- What Is CND, Exactly?
- Who Issues the CND and What Exam Do You Take?
- The 8 CND Exam Domains
- Exam Format, Passing Score, and What to Expect
- Eligibility Routes and What CND Actually Costs
- Who Hires CND-Certified Professionals?
- Keeping the Certification Active
- How to Approach Preparation by Domain
- Frequently Asked Questions
- CND is EC-Council's Certified Network Defender, tested through exam 312-38, not any other credential sharing the same initials.
- The exam has 100 multiple-choice questions with a four-hour limit and form-specific cut scores between 60% and 85%.
- Eight blueprint domains govern the exam; Endpoint Protection is weighted heaviest at 20%.
- Self-study candidates pay a $100 eligibility fee plus a $550 RPS exam voucher, totaling $650 before any study materials.
What Is CND, Exactly?
CND stands for Certified Network Defender, a vendor-neutral network security certification developed and administered by EC-Council. If you've searched What Is CND?, CND Meaning, or What Does CND Stand For?, this is the credential this site covers: a defensive, hands-on-oriented certification built for people who protect networks rather than attack them for a living.
It's worth being precise here because "CND" is an overloaded acronym across the security and IT world, and other organizations use the same three letters for unrelated things. This article, and everything else on CND Exam Prep, refers exclusively to EC-Council's Certified Network Defender program, tied to exam code 312-38. If you land on a page anywhere online that mixes in unrelated exam fees, dates, or domain breakdowns under the "CND" label, verify it's actually this certification before trusting the numbers.
Who Issues the CND and What Exam Do You Take?
EC-Council - the same organization behind several well-known offensive and defensive security certifications - owns and issues CND. The certifying exam is 312-38, delivered through the ECC Exam Center (EC-Council's exam portal). You can sit for it at an authorized testing center or remotely through EC-Council Remote Proctoring Services (RPS).
The training associated with the credential is currently branded CND v3, but the certification page links to a separate CND Exam Blueprint v4.0, published in April 2024. That distinction matters: the blueprint's domain structure - not the 20 modules taught in the official course, and not any "Protect/Detect/Respond/Predict" framework you might see referenced elsewhere - is what actually governs exam content. If you're mapping your study plan, always anchor it to the blueprint domains covered in the next section, detailed further in the CND Exam Domains 2026: Complete Guide to All 8 Content Areas.
The 8 CND Exam Domains
The 312-38 exam is organized into eight domains per the v4.0 blueprint, each carrying a different weight. Understanding these weights is the single most useful thing you can do before opening a study guide, because it tells you where to spend your limited prep time.
Domain 3: Endpoint Protection - 20%
The single largest domain on the exam. Candidates need solid command of endpoint hardening, host-based defenses, and the controls that protect individual devices connecting to the network.
- Highest point value of any domain - prioritize accordingly
Domain 5: Enterprise Virtual, Cloud, and Wireless Network Protection - 15%
Covers securing virtualized infrastructure, cloud environments, and wireless networks as extensions of the enterprise perimeter.
- Tied for second-highest weight on the blueprint
Domain 8: Incident Prediction - 15%
Focuses on proactive identification of risk before an incident occurs, distinct from the reactive work covered in the detection and response domains.
- Equal weight to Domain 5 - don't underestimate this one
| Domain | Weight |
|---|---|
| 1. Network Defense Management | 10% |
| 2. Network Perimeter Protection | 10% |
| 3. Endpoint Protection | 20% |
| 4. Application and Data Protection | 10% |
| 5. Enterprise Virtual, Cloud, and Wireless Network Protection | 15% |
| 6. Incident Detection | 10% |
| 7. Incident Response | 10% |
| 8. Incident Prediction | 15% |
Notice that four domains sit at 10% each, while three domains (Endpoint Protection, Enterprise Virtual/Cloud/Wireless, and Incident Prediction) together account for half the exam. A well-structured study plan - like the one laid out in the CND Study Guide 2026: How to Pass on Your First Attempt - should reflect this imbalance rather than treating all eight domains equally.
Key Takeaway
Three domains - Endpoint Protection, Enterprise Virtual/Cloud/Wireless Network Protection, and Incident Prediction - make up 50% of the exam. Weight your review time to match.
Exam Format, Passing Score, and What to Expect
The 312-38 exam consists of 100 multiple-choice questions with a four-hour time limit. That's roughly 2.4 minutes per question on average, though question difficulty within the pool varies, so pacing shouldn't be rigid - some scenario-based questions take longer to parse than straightforward recall items.
Passing cut scores are not fixed at a single number. EC-Council uses form-specific cut scores that range from 60% to 85% depending on which exam form you're issued. This is a passing threshold, not a pass rate - the two get confused constantly. If you want the full breakdown of what this variability means for your prep strategy, see the CND Passing Score 2026: Exactly What You Need to Pass and the separate discussion in the CND Pass Rate 2026: What the Data Shows.
It's also worth separating two things that get conflated: the certification exam itself is entirely multiple choice, while the official CND v3 training includes hands-on labs. The labs build the practical skills; the exam tests your knowledge of the concepts behind them. Neither one substitutes for the other, and candidates who skip the conceptual review because they've done the labs (or vice versa) often get surprised by exam question phrasing.
For a deeper look at how difficult candidates actually find this format in practice, read How Hard Is the CND Exam? Complete Difficulty Guide 2026.
Eligibility Routes and What CND Actually Costs
There are two paths to sitting for the 312-38 exam, and the cost mechanics differ meaningfully between them.
