EC-Council Intermediate

312-38v3

CND v3 - Certified Network Defender

The Certified Network Defender (CND) v3 is a comprehensive network security certification that validates skills in protecting, detecting, and responding to network security threats. This certification focuses on the defensive side of network security, preparing professionals to design and implement security controls, monitor network traffic, and respond to security incidents in real-time.

The exam covers five domains: Network Security Fundamentals (concepts, policies, architecture), Network Security Threats and Attacks (reconnaissance, scanning, enumeration, malware, DDoS, insider threats), Network Security Controls (firewalls, IDS/IPS, VPN, NAC, endpoint security), Cloud and Wireless Security (cloud security architecture, wireless security protocols, BYOD), and Network Traffic Monitoring and Analysis (traffic analysis, log management, SIEM). CND v3 includes enhanced coverage of zero-trust architecture, software-defined networking security, and cloud-native security controls.

This certification is designed for network administrators, network security engineers, security analysts, system administrators, and IT professionals responsible for network defense. CND provides hands-on skills in network security monitoring, incident detection, log analysis, and implementing defense-in-depth strategies. The certification aligns with NICE framework roles and DoD 8570 requirements.

Updated Feb 2024 Cybersecurity

100

Questions

Practice Tests

70%

Pass Score

Views

Total Attempts

Avg. Score

Pass Rate

Discussions

Practice Tests Flash Cards Exam Topics Cheat Sheet

€5.00

CND v3 Practice Exam 1

Comprehensive 50-question practice exam covering network security fundamentals, threats and vulnerabilities, security controls, cloud and wireless security, and network traffic monitoring and analysis for the EC-Council Certified Network Defender certification.

50 Q 120 minutes 70%

Test Drive

€5.00

CND v3 Practice Exam 2

Advanced 50-question practice exam focusing on DDoS mitigation, ARP poisoning defense, DNS security, MITM prevention, NAC implementation, endpoint protection, zero-trust architecture, SDN security, log management, and incident detection for the EC-Council Certified Network Defender certification.

50 Q 120 minutes 70%

Test Drive

€5.00

CND v3 Practice Exam 3

Comprehensive 50-question practice exam covering network hardening, PKI and certificate management, email security gateways, web application firewalls, data loss prevention, Bluetooth security, IoT network security, IPv6 security, security monitoring dashboards, and threat hunting on networks for the EC-Council Certified Network Defender certification.

50 Q 120 minutes 70%

Test Drive

€5.00

CND v3 Practice Exam 4

Comprehensive 50-question practice exam covering SASE/SSE architecture, microsegmentation, container network security, supply chain network attacks, 5G security, network forensics, security automation and SOAR, cloud-native firewalls, API gateway security, and network deception technologies for the EC-Council Certified Network Defender certification.

50 Q 120 minutes 70%

Test Drive

€5.00

CND v3 Practice Exam 5

Advanced 50-question practice exam focusing on ICS/SCADA network security, SD-WAN architecture, BGP and DNS security extensions, TLS inspection strategies, network resilience planning, and compliance-driven network controls for the EC-Council Certified Network Defender certification.

50 Q 120 minutes 70%

Test Drive

€5.00

CND v3 Practice Exam 6

Comprehensive 50-question practice exam covering network defense scenarios, incident response integration, advanced traffic analysis, multi-cloud security, zero trust implementation, network security automation, emerging threat defense, and operational security best practices for the EC-Council Certified Network Defender certification.

50 Q 120 minutes 70%

Test Drive

Unlock All Content for 312-38v3

6 Practice Test(s) + Flash Cards — 3 months access

€39.99 €26.99 Save 30%

or included with Monthly subscription / Content Bundle

312-38v3 Cheat Sheet

Quick reference guide - 6 sections

Free Access

CND v3 (312-38v3) Exam Details

Detail	Value
Exam Code	312-38v3
Full Title	Certified Network Defender v3
Duration	4 hours (240 minutes)
Number of Questions	100 multiple-choice questions
Passing Score	70%
Vendor	EC-Council
Delivery	ECC Exam Portal / Pearson VUE
Certification Level	Intermediate (Blue Team / Defensive Security)

