CNDA Practice Test

CNDA Exam at a Glance

What changed for CNDA in 2026

• Oct 26, 2026: Exam fee changed to $200 processing fee (previously USD 200 processing fee).^[1]
• Oct 26, 2026: Validity changed to Valid for as long as holder's CEH certification (previously Valid for as long as the holder's CEH certification).^[1]

What the CNDA is and how it works

According to EC-Council, “You need to first obtain CEH certification from EC-Council and must be employed by a government or military agency or be a contract employee of the Government.”^[1]

The CNDA is issued by EC-Council. It is not a sit-down test. You apply by email, and there is no separate exam to schedule.

Eligibility. You must already hold the CEH certification from EC-Council. You must also be employed by a government or military agency, or be a contract employee of the government. If you do not meet both conditions, the application does not apply to you.

Application and fee. You email the completed application documents to cnda@eccouncil.org. The processing fee is $200. If your application is accepted, the CNDA welcome kit arrives by registered mail within 4 weeks.

Renewal and validity. There is no annual renewal for the CNDA. Its validity is the same as your CEH certification, so it stays valid for as long as your CEH does.

What this page does not cover. We have no verified list of official content areas, scoring rules or retake rules for the CNDA, so we do not state any. Check the official EC-Council CNDA page and the application form before you apply, because requirements and fees can change. Our practice sets are written by us with AI tools. They are study aids, not real exam questions, and they do not replace the official material.

Worked examples: how to reason through CNDA questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: Which framework categorizes threat actors and their motivations into APT groups with numbered designations?

1. NIST CSF
2. MITRE ATT&CK with Group designations (e.g., APT28)
3. OWASP Top 10
4. CVE numbering system

Answer: B. MITRE ATT&CK with Group designations (e.g., APT28)

Explanation:

MITRE ATT&CK with Group designations is correct. It catalogs threat actor groups, such as APT28, together with the tactics, techniques and procedures they are known to use. Defenders can then tailor controls to the groups most likely to target them.

NIST CSF is a risk management framework for organizing security activities. It does not track named adversary groups. The OWASP Top 10 lists common web application risks and says nothing about who the attackers are. The CVE system numbers individual vulnerabilities, not actors.

Rule to remember: if the question is about who is attacking and how they behave, think ATT&CK. If it is about a specific flaw, think CVE. If it is about program structure, think a framework like NIST CSF.

Example 2

Question: What is the primary goal of the 'lessons learned' phase in NIST's incident response process?

1. To assign blame for the incident
2. To document findings and improve defenses, processes, and detection capabilities for future incidents
3. To complete regulatory reporting
4. To calculate the financial cost of the breach

Answer: B. To document findings and improve defenses, processes, and detection capabilities for future incidents

Explanation:

The correct answer is to document findings and improve defenses, processes and detection capabilities. The lessons learned phase turns what happened during the incident into changes. Those changes include updated playbooks, tighter controls and better detection logic, so the same event is less likely to recur.

Assigning blame is wrong because the phase is about process and systems, not punishing people. Regulatory reporting may happen around an incident, but it is a separate obligation, not the goal of this phase. Calculating the financial cost can be a useful output, but it is not the primary purpose.

Rule to remember: the last phase of incident response feeds back into preparation. If an answer looks backward at fault or paperwork, and another looks forward at improvement, choose improvement.

Example 3

Question: What firewall feature prevents internal hosts from using unauthorized DNS servers?

1. DNS sinkholing
2. DNS proxy or DNS inspection policy
3. DNSSEC validation
4. Split DNS

Answer: B. DNS proxy or DNS inspection policy

Explanation:

A DNS proxy or DNS inspection policy is correct. The firewall intercepts DNS queries from internal hosts and redirects them to approved resolvers. This blocks use of unauthorized DNS servers and also helps against DNS tunneling and command-and-control traffic.

DNS sinkholing works differently. It answers queries for known malicious domains with a harmless address, but it does not force every host to use approved resolvers. DNSSEC validation checks that DNS answers are authentic. It does not control which server a host asks. Split DNS gives different answers to internal and external clients, which is a naming design choice, not an enforcement control.

Rule to remember: to control where queries go, enforce it at the firewall. To check answers, use DNSSEC.

How to use these practice tests

Start with the eligibility facts, because they decide whether you can apply at all. Confirm that your CEH is current and that your employer qualifies, then read the official CNDA page and application form so you know what to email and what the fee covers.

Then use the practice sets by topic rather than all at once. Begin with Network Security Architecture, since firewalls, VPNs and monitoring all build on it. Move to Firewall Technologies and IDS/IPS, then VPN and Cryptographic Protocols, then Intrusion Detection and Incident Response. Finish with Threat Intelligence and Vulnerability Management, Risk Management and Compliance, and Wireless Network Security.

After each set, read the explanation for every question you missed, not only the answer. Write a short note on the rule behind each miss, such as which control enforces a policy and which only detects. Return to the same set after a few days and see whether those notes hold up.

Our questions are written by us with AI tools and are not real exam questions, so treat them as practice for reasoning, not a preview. Keep your CEH study material and the official EC-Council documents as your reference for anything you are unsure about.

Sources & last verified

1. EC-Council — exam fee, validity, renewal, eligibility (official source). “The CNDA processing fee is USD 200 and is payable at here.” Verified Oct 26, 2026.
2. EC-Council — delivery (official source). “Email the above documents to cnda@eccouncil.org If your application is accepted then you will receive your CNDA welcome kit by Registered Mail within 4 weeks.” Verified Oct 26, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.