended through annual fee payment and continuing-education compliance. Full maintenance requires 120 CE credits and an $80 annual fee, totaling $240 per three-year cycle.