Certified Network Defender v3 gives administrators and engineers the instincts of a network defender: protect the infrastructure, detect attacks, respond to incidents and anticipate threats. Across five days and more than 100 labs it covers the perimeter, Windows, Linux, mobile and IoT endpoints, cloud, virtualisation and wireless. We run it as a live online class, in person in Casablanca or on-site at your organization, in French or English.
Design a defence-in-depth strategy for the network
Put essential administrative and technical controls in place
Secure the perimeter, endpoints and applications
Protect data and virtual, cloud and wireless environments
Monitor traffic and logs to detect attacks
Respond to incidents and keep the business running
Anticipate threats through risk, attack surface and threat intelligence analysis
Program
Protect
Network attacks and defence strategies
Administrative network security
Technical network security
Network perimeter security
Windows endpoints
Linux endpoints
Mobile devices
IoT devices
Administrative application security
Data security
Enterprise virtual networks
Enterprise cloud
Enterprise wireless networks
Detect
Network traffic monitoring and analysis
Network log monitoring and analysis
Respond
Incident response and forensic investigation
Business continuity and disaster recovery
Predict
Risk anticipation through risk management
Threat assessment through attack surface analysis
Threat prediction through cyber threat intelligence
Prerequisites
Fundamental knowledge of networking concepts (OSI model, TCP/IP, routing)
Some Windows or Linux administration experience is helpful
Target audience
Network and system administrators responsible for day-to-day security
Network and security engineers who design and harden infrastructure
Security analysts and junior SOC operators building core defensive skills
Support technicians moving into a cybersecurity career
The exam
The C|ND exam (312-38) has 100 multiple-choice questions to answer in 4 hours. EC-Council runs several exam forms and sets a cut score between 60% and 85% for each, according to its difficulty. Questions span the programme's four pillars: protect, detect, respond and predict. Exam delivery and renewal rules are set by EC-Council, and we go through them in detail when you enrol.
Preparation tips
Review the most common ports, protocols and headers
Repeat the traffic monitoring labs until you can read a capture without hesitation
Pace yourself: 4 hours for 100 questions leaves time for a second pass
Frequently asked questions (FAQ)
Is CND suitable for beginners?
Yes, provided you know networking basics. It is often the first EC-Council certification for administrators moving into security, before CEH or Certified SOC Analyst.
What is the difference between CND and CEH?
CND trains the defender: harden systems, monitor traffic and logs, and respond when something goes wrong. CEH trains the ethical attacker: find and exploit weaknesses before real adversaries do. The two complement each other well, and many teams send staff on both.
How many labs are in v3?
EC-Council lists more than 100 hands-on labs, spread across the programme's twenty modules, so every topic is practised on real systems rather than just discussed.
Are cloud and IoT covered?
Yes. Version 3 has separate modules on enterprise cloud, virtualisation, wireless, mobile devices and IoT, reflecting how far today's networks reach beyond the traditional perimeter.
What is the pass mark?
It ranges from 60% to 85% depending on the exam form you receive, so that every version sets an equivalent standard.