01Network defense scope and asset context
Start with a reliable inventory of address spaces, network devices, services, owners and business dependencies. Separate a threat scenario from an observed incident, and map the exposed path through a trust boundary before selecting controls.
Practice exerciseUsing a fictional office-and-cloud diagram, label crown-jewel systems, internet-facing paths and owners. Write three questions the network team must answer before changing any rule.
Learning outcomeExplain why a technically correct firewall change can still fail when ownership, dependencies or change windows are unknown.
02Policies, segmentation and identity
Translate least privilege into network zones, management-plane isolation and access review. Compare where an identity check, a firewall rule and a separate administrative network each reduce risk; one does not replace the others.
Practice exerciseDesign a small fictional segmentation matrix for user, server and administrative zones. Document one allowed flow per business need and one safe validation step.
Learning outcomeJustify a narrower access path and recognize when an apparently blocked route is still reachable through a trusted intermediary.
03Perimeter and network control choices
Evaluate firewall, IDS/IPS, VPN, secure DNS and gateway controls by placement, visibility and failure mode. Distinguish an alerting control from a blocking control and discuss what happens when traffic is encrypted or bypasses the perimeter.
Practice exerciseFor four synthetic traffic flows, choose a control and a measurable acceptance test; include a rollback condition for a false-positive block.
Learning outcomeSelect controls based on the flow and evidence instead of assuming one perimeter appliance protects every workload.
04Endpoint and data protection
Connect host hardening, patch governance, mobile and IoT constraints, encryption, backups and recovery to network defense. Prioritize changes by exposure and business impact rather than by a scanner score alone.
Practice exerciseReview a fabricated asset list with missing patches and exposed administrative services. Rank three remediations and identify the owner and retest evidence for each.
Learning outcomeExplain how an endpoint weakness and a permissive network route combine into a larger incident path.
05Hybrid cloud and wireless boundaries
Assess virtual networking, cloud shared responsibility, wireless authentication and guest isolation. Track the effective route from an identity to a workload across on-premises and cloud connections.
Practice exerciseGiven a sample remote-office-to-cloud design, draw the permitted data path and identify two observations that would reveal unintended reachability.
Learning outcomeDescribe the control owner and evidence source for a hybrid-network exposure without claiming the cloud provider secures customer configuration.
06Traffic, logs and detection
Establish a baseline, retention expectations and time synchronization before interpreting traffic anomalies. Correlate router, firewall, server and endpoint records to test a hypothesis; do not treat a single alert as proof.
Practice exerciseUse a synthetic time-stamped firewall and server log set to distinguish a legitimate maintenance transfer from an unusual outbound flow. Note one missing data source.
Learning outcomeProduce a short detection rationale with confidence, alternative explanations and the next safe validation step.
07Incident handling and continuity
Practice triage, escalation, containment and evidence preservation as an ordered process. Weigh a fast network block against the operational cost of interrupting a critical service, then plan recovery and verification.
Practice exerciseDraft a fictional incident handoff containing observed scope, affected owners, containment options, evidence location, rollback trigger and a business-continuity contact.
Learning outcomeChoose a proportionate first response and document why it is reversible, authorized and measurable.
08Blueprint-led review and exam readiness
Compare each weak domain against the current official CND blueprint, revisit mistakes with evidence and practice making a defensive decision under a time limit. Do not rely on recalled exam questions or copied dumps.
Practice exerciseCreate a two-week revision grid that links each missed scenario to a blueprint section, a fresh synthetic exercise and a final teach-back explanation.
Learning outcomeDemonstrate a reasoned network-defense decision rather than memorizing a vendor-specific tool command.