thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Courses  /  EC-Council  /  EC-Council - Certified Network Defender (CND)
Exam 312-38CND v3 EC-Council DoD 8140 / 8570College credit

EC-Council - Certified Network Defender (CND)

Five days building the protect, detect, respond and predict skills a network defender uses every shift, with heavy hands-on lab time.

Five days, instructor-led In class or live online Class Hub + 90 days Military funding accepted DoD 8570: IAT I, IAT II, IAM I +1 Up to 3 college credits

Course overview

100 questionsFour-hour examExam 312-38, CND v3
20 modulesDefense in depthPerimeter to cloud to threat intelligence
5 days+ 90 days of Class HubPlus six months of EC-Council labs

thinQtank® Learning is offering a unique five-day training camp comprised of five days of instructor-led learning for Certified Network Defender. As with all our thinQtank® Training Experiences - exams are delivered in the classroom.

Learn about hackers and cyber defense strategies required in today's critical infrastructure. EC-Council has reviewed the entire CND space as designated by the Department of Defense as IAT I, II, III and IAM I, II, III as well as the NICE Framework KSA's as they relate to cyber defense and day-to-day cyber operations. With each of these considered, they built their exam blueprint, overall training scope, and got to work building the next certification we believe will be a game changer for cyber security professionals - Certified Network Defender.

The class is a professional level introduction to the cyber defense strategies needed in today's critical infrastructure. Certified Network Defender v3 has been designed by industry experts to help IT Professionals play an active role in the Protection of digital business assets and Detection and Response to Cyber Threats, while leveraging Threat Intelligence to Predict them before they happen. CND is a network security course designed to help organizations create and deploy the most comprehensive network defense system.

Your certification path

Where this course sits: what to have first, and where it leads.

This courseEC-Council - Certified Network Defender (CND)Exam 312-38

Course objectives

What you will be able to do by the end of the class.

Network defense strategyRecognize network attacks and build layered administrative and technical defenses.
Perimeter and endpoint securitySecure firewalls, IDS/IPS, Windows, Linux, mobile and IoT endpoints.
Application, data and cloudProtect applications and data, and secure virtual, cloud and wireless networks.
Monitoring and analysisMonitor traffic and logs to spot indicators of compromise, attack and exposure.
Incident response and continuityHandle first response and forensics, and plan business continuity and recovery.
Risk and threat predictionAnticipate risk, analyze attack surface and use threat intelligence to get ahead of attacks.

Who it is for

Who gets the most from this class, and what to know before you start.

Who should attend

  • System administrators
  • System engineers
  • Firewall administrators
  • Network managers
  • IT managers
  • IT professionals
  • Anyone interested in network security technologies
  • Managers who want to understand cyber security core principles and practices
  • Operations personnel, who although do not have security as their primary job function, will need an understanding of cyber security core principles and practices

Prerequisites

  • You should be well-versed in cyber security fundamentals.

Course outline

8 modules. Open any one to see what it covers.

01Attacks and defense strategies
  • Network attacks and attack techniques
  • Defense-in-depth strategy
  • Administrative network security
02Technical and perimeter security
  • Access control and AAA
  • Firewalls, IDS/IPS and proxies
  • Network perimeter design
03Endpoint security
  • Windows and Linux hardening
  • Mobile device security
  • IoT device security
04Application and data security
  • Application security controls
  • Data protection and encryption
  • Data loss prevention
05Virtual, cloud and wireless
  • Virtualization security
  • Enterprise cloud security
  • Wireless network security
06Traffic and log monitoring
  • Network traffic analysis
  • Log management and analysis
  • IoC, IoA and IoE
07Incident response and continuity
  • First response and forensics basics
  • Business continuity
  • Disaster recovery
08Risk, attack surface and threat intelligence
  • Risk management
  • Attack surface analysis
  • Cyber threat intelligence

The full lesson-by-lesson outline is in the course datasheet (PDF).

Course features

How the class is taught, and why it works.

Live, instructor-ledEvery session is taught live by a certified instructor, in the classroom and online at the same time.
Hands-on labs40% of class time is hands-on lab work, not slides.
Exam preparation built inPractice questions and focused review aligned to exam 312-38, with the exam delivered in the classroom.
Class Hub for 90 daysRecordings, materials and practice stay open for the class plus 90 days after it ends.
Attend your waySterling, VA, Atlanta, GA, Burbank, CA, or live online from anywhere.
Funding friendlyMilitary flat rate, thinQflex monthly payments, or a formal quote for your employer.