CND v3 Domain Breakdown

Domain	Topic
1	Network Attacks and Defense Strategies
2	Administrative Network Security
3	Technical Network Security
4	Network Perimeter Security
5	Endpoint Security
6	Application Security
7	Data Security
8	Enterprise Virtual, Cloud, and Wireless Network Security
9	Network Traffic Monitoring and Analysis
10	Network Logs Monitoring and Analysis
11	Incident Response and Forensic Investigation
12	Business Continuity and Disaster Recovery
13	Risk Anticipation with Risk Management
14	Threat Assessment with Attack Surface Analysis
15	Threat Prediction with Cyber Threat Intelligence

About the CND Certification

The EC-Council Certified Network Defender (CND) is a vendor-neutral, blue-team certification designed for network administrators and security professionals who defend, detect, and respond to network threats. CND v3 emphasizes a defend-detect-respond approach with practical, lab-based skills. It covers network security from an operations perspective, making it ideal for SOC analysts, network administrators, security engineers, and IT security officers. The certification maps to the NICE 2.0 framework and is approved under the U.S. DoD Directive 8570/8140. CND is positioned between entry-level certifications (like CompTIA Security+) and advanced offensive certifications (like CEH), focusing specifically on the defensive side of cybersecurity.

Exam Tip: The CND exam heavily tests practical knowledge of network defense tools, configurations, and procedures. Focus on understanding defense-in-depth strategies and the specific tools/technologies used at each network layer.

OSI Model & Security Relevance

Layer	Name	PDU	Security Concerns
7	Application	Data	SQL injection, XSS, malware, phishing
6	Presentation	Data	SSL/TLS encryption, data format exploits
5	Session	Data	Session hijacking, replay attacks
4	Transport	Segment	SYN flood, port scanning, TCP hijacking
3	Network	Packet	IP spoofing, ICMP attacks, routing exploits
2	Data Link	Frame	ARP spoofing, MAC flooding, VLAN hopping
1	Physical	Bits	Wiretapping, cable cutting, physical access

TCP/IP Model & Protocol Stack

TCP/IP Layer	OSI Equivalent	Key Protocols
Application	Layers 5-7	HTTP, HTTPS, FTP, SSH, DNS, DHCP, SMTP, SNMP, Telnet
Transport	Layer 4	TCP (reliable, connection-oriented), UDP (unreliable, connectionless)
Internet	Layer 3	IP, ICMP, ARP, IGMP
Network Access	Layers 1-2	Ethernet, Wi-Fi (802.11), PPP, Frame Relay

Common Ports (Must Know)

Port	Protocol	Service	Security Note
20/21	TCP	FTP (data/control)	Plaintext; use SFTP (22) or FTPS (990)
22	TCP	SSH / SFTP / SCP	Encrypted remote access
23	TCP	Telnet	Plaintext; never use in production
25	TCP	SMTP	Email relay; use 587 with STARTTLS
53	TCP/UDP	DNS	DNS tunneling, cache poisoning
67/68	UDP	DHCP	Rogue DHCP server attacks
80	TCP	HTTP	Unencrypted; redirect to 443
443	TCP	HTTPS	TLS-encrypted web traffic
161/162	UDP	SNMP	Use SNMPv3 with auth + encryption
389	TCP	LDAP	Use LDAPS (636) for encryption
514	UDP	Syslog	Centralized logging; use TLS variant
1812/1813	UDP	RADIUS	Authentication / Accounting
49	TCP	TACACS+	Full packet encryption
3389	TCP	RDP	Brute force target; use NLA + MFA

Defense-in-Depth Strategy

Defense-in-depth is a layered security approach where multiple defensive mechanisms are placed throughout the network so that if one layer fails, another layer stops the attack. CND v3 organizes defenses across these layers:

Policies & Procedures: Acceptable use, security policies, change management, incident response plans
Physical Security: Locks, badges, biometrics, CCTV, mantraps, environmental controls
Perimeter Security: Firewalls, DMZ, proxy servers, IDS/IPS at the network edge
Network Security: VLANs, segmentation, NAC, VPN, network monitoring
Host Security: OS hardening, patch management, endpoint protection, HIDS
Application Security: Secure coding, WAF, input validation, code reviews
Data Security: Encryption (at rest and in transit), DLP, access controls, backup

Exam Tip: Understand that defense-in-depth is the core CND philosophy. Every question relates back to which layer of defense addresses the scenario.

