Skip to main content
Ace Skills Consulting
EC-Council logoIntermediate

312-38: Certified Network Defender (CND)

Defend enterprise networks with layered controls, monitoring and incident response — and prepare for the CND 312-38 exam.

  • 40 hours of live, defence-focused training
  • Protect, detect, respond and predict approach
  • Firewall, IDS, endpoint and cloud security labs
  • Monitoring and incident response exercises
  • Practice questions mapped to the exam areas
Aligned to EC-Council exam 312-38
Duration
5 Days | 40 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Intermediate
Exam
312-38
Language
English

Why learn 312-38 with Ace Skills

  • Defence in depth

    Build layered controls from policy and perimeter to endpoints and data.

  • Network-centric skills

    Configure firewalls, IDS, VPNs and segmentation in a working lab network.

  • Detect and respond

    Monitor traffic and logs, then handle incidents with a structured process.

  • Exam-aligned preparation

    Topics follow the published CND exam areas with regular practice questions.

Course overview

Network defenders keep the organisation running while attackers probe it every day. Their work spans policy, perimeter controls, endpoints, applications, cloud and wireless networks, along with monitoring that spots trouble early and a response process that limits damage. This five-day course is exam-aligned preparation for the Certified Network Defender 312-38 exam, built on the protect, detect, respond and predict approach.

Day one covers network attacks and defence strategies, administrative security controls such as policies and compliance, and physical security. Day two focuses on technical controls at the perimeter and inside the network: firewalls, IDS and IPS, VPNs, network segmentation and access control. Day three addresses endpoint security for Windows, Linux, mobile and IoT devices, followed by application and data security.

Day four covers enterprise virtual networks, cloud and wireless security, then traffic and log monitoring to detect anomalies. Day five turns to incident response and forensic readiness, business continuity and disaster recovery, and anticipating threats through risk assessment, attack surface analysis and threat intelligence, finishing with exam readiness.

Labs give you practical experience configuring and monitoring defences in a lab network. This is independent, exam-aligned training; it does not use EC-Council courseware and Ace Skills Consulting does not claim to be an EC-Council Accredited Training Centre. Exam registration is handled through EC-Council’s official channels, so confirm the current version and requirements with EC-Council before booking.

Key features

  • Layered defence labs in a lab network
  • Firewall and IDS configuration exercises
  • Endpoint hardening for Windows and Linux
  • Log and traffic monitoring with a SIEM
  • Incident response and continuity planning
  • Practice questions with explanations
  • Course completion certificate from Ace Skills Consulting

Who should attend

  • Network administrators and engineers
  • Security operations and SOC staff
  • System administrators responsible for network security
  • IT professionals moving into defensive security

Prerequisites

  • Networking fundamentals including TCP/IP and routing
  • Familiarity with Windows and Linux administration

Curriculum

5 Days · 40 Hours · 14 Modules · 7 Labs

  1. Network attacks and defence strategies

    • Common network attack types
    • Defence-in-depth strategy
    • Protect, detect, respond and predict approach

    Administrative network security

    • Security policies and procedures
    • Regulatory frameworks and compliance
    • Security awareness
    • Lab: Draft an acceptable use and remote access policy · 30 min

    Physical security

    • Physical access controls
    • Environmental controls
    • Workplace security

  2. Access control and segmentation

    • Authentication and authorisation models
    • Network segmentation and VLANs
    • Network access control
    • VPN technologies
    • Lab: Segment a network and configure a site-to-site VPN · 50 min

    Firewalls and IDS/IPS

    • Firewall types and rule design
    • IDS and IPS deployment
    • Proxy servers and content filtering
    • Honeypots
    • Lab: Configure pfSense rules and Snort detection · 60 min

  3. Endpoint security

    • Windows hardening and group policy
    • Linux hardening
    • Mobile device management
    • IoT device security
    • Lab: Harden Windows and Linux endpoints against a baseline · 50 min

    Application security

    • Application allow listing
    • Web application firewalls
    • Secure patch management

    Data security

    • Data classification
    • Encryption at rest and in transit
    • Data loss prevention
    • Backup and retention
    • Lab: Encrypt data and configure backups · 30 min

  4. Virtual and cloud networks

    • Virtualisation and container security
    • Software-defined networking
    • Cloud security controls and shared responsibility

    Wireless security

    • Wireless encryption standards
    • Wireless intrusion prevention
    • Rogue access point detection

    Traffic and log monitoring

    • Baselining normal traffic
    • Detecting anomalies with Wireshark
    • Centralised logging and SIEM
    • Alert tuning
    • Lab: Detect suspicious traffic and correlate logs in a SIEM · 60 min

  5. Incident response and forensic readiness

    • Incident handling process
    • Forensic readiness planning
    • Evidence preservation
    • Lab: Handle a simulated network intrusion · 45 min

    Business continuity and disaster recovery

    • Business impact analysis
    • Continuity and recovery planning
    • Testing plans

    Anticipating threats and exam readiness

    • Risk assessment and management
    • Attack surface analysis
    • Cyber threat intelligence
    • Practice questions and review
Download full syllabus (PDF)

Skills you will gain

  • Network defence
  • Security policy
  • Firewall configuration
  • IDS/IPS
  • VPN
  • Network segmentation
  • Endpoint hardening
  • Data protection
  • Wireless security
  • Traffic monitoring
  • SIEM
  • Incident response
  • Business continuity

Tools & technologies

  • pfSense
  • Snort
  • Wireshark
  • Wazuh
  • Windows Group Policy
  • OpenVPN
  • Nmap

Certification exam

Exam details
Exam nameCertified Network Defender (CND)
Exam code312-38
Voucher includedNo — book directly with the vendor
Question formatMultiple choice

Skill areas measured

  1. Network attacks and defence strategies
  2. Administrative and physical network security
  3. Technical network security and perimeter protection
  4. Endpoint security (Windows, Linux, mobile and IoT)
  5. Application and data security
  6. Virtual, cloud and wireless network security
  7. Network traffic and log monitoring
  8. Incident response, business continuity and risk management
  9. Threat assessment with attack surface analysis and threat intelligence

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 40 hours of live, trainer-led sessions
  • 7 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 2 · 60 min

    Configure pfSense rules and Snort detection

  • Day 4 · 60 min

    Detect suspicious traffic and correlate logs in a SIEM

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The EC-Council certification itself is awarded by EC-Council when you pass exam 312-38.

Frequently asked questions

How do I register for the CND exam?

You register through EC-Council’s official channels, which also set eligibility requirements. We explain the steps, but vouchers and approvals come from EC-Council.

Is this official EC-Council training?

No. This is independent, exam-aligned preparation using our own material and labs.

How does CND compare with CEH?

CND focuses on defending networks, while CEH focuses on attack techniques. Many professionals take CND first, then CEH.

Is the course suitable for network engineers without security experience?

Yes. Networking knowledge is the main prerequisite, and security concepts are introduced from the basics.

Can you train our network operations team?

Yes. Private batches can use your firewall and monitoring platforms as examples.

Related courses

Explore more

All Cybersecurity courses EC-Council certifications

CEH, CHFI and CND are trademarks of the International Council of E-Commerce Consultants (EC-Council).

Train your team on 312-38

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.