- CND is EC-Council's Certified Network Defender, verified through exam code 312-38.
- The exam has 100 multiple-choice questions with a four-hour limit and a form-specific cut score of 60%-85%.
- Content is organized into eight domains from Exam Blueprint v4.0, with Endpoint Protection weighted heaviest at 20%.
- Self-study applicants pay a $100 eligibility fee plus a $550 RPS voucher, and must document two years of infosec experience.
What Is a CND, Exactly?
CND stands for Certified Network Defender, a credential issued by EC-Council and validated through the 312-38 examination. It's built for professionals who design, configure, monitor, and defend network infrastructure rather than for generalist security analysts or penetration testers. If you've landed here after searching "what is CND" or "CND meaning," the short answer is: it's a vendor-neutral, network-security-focused certification that proves a candidate can identify, harden, and respond to threats across an organization's network environment.
Because the acronym "CND" is shared by other unrelated credentials and government programs, it's worth being precise: everything in this article refers exclusively to EC-Council's Certified Network Defender. For a broader breakdown of the term itself, see our companion piece on CND Meaning and the related explainer What Does CND Stand For?
The 312-38 Exam: Format and Delivery
The CND certification exam carries the code 312-38 and consists of 100 multiple-choice questions, with a four-hour time limit. Unlike the hands-on lab work found in the associated training program, the certification exam itself is strictly multiple choice - there's no live lab or simulation component on test day.
Passing isn't a fixed number across every candidate. EC-Council uses form-specific cut scores that range from 60% to 85% depending on which exam form you're assigned, a psychometric practice meant to keep difficulty consistent across different question sets. That's a passing threshold, not a historical pass rate, and it's easy to confuse the two. If you want the full breakdown of how cut scores are calculated and what score you should actually target, read CND Passing Score 2026: Exactly What You Need to Pass.
You can sit the exam at an authorized testing center or remotely through EC-Council's Remote Proctoring Services (RPS), with both delivery paths routed through the ECC Exam Center or the EC-Council Exam Portal. There's no need to guess at scheduling logistics on your own - our guide to CND Exam Dates 2026: Testing Windows, Deadlines & Scheduling walks through how the booking process and voucher validity actually work.
Key Takeaway
The RPS exam voucher costs $550 and is valid for one year from purchase, so timing your eligibility application and study schedule around that window matters.
The Eight CND Exam Domains
CND's content is structured around eight domains defined in the CND Exam Blueprint v4.0, hosted by EC-Council in April 2024. It's worth noting these eight domains are distinct from the 20 modules taught in the CND v3 training course and from the older Protect/Detect/Respond/Predict framework you may see referenced elsewhere - the blueprint's domain structure is what the exam itself is built on.
Domain 1: Network Defense Management (10%)
Covers governance, security policy design, and the administrative foundations of a defensible network.
- Security policy frameworks and risk management basics
Domain 2: Network Perimeter Protection (10%)
Focuses on firewalls, IDS/IPS, and controlling traffic at the network edge.
- Perimeter device configuration and traffic filtering logic
Domain 3: Endpoint Protection (20%)
The single largest domain on the exam, covering hardening of workstations, servers, and mobile devices.
- OS hardening, endpoint hygiene, and device-level defense controls
Domain 4: Application and Data Protection (10%)
Addresses securing applications and data at rest and in transit.
- Data protection mechanisms and application-layer defenses
Domain 5: Enterprise Virtual, Cloud, and Wireless Network Protection (15%)
Covers virtualization security, cloud environments, and wireless network defense together as one weighted domain.
- Virtual/cloud infrastructure controls and wireless security configuration
Domain 6: Incident Detection (10%)
Focuses on monitoring, log analysis, and recognizing indicators of compromise.
- Detection tooling and log-based threat identification
Domain 7: Incident Response (10%)
Covers the operational steps taken once an incident is confirmed.
- Response procedures, containment, and escalation
Domain 8: Incident Prediction (15%)
Tied with Domain 5 as the second-highest weighted area, focused on proactive threat anticipation.
- Threat intelligence and predictive risk assessment
Because Endpoint Protection alone accounts for a fifth of the exam, and Domains 5 and 8 together add another 30%, more than half of your exam score rides on just three domains. For a deeper domain-by-domain study plan, see CND Exam Domains 2026: Complete Guide to All 8 Content Areas.
| Domain | Weight |
|---|---|
| Endpoint Protection | 20% |
| Enterprise Virtual, Cloud, and Wireless Network Protection | 15% |
| Incident Prediction | 15% |
| Network Defense Management | 10% |
| Network Perimeter Protection | 10% |
| Application and Data Protection | 10% |
| Incident Detection | 10% |
| Incident Response | 10% |
Eligibility Routes and What CND Costs
There are two ways to become eligible to sit for 312-38. The first is the self-study route, which requires documenting two years of information-security work experience and paying a nonrefundable $100 eligibility-application fee. Add the $550 RPS exam voucher, and self-study candidates are looking at $650 total before any preparation materials are purchased.