Security Policies & Risk Assessment

Policy Type	Purpose
Acceptable Use Policy (AUP)	Defines permitted use of organizational IT resources
Access Control Policy	Specifies who can access what resources and under what conditions
Password Policy	Minimum length, complexity, rotation, history requirements
Remote Access Policy	VPN requirements, device security for remote workers
Incident Response Policy	Steps for detecting, containing, eradicating, and recovering from incidents
BYOD Policy	Rules for personal devices connecting to corporate networks

Risk Formula: Risk = Threat x Vulnerability x Impact. Quantitative: ALE = SLE x ARO (Annualized Loss Expectancy = Single Loss Expectancy x Annual Rate of Occurrence). Qualitative: Uses scales (High/Medium/Low) based on expert judgment.

Network Threat Landscape

Attack Category	Examples	Defense
Reconnaissance	Port scanning, WHOIS, DNS enumeration, ping sweeps	IDS, firewall rules, restrict ICMP
DoS / DDoS	SYN flood, UDP flood, Smurf, Slowloris, amplification	Rate limiting, SYN cookies, DDoS mitigation services
Man-in-the-Middle	ARP poisoning, DNS spoofing, SSL stripping	DAI, DNSSEC, HSTS, certificate pinning
Malware	Ransomware, trojans, worms, rootkits, fileless malware	Endpoint protection, application whitelisting, sandboxing
Social Engineering	Phishing, spear phishing, vishing, pretexting	Security awareness training, email filtering, MFA
Insider Threats	Data theft, sabotage, privilege abuse	Least privilege, DLP, UEBA, separation of duties

Firewall Types & Generations

Firewall Type	OSI Layer	How It Works	Limitations
Packet Filtering	Layer 3-4	Inspects headers (src/dst IP, port, protocol); stateless	No context; vulnerable to IP spoofing
Stateful Inspection	Layer 3-4	Tracks connection state in a state table; allows return traffic	Cannot inspect application content
Application Proxy (Gateway)	Layer 7	Acts as intermediary; inspects full application data	Slow; not all protocols supported
Circuit-Level Gateway	Layer 5	Validates TCP handshake completion; SOCKS proxy	No deep packet inspection
Next-Generation Firewall (NGFW)	Layers 3-7	Stateful + DPI + application awareness + IPS + TLS inspection	Complex configuration; resource intensive
Web Application Firewall (WAF)	Layer 7	Protects web apps from SQLi, XSS, CSRF; HTTP-specific rules	Only for web traffic

Exam Tip: Know the difference between stateless packet filtering (checks each packet independently) and stateful inspection (maintains a connection state table). NGFW combines stateful inspection with application-layer intelligence and integrated IPS.

IDS vs IPS: Detection Methods

Feature	IDS (Intrusion Detection)	IPS (Intrusion Prevention)
Mode	Passive (monitors copy of traffic)	Inline (sits in traffic path)
Action	Alerts only (does not block)	Alerts AND blocks malicious traffic
Latency Impact	None (out of band)	Minimal (inline processing)
Failure Mode	Network continues if IDS fails	Must fail-open or fail-closed

Detection Method	How It Works	Strengths / Weaknesses
Signature-Based	Matches traffic against known attack patterns (signatures)	Fast, low false positives; cannot detect zero-day attacks
Anomaly-Based (Behavioral)	Builds a baseline of normal behavior; flags deviations	Detects zero-days and novel attacks; higher false positives
Protocol Analysis	Checks traffic against protocol standards (RFCs)	Detects protocol anomalies; complex to maintain

NIDS: Network-based IDS deployed at strategic network points (span port / tap). HIDS: Host-based IDS installed on individual endpoints monitoring file integrity, logs, and system calls. Tools: Snort, Suricata (NIDS), OSSEC, Wazuh (HIDS).