What you get

Everything below is included in the course price.

Class Hub access for the length of the class plus 90 days
thinQtank® Learning Accelerated Custom Exam Study Guide for the CND exam
Exam delivery in classroom with 98% success
Course specific thinQtank® Learning publications to promote fun exciting learning
Extended hours of training including immersive hands-on exercises
WE DO NOT TEACH THE TEST. We always deliver valuable hands-on experience
Receive all reading material and study guides when you register
All courses taught by certified expert engineers

Format: Five days of instructor-led learning · 60% lecture, 40% hands-on labs/demonstrations · Instructor-Led Training, Immersive Live-Online Training, On-Site and Custom Delivery

Study plan

How the five days run, plus what to do before and after class.

Before class
  • Check the prerequisites above and fill any gaps
  • We send joining details and course materials before day one
Day 1
  • Attacks and defense strategies
  • Technical and perimeter security
Day 2
  • Endpoint security
  • Application and data security
Day 3
  • Virtual, cloud and wireless
  • Traffic and log monitoring
Day 4
  • Incident response and continuity
  • Risk, attack surface and threat intelligence
Day 5
  • Final review and exam
After class
  • Class Hub stays open 90 days: recordings, labs and practice
  • Missed a passing score? Review your weak domains and rebook

The order of topics can shift with the class; your instructor confirms the schedule on day one.

The certification exam

EC-Council Certified Network Defender (CND v3) · exam 312-38

Exam code312-38
Questions100
Time4 hours
Passing scoreSet per exam form, 60%–85%
Format
Multiple choice
Voucher
Exam voucher available — ask us to add it to your registration
Validity
Valid for three years, maintained with 120 EC-Council continuing education credits

DoD 8140 and college credit

What this certification counts for with the Department of Defense, and toward a degree.

DoD 8140 / 8570 CND qualifies for 4 of the 14 DoD workforce categories.
Information Assurance Technical, Level I IAT Level I
0–2 years typicalGS-5 to GS-7
Help desk technician · Desktop / client support · IT specialist (customer support) · Junior network technician
Typically performs (DCWF): 411 Technical Support Specialist
Information Assurance Technical, Level II IAT Level II
2–5 years typicalGS-9 to GS-11
System administrator · Network administrator · Junior security analyst · ISSO on a small system
Typically performs (DCWF): 451 System Administrator; 441 Network Operations Specialist; 521 Cyber Defense Infrastructure Support Specialist
Information Assurance Management, Level I IAM Level I
2–4 years typicalGS-9 to GS-11
ISSO on a single system · Security coordinator · Assistant ISSM · Compliance support
Typically performs (DCWF): 722 Information Systems Security Manager (Basic); 612 Security Control Assessor (Basic)
Cybersecurity Service Provider Infrastructure Support CSSP Infrastructure Support
3–6 years typicalGS-11 to GS-12
Sensor / tool administrator · IDS-IPS engineer · SIEM engineer · Defensive infrastructure support
Typically performs (DCWF): 521 Cyber Defense Infrastructure Support Specialist

DoD 8570 was replaced by DoD 8140 work roles (contractors since February 2026), but job postings still use these categories. DoD publishes no crosswalk between the two; the work roles shown are what this population typically performs, not an official mapping. Experience figures are typical, not requirements.

College credit Pass the exam and these universities will count it toward a degree. This is what each school publishes about its own transfer policy; the registrar makes the final call.
3credits UMGC
3creditsACE recommendationaccepted by 1,500+ schools

Most schools only count IT certifications earned in the last three to five years (some require them to be current), and several will not award transfer credit once you have enrolled. Get your evaluation done first.

Where it can take you

Roles this certification is commonly asked for.

Network Security AdministratorRun and tune the controls that protect the network.
SOC AnalystMonitor traffic and logs, and escalate real incidents.
Network Defense TechnicianHarden, patch and monitor infrastructure.
Cybersecurity EngineerDesign layered defenses across on-premises and cloud.
DoD Cyber Defense RolesCND is approved for DoD 8140 cyber defense work roles.