The second route is completing recognized official training, currently branded CND v3. The training's price already incorporates the eligibility-application fee, which simplifies the path for candidates who'd rather skip the experience-verification paperwork. It's worth noting that standalone courseware - study guides or materials purchased outside the official training program - is a separate purchase from both the training itself and the exam voucher, so don't assume one covers the other.
If you're unsure which eligibility path fits your background, our dedicated guide on CND Requirements 2026: Eligibility, Prerequisites & How to Qualify walks through the documentation EC-Council expects and how the training-based route differs in practice.
Who Hires CND Holders
CND is positioned for network administrators, network security engineers, and defensive-security practitioners whose job is to keep infrastructure running securely - not primarily for offensive-security roles like penetration testing. Because the domains span perimeter defense, endpoint hardening, cloud/wireless protection, and incident handling, the certification maps closely to job titles like network security administrator, network defense technician, and SOC-adjacent monitoring roles that lean on network-layer visibility.
If you're evaluating whether the credential lines up with your career goals, two resources are worth reading before you commit budget and study time: CND Jobs covers the kinds of roles employers associate with the certification, and CND Salary Guide 2026: Complete Earnings Analysis looks at how the credential factors into compensation conversations. For a broader cost-versus-benefit view, Is the CND Certification Worth It? Complete ROI Analysis 2026 weighs the certification against its total cost and maintenance requirements.
Keeping the Certification Active
Passing 312-38 isn't the end of the story. The CND certificate initially carries one-year validity, and staying certified means paying attention to two ongoing requirements: continuing education and annual fees.
- Continuing education: 120 CE credits are required per three-year cycle.
- Annual fee: $80 per year, which totals $240 across a full three-year cycle.
- Renewal mechanism: the certificate's validity is extended through a combination of annual fee payment and demonstrated CE compliance.
Skipping either the fee or the CE credits puts your certification status at risk, so it's worth building a light annual reminder into your calendar rather than scrambling near the renewal date.
Mapping Your Prep to the Blueprint
Generic study advice rarely accounts for how lopsided the CND domain weights actually are. Since Endpoint Protection alone is worth 20% and the two 15%-weighted domains (Enterprise Virtual/Cloud/Wireless Protection and Incident Prediction) bring the top three domains to half the exam, your study calendar should reflect that imbalance rather than splitting time evenly across all eight domains.
Endpoint Protection and Network Perimeter Protection
- Build strong fundamentals in endpoint hardening since it's the single heaviest domain
- Layer in perimeter device configuration alongside it, since the two domains reinforce each other conceptually
Enterprise Virtual, Cloud, and Wireless Network Protection
- Dedicate focused time here given its 15% weight and broad scope across three technology areas
Incident Detection, Response, and Prediction
- Study these three domains together since they form a logical incident-lifecycle sequence
- Prioritize Incident Prediction's proactive concepts given its 15% weight
Network Defense Management and Application/Data Protection
- Close out the lighter-weighted 10% domains with focused review sessions
Full-length practice and timing drills
- Practice pacing across 100 questions within the four-hour limit
- Review weak domains identified during practice attempts
For a structured, week-by-week study framework built specifically around this domain weighting, see the CND Study Guide 2026: How to Pass on Your First Attempt. And if you're trying to gauge realistically how difficult the exam is before committing to a timeline, How Hard Is the CND Exam? Complete Difficulty Guide 2026 and CND Pass Rate 2026: What the Data Shows are both worth reading early in your planning.
Between study sessions, keep a condensed reference nearby - our CND Cheat Sheet 2026: One-Page Review of Must-Know Facts is built for quick review passes rather than deep study, and pairs well with timed drills on the practice test site.
Frequently Asked Questions
CND stands for Certified Network Defender, a certification issued by EC-Council and validated through exam 312-38. It should not be confused with other credentials that share the same three-letter acronym.
The 312-38 exam has 100 multiple-choice questions, and candidates are given a four-hour time limit to complete it.
Passing cut scores are form-specific and range from 60% to 85%, depending on which exam form a candidate is assigned. This reflects difficulty calibration across forms, not a fixed pass rate.
Self-study candidates pay a $100 nonrefundable eligibility-application fee plus a $550 RPS exam voucher, totaling $650 before preparation materials. The official training route (CND v3) incorporates the eligibility fee into its training price instead.
Yes, if you choose the self-study eligibility route, you must document two years of information-security work experience. Candidates who complete recognized official training follow a different eligibility path that doesn't require this same documentation process.