VPN Technologies & Protocols

VPN Protocol	Type	Port	Key Features
IPsec	Site-to-Site / Remote	UDP 500 (IKE), Protocol 50/51	AH (integrity) + ESP (encryption + integrity); tunnel or transport mode
SSL/TLS VPN	Remote Access	TCP 443	Browser-based or client; easy NAT traversal; portal or tunnel mode
OpenVPN	Remote Access	UDP 1194 (default)	Open-source; SSL/TLS based; highly configurable
WireGuard	Remote Access	UDP 51820	Modern, minimal codebase; high performance
L2TP/IPsec	Remote Access	UDP 1701	L2TP provides tunnel; IPsec provides encryption
GRE over IPsec	Site-to-Site	Protocol 47	GRE encapsulates multicast/routing; IPsec encrypts

IPsec Modes: Transport mode encrypts only the payload (host-to-host). Tunnel mode encrypts the entire original packet including headers (gateway-to-gateway). IKE Phases: Phase 1 establishes a secure channel (ISAKMP SA); Phase 2 negotiates IPsec SAs for actual data encryption.

Network Segmentation & DMZ Architecture

Network segmentation divides the network into isolated zones to limit lateral movement and contain breaches. Key concepts:

DMZ (Demilitarized Zone): Semi-trusted zone between external and internal networks hosting public-facing services (web, email, DNS servers). Uses dual firewalls or a single firewall with three interfaces.
VLANs: Logical separation at Layer 2. Each VLAN is a separate broadcast domain. Inter-VLAN traffic must pass through a router or Layer 3 switch (where ACLs can be applied).
Micro-segmentation: Granular segmentation at the workload level using software-defined networking (SDN). Controls east-west traffic between servers.
Zero Trust: "Never trust, always verify." Every access request is authenticated and authorized regardless of network location. Uses identity, device health, and least privilege.

Proxy Servers & Honeypots

Technology	Purpose	Types
Forward Proxy	Intermediary for outbound client requests; content filtering, caching, anonymity	Explicit (configured on client), Transparent (intercepted by network)
Reverse Proxy	Intermediary for inbound requests to servers; load balancing, SSL offloading, WAF	Nginx, HAProxy, AWS ALB
Honeypot	Decoy system to attract attackers, study techniques, and generate alerts	Low-interaction (emulates services), High-interaction (full OS)
Honeynet	Network of honeypots simulating an entire environment	Production (protect real network), Research (study attackers)

SIEM (Security Information & Event Management)

SIEM aggregates logs and events from across the network into a centralized platform for real-time analysis, correlation, alerting, and compliance reporting.

Log Collection: Ingests logs from firewalls, IDS/IPS, servers, endpoints, applications via syslog, agents, or APIs
Normalization: Converts different log formats into a common schema for consistent analysis
Correlation: Applies rules to detect patterns across multiple log sources (e.g., failed logins + privilege escalation = compromised account)
Alerting: Generates real-time alerts for security events matching predefined thresholds or correlation rules
Dashboards & Reporting: Provides visualization and compliance reports (PCI DSS, HIPAA, SOX)

Popular SIEM Tools: Splunk, IBM QRadar, Microsoft Sentinel, Elastic SIEM, LogRhythm, AlienVault (AT&T Cybersecurity).

Exam Tip: SIEM is central to CND operations. Understand the difference between log management (collection + storage) and SIEM (collection + correlation + analysis + alerting).

Access Control Models

Model	Description	Use Case
DAC (Discretionary)	Owner controls access to their resources; identity-based	Windows NTFS permissions, Linux file permissions
MAC (Mandatory)	System-enforced labels (classification levels); users cannot change	Military, government (Top Secret, Secret, etc.)
RBAC (Role-Based)	Access granted based on organizational role; most common in enterprise	Active Directory groups, application roles
ABAC (Attribute-Based)	Policies evaluate attributes (user, resource, environment, action)	Cloud IAM policies, dynamic access decisions
Rule-Based	Access determined by rules (e.g., time of day, IP range)	Firewall ACLs, router access lists

Principle of Least Privilege: Users should have only the minimum access necessary to perform their job functions. Combined with Separation of Duties: Critical tasks require multiple people to prevent fraud or error.

