CDFE Practice Questions - PECB Certified Digital Forensics Examiner (CDFE) Exam

Access More Questions

What is the primary forensic advantage of deploying a network TAP instead of configuring a SPAN (mirror) port on a switch for evidence capture?

A TAP encrypts captured traffic so it remains admissible in court A TAP copies all traffic including physical-layer errors without dropping packets under load, and is passive on the wire A TAP automatically timestamps packets with a court-certified clock source A TAP filters malicious traffic so the examiner only stores relevant packets

Correct Answer:

A TAP copies all traffic including physical-layer errors without dropping packets under load, and is passive on the wire

Access more questions from this quiz

Continue to CDFE Practice Questions - PECB Certified Digital Forensics Examiner (CDFE) Exam for more practice questions and the full quiz experience.

Access More Questions