How to Prepare for the CND Exam: A 6-Week Study Plan

CND has 20 modules and a 4-hour, 100-question exam. This 6-week plan assumes about 8 hours a week and covers the modules in groups, with something to do in a lab each week. No plan guarantees a pass, and details can change, so check the current format on EC-Council's CND page (read November 5, 2026). Practice only on systems you own.

Before Week 1

Build a small lab: one Linux VM and one Windows VM on a host-only network, as in our home lab guide. Defense is easier to learn when you can break a setting and then watch what changes.

Week 1: Attacks, Policies and Technical Controls (Modules 1 To 3)

Learn the common attack types, then the controls that answer them: security policies, access control, authentication, encryption and VPNs. Write a one-page table: attack, what it exploits, which control stops it.

Week 2: the Network Perimeter (Module 4)

• Learn the types of firewall, IDS and IPS, proxies and where each sits. Our guide to firewalls, IDS and IPS covers this.
• In the lab, list your Linux firewall rules with sudo ufw status verbose and see what is open with ss -tulpn.
• Change one rule, test it with a scan, change it back.

Week 3: Endpoints (Modules 5 To 8)

Windows, Linux, mobile and IoT hardening: patching, least privilege, disabling unneeded services, secure configuration. Check what is listening on your Linux VM, remove one service you do not need and note how the attack surface shrinks.

Week 4: Applications, Data, Virtual, Cloud and Wireless (Modules 9 To 13)

These modules are reading-heavy. Make one-page summaries, because they feed short factual questions. Link ideas together: the shared-responsibility model in cloud, encryption for data at rest and in transit, and secure wireless settings.

Week 5: Monitoring, Logs and Incident Response (Modules 14 To 16)

• Capture traffic in Wireshark and filter for connection attempts with tcp.flags.syn == 1 && tcp.flags.ack == 0; see Wireshark for beginners.
• On Linux, search failed logins with grep "Failed password" /var/log/auth.log. On Windows, learn Event ID 4625 from our Windows event IDs guide.
• Walk through the stages in incident response steps explained.

Week 6: Continuity, Risk, Threat Intelligence and Timed Practice (Modules 17 To 20)

• Learn the vocabulary: backup types, recovery targets, risk assessment, attack surface and threat intelligence.
• 100 questions in 4 hours is about 2 minutes 24 seconds each. Take at least two full timed question sets.
• For each wrong answer, write why you chose it. The pattern shows which module to revisit.
• Rest the day before.

Common Mistakes

• Memorizing definitions with no lab to attach them to.
• Spending all the time on firewalls and skipping risk, continuity and threat intelligence, which still produce questions.
• Treating practice scores as a prediction. They show gaps, not results.