AAA: Authentication Protocols

Feature	RADIUS	TACACS+	Kerberos
Transport	UDP 1812/1813	TCP 49	UDP 88
Encryption	Password only	Entire packet body	Ticket-based (symmetric keys)
AAA Separation	Combined AuthN + AuthZ	Separate AuthN, AuthZ, Accounting	Authentication + authorization via tickets
Best For	Network access (802.1X, VPN, Wi-Fi)	Device admin (CLI, router/switch access)	Windows domain authentication (Active Directory)
Standard	Open (RFC 2865/2866)	Cisco proprietary	Open (RFC 4120)

Multi-Factor Authentication (MFA): Combines two or more factors: Something you know (password), Something you have (token, smart card), Something you are (biometrics). 802.1X: Port-based NAC using EAP between supplicant, authenticator (switch), and authentication server (RADIUS).

Endpoint Security

Antivirus / Anti-Malware: Signature-based and heuristic detection of known and unknown malware
EDR (Endpoint Detection & Response): Real-time monitoring, behavioral analysis, threat hunting, and automated response on endpoints
Host-Based Firewall: Controls inbound/outbound traffic on individual hosts (Windows Firewall, iptables)
HIDS/HIPS: Host-based intrusion detection/prevention; monitors file integrity, registry, system calls
Application Whitelisting: Only pre-approved applications can execute; blocks all others (strongest against zero-day)
Patch Management: Regular deployment of OS and application patches; use WSUS, SCCM, or third-party tools
Disk Encryption: BitLocker (Windows), FileVault (macOS), LUKS (Linux) to protect data at rest
DLP Agent: Endpoint DLP monitors and blocks sensitive data transfer (USB, email, cloud uploads)

Wireless Network Security

Standard	Encryption	Authentication	Status
WEP	RC4 (24-bit IV)	Shared key	Broken; never use
WPA	TKIP (RC4-based)	PSK or 802.1X	Deprecated
WPA2-Personal	AES-CCMP	Pre-shared key (PSK)	Standard; use with strong passphrase
WPA2-Enterprise	AES-CCMP	802.1X / RADIUS	Best for corporate networks
WPA3-Personal	AES-GCMP-256	SAE (Dragonfly handshake)	Forward secrecy; resists offline attacks
WPA3-Enterprise	AES-GCMP-256	802.1X / RADIUS	192-bit security suite

Wireless Attacks: Evil twin (rogue AP mimicking legitimate SSID), Deauthentication attack (force clients to reconnect to capture handshake), War driving (scanning for open networks), KRACK (WPA2 key reinstallation). Defenses: WPA2/3-Enterprise, WIDS/WIPS, MAC filtering (weak), disable SSID broadcast (weak), use 802.1X with RADIUS.

Cloud Security Fundamentals

Model	Customer Manages	Provider Manages
IaaS (Infrastructure)	OS, apps, data, middleware, runtime	Compute, storage, networking, virtualization
PaaS (Platform)	Apps, data	OS, middleware, runtime, infrastructure
SaaS (Software)	Data, user access	Everything (application through infrastructure)

CASB (Cloud Access Security Broker): Sits between users and cloud services; enforces security policies, monitors usage, detects shadow IT
CSPM (Cloud Security Posture Management): Continuous monitoring for misconfigurations in cloud environments
Shared Responsibility Model: Security is split between cloud provider (security OF the cloud) and customer (security IN the cloud)

IoT & Mobile Security

IoT Risks: Default credentials, unpatched firmware, insecure protocols (Telnet, HTTP), large attack surface, botnets (Mirai)
IoT Defenses: Change defaults, network segmentation (separate IoT VLAN), firmware updates, disable unused services, use encrypted protocols
MDM (Mobile Device Management): Centrally manage mobile devices: enforce encryption, remote wipe, application control, GPS tracking
MAM (Mobile Application Management): Control and secure individual apps rather than full device
BYOD Controls: Containerization (separate work/personal data), VPN required, certificate-based authentication, jailbreak detection

Exam Tip: CND v3 emphasizes securing all endpoints including IoT, mobile, and BYOD devices. Know MDM capabilities and the principle of segmenting IoT devices onto separate VLANs.

