To help improve your performance, it is critical to understand the exam topics in detail. Thus, the content covered in the certification test that will be measured includes the following:

• Protection of Network Perimeter: 16%

  This subject area focuses on the individuals’ skills in explaining access control terminologies, models, principles, as well as cryptographic security methods. The applicants should also develop their competence in explaining the concepts of identity & access management.

• Endpoint Protection: 15%

  This domain requires a good understanding of security concerns and Windows operating system. It also focuses on your ability to explain different features and components of Windows security, Windows User Account, and Password Management. The test takers also need to have an understanding of the Linux operating system and security concerns. They should possess the ability to explain Linux installation, Linux patching, and Linux operating system hardening methods.

• Incident Prediction: 10%

  The last area covers the concepts of risk management and evaluates the students’ skills in managing risk through the risk management program and managing vulnerabilities through the vulnerability management program. It also covers their understanding of the cyber threat intelligence’s role in network defense and various threat intelligence types.

• Incident Detection: 14%

  To deal with the following objective, the examinees will need to have an understanding of the requirements and benefits of network traffic monitoring and the ability to explain the concepts of bandwidth monitoring and network performance. It also covers their skills in explaining log monitoring & analysis on Mac, Linux, Web, Routers, and Firewall.

• Application & Data Protection: 13%

  This module evaluates the learners’ skills in explaining & implementing Application Blacklisting & Whitelisting, application sandboxing, application patch management, and web application firewall. It also covers their understanding of data security and its importance. The interested candidates should also be able to describe the encryption of data at rest and at transit implementation.

• Enterprise Virtual, Wireless, and Cloud Network Protection: 12%

  The next part of the test requires that you have the ability to explain network virtualization security, software-defined network security, network function virtualization, and operating system virtualization security. It also requires that you possess the skills in explaining security guidelines, best practices, and recommendations for containers, Kubernetes, and dockers, among others.

• Incident Response: 10%

  As for this section, it focuses on one’s skills in explaining the process of handling incidents & response as well as forensics investigation. You should also be able to describe BCP & DRP, different BC/DR standards, and BC/DR activities.

• Network Defense Management: 10%

  This topic measures the ability of the candidates to describe important terminologies associated with network attacks as well as the skills in explaining different samples of the network-level, host-level, and application-level attack methods. Besides that, you should also be able to explain different samples of wireless network-specific attack methods.

Reference: https://www.eccouncil.org/programs/certified-network-defender-cnd/

Related Certification Path: CND

The EC-Council Certified Network Defender designation is designed to validate the technical skills of network administrators who are constantly involved in managing network threats. Such individuals should be well versed with a wide range of concepts around this field including network topology, security policy, traffic, performance & utilization, and network components just to mention a few. As a Certified Network Defender, you will be expected to demonstrate your ability to apply network security controls, configure firewall and VPN, and analyze network vulnerabilities. As continuity and resilience of operations matter in today's IT world, this is the best validation that IT specialists, companies, and hiring managers should turn to. In a nutshell, the CND certification path is designed to validate the following individuals:

• Network Security Engineers.
• Network Administrators;
• Network Security Administrators;
• Security Operators;
• CND Analysts;
• Network Defense Technicians;
• Security Analysts;

The EC-Council 312-38 is a mandatory exam for all candidates pursuing the EC-Council Certified Network Defender (CND) certification. This is a skill-based learning path that aims to create competent network administrators who can protect, detect, and respond to rampant security threats on computer networks.