Self-Study Eligibility Route
If you're not taking official training, you apply directly for exam eligibility. This requires documenting two years of information-security work experience for EC-Council's approval, plus a $100 nonrefundable eligibility-application fee. Once approved, you separately purchase the exam voucher.
Official Training Route
The alternative is enrolling in EC-Council's recognized official training, whose price already incorporates the eligibility-application fee - so you don't pay that $100 separately if you go this route. Note that standalone courseware (self-paced materials purchased outside official training) is a distinct product from both the training itself and the exam voucher - don't assume buying courseware covers your eligibility or your exam fee.
Putting the Numbers Together
The official RPS exam voucher costs $550 USD and is valid for one year from purchase. For a self-study candidate, that means:
- $100 eligibility-application fee (nonrefundable)
- $550 RPS exam voucher
- $650 total before any prep materials or courseware
That total doesn't include study resources, practice tests, or retake costs if needed. For the complete pricing picture, including how the training-route costs compare, see the CND Certification Cost 2026: Complete Pricing Breakdown and the eligibility documentation requirements in the CND Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Key Takeaway
Self-study candidates should budget $650 minimum ($100 eligibility fee + $550 voucher) before spending anything on study materials or a practice-test platform like CND Exam Prep's practice tests.
Who Hires CND-Certified Professionals?
CND is built for roles that sit on the defensive side of network security operations - the people responsible for keeping infrastructure hardened, monitoring for anomalies, and responding when something goes wrong. Typical roles associated with the certification include:
- Network administrators and network security administrators
- Network security engineers and analysts
- Security operations center (SOC) analysts focused on network-layer monitoring
- Entry-to-mid-level incident responders working within network defense teams
Because the exam blueprint spans endpoint hardening, perimeter defense, cloud and wireless protection, and both incident detection and prediction, the credential signals breadth across defensive network security rather than depth in one narrow specialty. Employers evaluating candidates for hands-on network defense roles often look at CND alongside practical experience rather than as a standalone qualifier. For a more detailed look at how the credential translates into job titles and career paths, see CND Jobs and the earnings analysis in the CND Salary Guide 2026: Complete Earnings Analysis. If you're still deciding whether the investment makes sense for your career stage, the Is the CND Certification Worth It? Complete ROI Analysis 2026 walks through that decision in more depth.
Keeping the Certification Active
Earning CND isn't a one-time event - the certificate initially carries one-year validity, extended annually through continued fee payment and continuing-education compliance. Over a full three-year cycle, EC-Council requires:
- 120 continuing-education (CE) credits across the three-year cycle
- $80 annual continuing-education fee, which totals $240 per three-year cycle
This is a real ongoing cost that candidates often forget to budget for when they're focused solely on passing the initial exam. If you're comparing the full cost of ownership - exam plus years of maintenance - factor the $240 per cycle into your long-term planning alongside the upfront $650 (or training-route equivalent).
How to Approach Preparation by Domain
Generic study techniques - spaced repetition, timed practice blocks, active recall - all work fine for CND prep, but they only pay off when applied against the actual blueprint weights rather than spread evenly across all eight domains. A simple way to structure the final stretch before your exam date:
Heaviest Domains First
- Deep review of Domain 3 (Endpoint Protection, 20%)
- Deep review of Domain 5 (Enterprise Virtual, Cloud, and Wireless Network Protection, 15%)
- Deep review of Domain 8 (Incident Prediction, 15%)
Mid-Weight Domains
- Domain 1 (Network Defense Management), Domain 2 (Network Perimeter Protection), Domain 4 (Application and Data Protection) - each at 10%
Remaining Domains + Full Review
- Domain 6 (Incident Detection) and Domain 7 (Incident Response), each 10%
- Timed 100-question practice runs to build pacing for the four-hour limit
- Review of any form-specific cut score guidance so you understand the passing threshold you're targeting
This isn't the only valid sequence, but it reflects a core principle: since Domains 3, 5, and 8 together make up half your score, mastering them first reduces risk if your remaining study time gets compressed. For question-level practice organized by these same domain weights, run through timed sets on CND Exam Prep's practice test platform before exam day. A full walkthrough of this kind of planning, including how to sequence review around the exam blueprint, is available in the CND Study Guide 2026: How to Pass on Your First Attempt.
Frequently Asked Questions
No. This article covers EC-Council's Certified Network Defender exclusively, tied to exam 312-38. Other organizations use "CND" for unrelated purposes, and their facts, fees, and requirements don't apply here.
You take EC-Council's 312-38 exam: 100 multiple-choice questions with a four-hour time limit, delivered through the ECC Exam Center at an authorized testing center or via EC-Council Remote Proctoring Services.
Self-study candidates pay a $100 nonrefundable eligibility-application fee plus a $550 RPS exam voucher, totaling $650 before purchasing any study materials or courseware.
Passing cut scores are form-specific and range from 60% to 85% depending on which exam form you receive. This is a passing threshold, not a pass rate.
Domain 3, Endpoint Protection, carries the most weight at 20%. Domains 5 (Enterprise Virtual, Cloud, and Wireless Network Protection) and 8 (Incident Prediction) follow at 15% each, together making up half the exam.
For a broader introduction to the terminology and background covered here, related pages like CND Certification, What Is A CND?, What Does CND Mean?, and What Is CND Certification? walk through adjacent angles on the same credential, while CND Training and CND Exam Dates 2026: Testing Windows, Deadlines & Scheduling cover the logistics of getting there. And when you're ready to test your domain knowledge under real exam conditions, CND Exam Prep's practice tests are built around this exact blueprint.