Log Management & Analysis

Log Source	What It Records	Key Events to Monitor
Firewall Logs	Allowed/denied connections, source/dest IP, port	Denied connections, unusual ports, repeated blocked attempts
IDS/IPS Logs	Detected attacks, signatures triggered, actions taken	High-severity alerts, repeated signature triggers
Windows Event Logs	Security (4624 logon, 4625 failed, 4720 account created)	Multiple failed logins, privilege escalation, new accounts
Linux Syslog	/var/log/auth.log, /var/log/syslog, /var/log/secure	Failed SSH attempts, sudo usage, cron changes
Web Server Logs	Access logs (requests, IPs, status codes, user agents)	404 bursts (scanning), SQLi patterns, unusual user agents
Proxy Logs	URLs accessed, categories, bytes transferred	Malicious domain access, data exfiltration patterns
DNS Logs	Query records, response codes, queried domains	DNS tunneling, DGA domains, excessive NXDOMAIN responses

Syslog Severity Levels: 0-Emergency, 1-Alert, 2-Critical, 3-Error, 4-Warning, 5-Notice, 6-Informational, 7-Debug. Forward all logs to a centralized SIEM with a retention policy aligned to compliance requirements.

Network Traffic Analysis

Packet Capture (Full): Complete recording of all network traffic. Tools: Wireshark, tcpdump, NetworkMiner. Provides maximum detail but requires large storage.
NetFlow / sFlow / IPFIX: Flow-based metadata (src/dst IP, ports, protocol, byte count, duration). Lightweight; identifies trends and anomalies without full packet capture.
SPAN / Mirror Port: Switch copies traffic from one or more ports to a monitoring port for IDS or packet capture.
Network TAP: Hardware device that creates a physical copy of traffic for monitoring. Passive; does not affect network performance.
Baseline Analysis: Establish normal traffic patterns (bandwidth, protocols, peak times) then detect deviations indicating potential attacks.

Indicator	Possible Threat
Unusual outbound traffic volume	Data exfiltration, C2 communication
DNS queries to random subdomains	DNS tunneling, DGA malware
Repeated connections to known-bad IPs	Botnet C2, compromised host
Port scanning patterns (sequential ports)	Reconnaissance activity
ARP anomalies (duplicate IPs)	ARP spoofing / MITM attempt

Incident Response Process (NIST SP 800-61)

Phase	Activities
1. Preparation	Build IR team (CSIRT), define policies, deploy monitoring tools, conduct training and tabletop exercises, maintain communication plans
2. Detection & Analysis	Identify indicators of compromise (IoCs), analyze alerts from SIEM/IDS, triage severity, correlate events, document findings
3. Containment, Eradication & Recovery	Short-term containment (isolate host), long-term containment (patch, block), eradicate root cause (remove malware, close vulnerability), restore systems from clean backups, verify integrity
4. Post-Incident Activity	Lessons learned meeting, update IR plan, improve detection rules, document timeline and root cause, report to stakeholders

Exam Tip: The CND exam frequently tests the order of incident response phases and which activities belong to which phase. Memorize the NIST framework and understand that containment always comes before eradication.

Vulnerability Management Lifecycle

1. Discovery: Identify all assets on the network (asset inventory, network scanning)
2. Vulnerability Scanning: Use tools (Nessus, Qualys, OpenVAS) to identify known vulnerabilities via CVE database
3. Risk Assessment: Prioritize vulnerabilities using CVSS scores (0-10), asset criticality, and exploit availability
4. Remediation: Apply patches, reconfigure systems, implement compensating controls, or accept risk
5. Verification: Re-scan to confirm vulnerabilities are resolved
6. Reporting: Document findings, track metrics (mean time to remediate), report to management

CVSS (Common Vulnerability Scoring System): 0.0 = None, 0.1-3.9 = Low, 4.0-6.9 = Medium, 7.0-8.9 = High, 9.0-10.0 = Critical. Vulnerability scanning is passive/non-intrusive; penetration testing is active/intrusive and requires authorization.

