CND Certification: Exam Format, Eligibility and 20 Modules

The Certified Network Defender (CND) from EC-Council is the defensive counterpart to CEH: instead of attacking systems, you learn to protect, monitor and respond. It is a common first step for network administrators and freshers who want a blue team career. These details come from EC-Council's CND page and the CND v4.0 exam blueprint, read on November 5, 2026. EC-Council changes its rules and fees, so confirm current terms before you register.

Exam Format

• Exam code: 312-38.
• Questions: 100, all multiple choice.
• Duration: 4 hours, which is about 2 minutes 24 seconds per question.
• Delivery: through the EC-Council exam portal.
• Passing score: EC-Council says a cut score of 60% to 85%, depending on the exam form you receive.

EC-Council's CND page mentions version 3 in one sentence, while its exam blueprint is numbered v4.0, so you may see both labels. Check the current version when you register.

EC-Council describes the program as designed for five days of training, with more than 100 labs on live target machines, and says over half of the course is hands-on.

Who Can Start, and Who It Suits

EC-Council says students should have fundamental knowledge of networking concepts, and it calls CND suitable for beginners. It also describes it as an intermediate-level program for people who work as network administrators, security analysts or network engineers. If TCP/IP, ports and basic routing are still new, read networking basics for cybersecurity first.

The Protect, Detect, Respond, Predict Approach

EC-Council frames the course around four jobs a defender does: protect systems, detect attacks, respond to incidents and predict threats. The modules follow that arc, from securing networks and endpoints to reading logs, handling incidents and using threat intelligence.

The 20 Modules

• 1. Network Attacks and Defense Strategies
• 2. Administrative Network Security
• 3. Technical Network Security
• 4. Network Perimeter Security
• 5. Endpoint Security: Windows Systems
• 6. Endpoint Security: Linux Systems
• 7. Endpoint Security: Mobile Devices
• 8. Endpoint Security: IoT Devices
• 9. Administrative Application Security
• 10. Data Security
• 11. Enterprise Virtual Network Security
• 12. Enterprise Cloud Security
• 13. Enterprise Wireless Network Security
• 14. Network Traffic Monitoring and Analysis
• 15. Network Logs Monitoring and Analysis
• 16. Incident Response and Forensics Investigation
• 17. Business Continuity and Disaster Recovery
• 18. Risk Anticipation with Risk Management
• 19. Threat Assessment with Attack Surface Analysis
• 20. Threat Prediction with Cyber Threat Intelligence

Where CND Leads

EC-Council places CND at the start of its blue team route, with CTIA, ECIH, CSA and CHFI for threat intelligence, incident handling, SOC work and forensics. See CND or CSA first for how to choose. EC-Council also points to CND as a base for red team study such as CEH; our CEH vs CND guide compares the two.

Cost and What We Offer

Our CND fee is ₹34,000 + 18% GST (₹40,120 in total). Each EC-Council certification fee includes one exam attempt. Remote proctoring charges, if any, are confirmed in writing. EC-Council says its own price depends on the delivery mode: in person, online or self-study. The full table is on the CND certification page. A certificate alone will not get you a SOC job; employers also test hands-on skill, which is the focus of our SOC, Splunk, Wazuh and DFIR course.