Upcoming dates

Every class runs in the classroom and live online at the same time. Pick the dates; choose how you attend when you register.

DatesLocationFormat
Nov 9 – 13, 2026 Sterling, VA Classroom + live online Reserve
Dec 14 – 18, 2026 Santa Clarita, CA Classroom + live online Reserve
Jan 11 – 15, 2027 Sterling, VA Classroom + live online Reserve
Feb 8 – 12, 2027 Santa Clarita, CA Classroom + live online Reserve
Mar 8 – 12, 2027 Sterling, VA Classroom + live online Reserve
Apr 5 – 9, 2027 Santa Clarita, CA Classroom + live online Reserve
May 10 – 14, 2027 Sterling, VA Classroom + live online Reserve
Jun 14 – 18, 2027 Santa Clarita, CA Classroom + live online Reserve
Jul 5 – 9, 2027 Sterling, VA Classroom + live online Reserve
Aug 9 – 13, 2027 Santa Clarita, CA Classroom + live online Reserve
Sep 13 – 17, 2027 Sterling, VA Classroom + live online Reserve
Oct 4 – 8, 2027 Santa Clarita, CA Classroom + live online Reserve

2 more dates through December 2027. Ask about a later date.

Paying for it

The price above is our standard rate. These options can bring it down or spread it out.

Military & veterans
$1,500

Flat rate per class when you use Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0. Your program confirms eligibility.

Funding details
thinQflex™
Name your price

Paying yourself? Tell us what you can pay and over how many months, up to twelve. We say yes, or come back with terms.

Make an offer
Employer or agency
Formal quote

A formal quote with the course and exam voucher as separate lines, valid 30 days. Group and government pricing available.

Request a quote

How to enroll

Four steps from here to certified.

  1. Pick your datesChoose a class from the dates above, in a classroom or live online.
  2. Reserve or get a quoteReserve your seat, ask for a quote for your employer, or make a thinQflex offer.
  3. Get readyWe confirm your seat and send joining details and materials before day one.
  4. Attend and certifyTake the class, then sit exam 312-38, with Class Hub open for 90 days after.

Frequently asked questions

How is CND different from CEH?
CND is the defender's course: protecting, detecting and responding. CEH teaches the attacker's methodology. Many people take CND first, then CEH.
Which version is taught?
CND v3, the current version, tested by exam 312-38.
What lab access do I get?
Labs run throughout class, and you get six months of access to EC-Council's CND virtual lab environment.
What does it cost?
The standard price is $4,950; exam voucher available — ask us to add it to your registration. Military students using AF COOL, Army CA, MyCAA or VET TEC 2.0 pay $1,500, and thinQflex lets you name your own price and monthly payment.
How long is the class?
Five days of live, instructor-led training, about 40% of it hands-on labs.
Can I attend live online?
Yes. Every class runs live online at the same time as the classroom, with the same instructor and labs.
How long do I keep access to the materials?
Your Class Hub stays open for the length of the class plus 90 days.
Is the exam included?
The exam voucher is priced separately; we can add it to your registration or quote.
Can I use military funding?
Yes. With Air Force COOL, Army CA, MyCAA or VET TEC 2.0 you pay a flat $1,500 per class.
Can my employer pay?
Yes. Request a quote and we will send a formal one, valid for 30 days.
What if I cannot pay all at once?
Use thinQflex to name your price and spread payments over up to twelve months.
Where are the classrooms?
Sterling, Virginia; Atlanta, Georgia; and Burbank, California. Every class also runs live online, so you can join from anywhere.
What do I need to attend online?
A computer with a reliable internet connection, a headset or speakers, and a microphone. A webcam is recommended.
Will I get a certificate of completion?
Yes. You receive a thinQtank Learning certificate of completion when you finish the class.
Which course should I take next?
Most students go on to EC-Council Certified Ethical Hacker, CompTIA Security+, CompTIA CySA+. Tell us your goal and we will map the path with you.
Do you run private classes for teams?
Yes. We deliver private classes on-site or online for teams and agencies, on your dates. Ask for a quote.
Can you help me choose the right course?
Yes. Call 855-868-4467 or email sasmith@thinqtanklearning.com and we will recommend the right starting point.

Ready to earn your - Certified Network Defender (CND)?

Next class Nov 9 – 13, 2026 · Sterling, VA and live online.