Digital Forensics Fundamentals

Principle	Description
Chain of Custody	Document every person who handles evidence, when, and what was done; ensures admissibility in court
Order of Volatility	Collect most volatile data first: CPU registers > RAM > swap > disk > logs > network > backups
Forensic Imaging	Bit-for-bit copy of storage media; verify with cryptographic hash (MD5/SHA-256). Work on the copy, not the original.
Write Blockers	Hardware or software that prevents writes to evidence media during imaging
Network Forensics	Analyze packet captures, flow data, DNS logs, and proxy logs to reconstruct attack timeline

Business Continuity & Disaster Recovery

Concept	Definition
BCP (Business Continuity Plan)	Strategy to maintain critical business functions during and after a disaster
DRP (Disaster Recovery Plan)	IT-focused plan to restore systems, data, and infrastructure after a disaster
RPO (Recovery Point Objective)	Maximum acceptable data loss measured in time (e.g., 4 hours = max 4 hours of lost data)
RTO (Recovery Time Objective)	Maximum acceptable downtime before systems must be restored (e.g., 2 hours)
BIA (Business Impact Analysis)	Identifies critical processes, quantifies impact of disruption, determines RPO/RTO

Backup Type	What It Backs Up	Restore Speed	Storage Required
Full	All data	Fastest (single backup)	Most
Incremental	Changes since last backup (any type)	Slowest (full + all incrementals)	Least
Differential	Changes since last full backup	Moderate (full + latest differential)	Moderate

Recovery Site	Description	Recovery Time	Cost
Hot Site	Fully operational duplicate; real-time data replication	Minutes to hours	Highest
Warm Site	Hardware ready; requires data restoration and configuration	Hours to days	Moderate
Cold Site	Empty facility with power/network; requires full hardware and data setup	Days to weeks	Lowest

IDS vs IPS vs Firewall

Feature	Firewall	IDS	IPS
Primary Function	Allow/deny based on rules	Detect and alert	Detect and block
Placement	Inline (network boundary)	Out of band (SPAN/TAP)	Inline (in traffic path)
Action on Threat	Blocks based on IP/port rules	Logs alert; no blocking	Drops malicious packets
Inspection Depth	Headers (L3-4); NGFW adds L7	Full packet (DPI)	Full packet (DPI)
Latency Impact	Minimal	None (passive)	Slight (inline processing)

RADIUS vs TACACS+ vs Kerberos

Feature	RADIUS	TACACS+	Kerberos
Transport	UDP 1812/1813	TCP 49	UDP 88
Encryption	Password only	Full packet body	Symmetric key tickets
AAA Handling	Combined auth + authz	Separate auth, authz, acct	Mutual authentication
Granularity	Less granular	Per-command authorization	Service ticket-based
Typical Use	Network access (802.1X, VPN)	Device admin (router/switch CLI)	Windows AD authentication
Vendor	Open standard (RFC)	Cisco proprietary	Open standard (MIT/RFC)

Symmetric vs Asymmetric Encryption

Feature	Symmetric	Asymmetric
Keys	One shared secret key	Public + Private key pair
Speed	Fast (bulk data encryption)	Slow (key exchange, signatures)
Key Distribution	Difficult (must share securely)	Easy (public key is shareable)
Algorithms	AES (128/192/256), 3DES, Blowfish, ChaCha20	RSA, ECC, Diffie-Hellman, DSA
Use Case	Data encryption at rest and in transit	Key exchange, digital signatures, certificates

Hashing (integrity, not encryption): MD5 (128-bit, broken), SHA-1 (160-bit, deprecated), SHA-256 (256-bit, standard), SHA-3 (latest). Hashing is one-way and produces a fixed-length digest. Used for password storage, file integrity, digital signatures.

