Free study guide

EC-Council 312-38 Study Guide

EC-Council Certified Network Defender (CND) 312-38

EC-Council Certified Network Defender (CND), exam 312-38, tests the skills a network defender uses to protect, detect, respond to and predict attacks on an enterprise network. It covers defense management, perimeter and endpoint protection, application and data protection, virtual, cloud and wireless security, and incident detection, response and prediction. It suits network and security administrators and SOC staff.

  • Exam code 312-38
  • Associate level
  • 8 exam domains

This guide is free, with no sign-up. It explains every EC-Council 312-38 exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 8chapters
  • 41topics
  • 8diagrams and exhibits
  • 3 h 12 minfast track
Start with Network Defense Management
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Network Defense Management5 topics · 24 min fast trackAttacks, hacking frameworks, defense strategy, compliance, policies, training and asset management.
  1. 1Attack Terminology and Network, Host and Application Attacks5 min
  2. 2Human, Email, Mobile, Cloud, Wireless and Supply Chain Attacks5 min
  3. 3Attacker Methodologies and Defense Strategies5 min
  4. 4Compliance, Regulations and Security Policies4 min
  5. 5Awareness, Administrative Controls, Asset Management and Threat Awareness5 min
Read the chapter overview →
2Network Perimeter Protection6 topics · 31 min fast trackAccess control, IAM, cryptography, segmentation, firewalls, IDS, device hardening and zero trust.
  1. 1Access Control and Identity and Access Management5 min
  2. 2Cryptography and Network Security Protocols5 min
  3. 3Segmentation, Security Solutions, Router and Switch Security and Zero Trust5 min
  4. 4Firewall Concepts, Types, Topologies and Placement5 min
  5. 5Firewall Selection, Deployment and Administration5 min
  6. 6IDS and IPS Concepts, Deployment and Solutions6 min
Read the chapter overview →
3Endpoint Protection9 topics · 36 min fast trackWindows and Linux hardening, enterprise mobile security, Android, iOS and IoT security, worth 20 percent.
  1. 1Windows Security Components, Features and Baselines4 min
  2. 2Windows Accounts, Passwords, Patching and Access4 min
  3. 3Windows Hardening, Active Directory and Network Services4 min
  4. 4Linux Security Concerns, Patching and Hardening4 min
  5. 5Linux Access, Remote Security and Security Tools4 min
  6. 6Enterprise Mobile Policies, Risks and Management4 min
  7. 7Mobile Platform Guidelines for Android and iOS4 min
  8. 8IoT Devices, Ecosystem and Security Risks4 min
  9. 9IoT Security Measures, Tools and Standards4 min
Read the chapter overview →
4Application and Data Protection4 topics · 18 min fast trackAllowlisting, sandboxing, WAF, data integrity, encryption, backup and DLP, worth 10 percent.
  1. 1Application Control, Sandboxing, Patching and WAF4 min
  2. 2Data Security, Integrity, Access Control and Encryption at Rest4 min
  3. 3Encryption in Transit for Web, Database and Email5 min
  4. 4Data Masking, Backup, Destruction and DLP5 min
Read the chapter overview →
5Enterprise Virtual, Cloud, and Wireless Network Protection5 topics · 25 min fast trackVirtualization, containers, cloud and Wi-Fi security, worth 15%.
  1. 1Virtualization, NV, SDN and NFV Security5 min
  2. 2OS Virtualization, Containers, Docker and Kubernetes Security5 min
  3. 3Cloud Fundamentals, Security and Evaluating a Provider5 min
  4. 4AWS, Azure, GCP and Cloud Security Best Practices5 min
  5. 5Wireless Networks, Encryption, Authentication and Security5 min
Read the chapter overview →
6Incident Detection4 topics · 20 min fast trackNetwork monitoring, baselines, Wireshark, anomaly detection and log analysis, worth 10 percent.
  1. 1Network Traffic Monitoring and Baselines5 min
  2. 2Wireshark, Performance Monitoring and Anomaly Detection5 min
  3. 3Logging Concepts and Windows, Linux and Mac Logs5 min
  4. 4Firewall, Router, Web Server and Centralized Log Monitoring5 min
Read the chapter overview →
7Incident Response4 topics · 18 min fast trackFirst response, handling process, SOAR, EDR, XDR, forensics, BC/DR and crisis management, worth 10%.
  1. 1Incident Response, First Response and the Handling Process5 min
  2. 2Automating Response with SOAR, EDR, MDR and XDR4 min
  3. 3Forensics Investigation and Business Continuity Basics5 min
  4. 4BCP, DRP, BC/DR Standards and Crisis Management4 min
Read the chapter overview →
8Incident Prediction4 topics · 20 min fast trackRisk and vulnerability management, attack surface, threat intelligence and hunting, worth 15%.
  1. 1Risk Management and Risk Management Frameworks4 min
  2. 2Vulnerability Management, Assessment, Scanning and PIA5 min
  3. 3Attack Surface Analysis, Exposures, Simulation and Reduction5 min
  4. 4Threat Intelligence, IoCs, IoAs and Threat Hunting6 min
Read the chapter overview →

Ready for more practice?

The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.