The CNDA, Certified Network Defense Architect, is an EC-Council credential for CEH holders who work for a government or military agency. This page explains who is eligible, what the application costs and how validity works. It also links to free practice sets on firewalls, intrusion detection, VPNs, risk, threat intelligence and wireless security.
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Exam fee | $200 processing fee[1] | EC-Council · Oct 26, 2026 |
| Validity | Valid for as long as holder's CEH certification[1] | EC-Council · Oct 26, 2026 |
| Renewal | No annual renewal; follows CEH validity[1] | EC-Council · Oct 26, 2026 |
| Delivery | Application by email (no separate exam); welcome kit by registered mail within 4 weeks[2] | EC-Council · Oct 26, 2026 |
| Eligibility | Must hold CEH and work for a government or military agency (employee or contractor)[1] | EC-Council · Oct 26, 2026 |
According to EC-Council, “You need to first obtain CEH certification from EC-Council and must be employed by a government or military agency or be a contract employee of the Government.”[1]
The CNDA is issued by EC-Council. It is not a sit-down test. You apply by email, and there is no separate exam to schedule.
Eligibility. You must already hold the CEH certification from EC-Council. You must also be employed by a government or military agency, or be a contract employee of the government. If you do not meet both conditions, the application does not apply to you.
Application and fee. You email the completed application documents to cnda@eccouncil.org. The processing fee is $200. If your application is accepted, the CNDA welcome kit arrives by registered mail within 4 weeks.
Renewal and validity. There is no annual renewal for the CNDA. Its validity is the same as your CEH certification, so it stays valid for as long as your CEH does.
What this page does not cover. We have no verified list of official content areas, scoring rules or retake rules for the CNDA, so we do not state any. Check the official EC-Council CNDA page and the application form before you apply, because requirements and fees can change. Our practice sets are written by us with AI tools. They are study aids, not real exam questions, and they do not replace the official material.
Prepare for the CNDA - Certified Network Defense Architect exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: Which framework categorizes threat actors and their motivations into APT groups with numbered designations?
Answer: B. MITRE ATT&CK with Group designations (e.g., APT28)
Explanation:
MITRE ATT&CK with Group designations is correct. It catalogs threat actor groups, such as APT28, together with the tactics, techniques and procedures they are known to use. Defenders can then tailor controls to the groups most likely to target them.
NIST CSF is a risk management framework for organizing security activities. It does not track named adversary groups. The OWASP Top 10 lists common web application risks and says nothing about who the attackers are. The CVE system numbers individual vulnerabilities, not actors.
Rule to remember: if the question is about who is attacking and how they behave, think ATT&CK. If it is about a specific flaw, think CVE. If it is about program structure, think a framework like NIST CSF.
Question: What is the primary goal of the 'lessons learned' phase in NIST's incident response process?
Answer: B. To document findings and improve defenses, processes, and detection capabilities for future incidents
Explanation:
The correct answer is to document findings and improve defenses, processes and detection capabilities. The lessons learned phase turns what happened during the incident into changes. Those changes include updated playbooks, tighter controls and better detection logic, so the same event is less likely to recur.
Assigning blame is wrong because the phase is about process and systems, not punishing people. Regulatory reporting may happen around an incident, but it is a separate obligation, not the goal of this phase. Calculating the financial cost can be a useful output, but it is not the primary purpose.
Rule to remember: the last phase of incident response feeds back into preparation. If an answer looks backward at fault or paperwork, and another looks forward at improvement, choose improvement.
Question: What firewall feature prevents internal hosts from using unauthorized DNS servers?
Answer: B. DNS proxy or DNS inspection policy
Explanation:
A DNS proxy or DNS inspection policy is correct. The firewall intercepts DNS queries from internal hosts and redirects them to approved resolvers. This blocks use of unauthorized DNS servers and also helps against DNS tunneling and command-and-control traffic.
DNS sinkholing works differently. It answers queries for known malicious domains with a harmless address, but it does not force every host to use approved resolvers. DNSSEC validation checks that DNS answers are authentic. It does not control which server a host asks. Split DNS gives different answers to internal and external clients, which is a naming design choice, not an enforcement control.
Rule to remember: to control where queries go, enforce it at the firewall. To check answers, use DNSSEC.
Start with the eligibility facts, because they decide whether you can apply at all. Confirm that your CEH is current and that your employer qualifies, then read the official CNDA page and application form so you know what to email and what the fee covers.
Then use the practice sets by topic rather than all at once. Begin with Network Security Architecture, since firewalls, VPNs and monitoring all build on it. Move to Firewall Technologies and IDS/IPS, then VPN and Cryptographic Protocols, then Intrusion Detection and Incident Response. Finish with Threat Intelligence and Vulnerability Management, Risk Management and Compliance, and Wireless Network Security.
After each set, read the explanation for every question you missed, not only the answer. Write a short note on the rule behind each miss, such as which control enforces a policy and which only detects. Return to the same set after a few days and see whether those notes hold up.
Our questions are written by us with AI tools and are not real exam questions, so treat them as practice for reasoning, not a preview. Keep your CEH study material and the official EC-Council documents as your reference for anything you are unsure about.
You must hold the CEH certification from EC-Council and be employed by a government or military agency, or be a contract employee of the government. Both conditions apply. If you work in the private sector without a government contract, you do not meet the stated requirement.
No separate exam is described. The process is an application sent by email to cnda@eccouncil.org with the required documents. If EC-Council accepts it, your welcome kit arrives by registered mail within 4 weeks. Our practice sets are for building skills, not for a scheduled test.
The CNDA processing fee is $200, according to the EC-Council CNDA page. Check that page for payment details before you apply, since fees can change. We do not list other costs because none are in our verified facts.
No. There is no annual renewal for the CNDA. Its validity is the same as your CEH certification, so it remains valid for as long as your CEH is valid. Keeping your CEH current is what keeps the CNDA current.
No. We write them with AI tools to practise topics like firewalls, intrusion detection, VPNs, risk and threat intelligence. They are not taken from any official test. Use them to check your reasoning, and rely on EC-Council for official requirements.
How we verify: editorial & fact-checking policy. Report an error: contact us.