VPN Protocols Compared

Protocol	Transport	Encryption	Use Case	NAT Traversal
IPsec (ESP)	IP Protocol 50	AES, 3DES	Site-to-site VPN	Requires NAT-T (UDP 4500)
SSL/TLS VPN	TCP 443	AES (TLS 1.2/1.3)	Remote access	Excellent (uses HTTPS)
L2TP/IPsec	UDP 1701 + IPsec	IPsec provides encryption	Remote access	Problematic behind NAT
OpenVPN	UDP 1194 / TCP 443	OpenSSL (AES-256)	Remote access	Excellent
WireGuard	UDP 51820	ChaCha20, Curve25519	Remote access	Excellent

NIDS vs HIDS

Feature	NIDS (Network-Based)	HIDS (Host-Based)
Deployment	Network segment (SPAN port / TAP)	Installed on individual host
Monitors	Network traffic (packets, flows)	File integrity, logs, processes, registry
Encrypted Traffic	Cannot inspect without TLS termination	Can see decrypted data on host
Scope	Broad (entire network segment)	Narrow (single host)
Performance	No host resource impact	Consumes host CPU/memory
Tools	Snort, Suricata, Zeek (Bro)	OSSEC, Wazuh, Tripwire, AIDE

Vulnerability Scan vs Penetration Test

Feature	Vulnerability Scan	Penetration Test
Approach	Automated tool scan	Manual + automated; simulates real attack
Scope	Broad (entire network)	Targeted (specific systems or scope)
Exploitation	No (identifies only)	Yes (attempts to exploit vulnerabilities)
Frequency	Regular (weekly/monthly)	Periodic (annually or after changes)
Risk	Low (non-intrusive)	Higher (may disrupt services)
Output	List of vulnerabilities + CVSS scores	Detailed report with exploited paths + business impact
Tools	Nessus, Qualys, OpenVAS	Metasploit, Burp Suite, Cobalt Strike

Hot Site vs Warm Site vs Cold Site

Feature	Hot Site	Warm Site	Cold Site
Infrastructure	Full hardware + live data	Hardware ready; no live data	Empty facility (power + cooling)
Recovery Time	Minutes to hours	Hours to days	Days to weeks
Cost	Highest (duplicate everything)	Moderate	Lowest
Data Currency	Real-time replication	Periodic backups (some data loss)	Restore from offsite backups
Best For	Mission-critical systems (near-zero RTO)	Important systems (moderate RTO)	Non-critical systems (high RTO acceptable)

Exam Tip: The Key Comparisons section topics are among the most frequently tested on the CND exam. Know the differences between IDS vs IPS, RADIUS vs TACACS+, symmetric vs asymmetric, vulnerability scan vs pentest, and all three recovery site types.

312-38v3

CND v3 - Certified Network Defender

CND v3 Practice Exam 1

CND v3 Practice Exam 2

CND v3 Practice Exam 3

CND v3 Practice Exam 4

CND v3 Practice Exam 5

CND v3 Practice Exam 6

Unlock All Content for 312-38v3

Preview (10 / 120)

Flash Cards

Available Languages

Exam Topics

312-38v3 Cheat Sheet

CND v3 (312-38v3) Exam Details

CND v3 Domain Breakdown

About the CND Certification

OSI Model & Security Relevance

TCP/IP Model & Protocol Stack

Common Ports (Must Know)

Defense-in-Depth Strategy

Security Policies & Risk Assessment

Network Threat Landscape

Firewall Types & Generations

IDS vs IPS: Detection Methods

VPN Technologies & Protocols

Network Segmentation & DMZ Architecture

Proxy Servers & Honeypots

SIEM (Security Information & Event Management)

Access Control Models

AAA: Authentication Protocols

Endpoint Security

Wireless Network Security

Cloud Security Fundamentals

IoT & Mobile Security

Log Management & Analysis

Network Traffic Analysis

Incident Response Process (NIST SP 800-61)

Vulnerability Management Lifecycle

Digital Forensics Fundamentals

Business Continuity & Disaster Recovery

IDS vs IPS vs Firewall

RADIUS vs TACACS+ vs Kerberos

Symmetric vs Asymmetric Encryption

VPN Protocols Compared

NIDS vs HIDS

Vulnerability Scan vs Penetration Test

Hot Site vs Warm Site vs Cold Site