Reinforce CND concepts with active-recall study cards covering all 8 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For CND preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the CND question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your CND flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real CND exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass CND.
Sample cards from the CND flashcard bank. Read the question, think of the answer, then read the explanation below.
An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?
Azure Site Recovery (ASR)
Azure Site Recovery (ASR) is the Azure service designed for disaster recovery of VMs, replicating VM disks asynchronously to a secondary region without requiring secondary VMs to run continuously. It continuously replicates changes to a target region, and on failover it provisions the secondary VMs from the replicated disks, enabling recovery with minimal downtime. This matches the requirement of asynchronous cross-region disk replication with no always-on secondary VMs.
An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?
Tune the IDS sensor signature policies to exclude the internal vulnerability scanner's source IP addresses
Tuning the IDS signature policies to exclude the internal vulnerability scanner's source IP addresses suppresses alerts generated by authorized scanning activity while keeping all detection signatures active for real threats. This directly reduces false positive fatigue without weakening the IDS's ability to detect actual attacks.
An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?
Identifying and cataloging all network assets, data flows, and current vulnerabilities
The Assessment and Analysis phase of the Network Defense Lifecycle is the discovery and baseline phase: you must inventory assets, map data flows, and identify current vulnerabilities before you can design or deploy defenses. Without this baseline, subsequent phases (design, implementation, monitoring) lack the context to prioritize controls. This aligns with frameworks like NIST CSF's Identify function and the CND methodology's emphasis on situational awareness first.
A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?
stats sum(bytes) by dest_ip
The stats command in Splunk is used for aggregating and summarizing data. Using 'stats sum(bytes) by dest_ip' calculates the total outbound bytes for each destination IP address, directly fulfilling the requirement. This is the standard SPL syntax for grouped aggregation.
During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?
Enforce Instance Metadata Service Version 2 (IMDSv2) requiring session tokens and configure strict URL parsing libraries on the web application.
IMDSv2 requires a session token obtained via a PUT request before metadata can be retrieved, which defeats most SSRF attacks that can only issue simple GET requests. Combining IMDSv2 with strict URL parsing and allow-listing on the web application prevents attackers from crafting requests to 169.254.169.254, addressing both the architectural and application-layer causes.
An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?
McAfee DLP Endpoint Client
The McAfee DLP Endpoint Client is the agent installed on each workstation that performs local inspection and enforcement, including blocking writes to USB mass storage devices. It enforces policy at the endpoint without requiring a round trip to a network appliance. This is the component that actually intercepts the file-copy operation on the host.
An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?
Windows PowerShell Operational Log (Event ID 4104)
The Windows PowerShell Operational Log records script block logging events, specifically Event ID 4104, which captures the decoded contents of script blocks executed by PowerShell. When an encoded command is run, PowerShell decodes it internally, and if script block logging is enabled, the decoded script is written to this log. This makes Event ID 4104 the correct source for retrieving the actual script contents, not just the encoded command line.
An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?
ufw allow from 192.168.100.0/24 to any port 22 proto tcp
The correct UFW syntax to allow SSH from a specific subnet is `ufw allow from 192.168.100.0/24 to any port 22 proto tcp`. This rule specifies the source subnet, the destination (any), the port (22), and the protocol (TCP), which is exactly what UFW expects for a scoped allow rule.
The CND flashcard bank covers all 8 official blueprint domains published by EC-Council. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Enterprise Cloud Virtual And Wireless Network Protection
Network Security Controls Protocols And Devices
Network Defense Management
Incident Detection Response And Threat Prediction
Network Attacks And Defense Strategies
Application And Data Protection
Endpoint Protection
Network Perimeter Protection
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that CND questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.CND questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective CND study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free CND flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 311+ original CND flashcards across all 8 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are checked against the official EC-Council exam objectives, with editorial oversight from an experienced network and security engineer.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official CND exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included