Question 1
During a network forensic investigation, which artifact provides the most complete ground truth of exactly what bytes traversed the wire, allowing full session reconstruction?
Correct Answer:
Full packet capture (PCAP) collected at a monitored network point
Question 2
In a TCP three-way handshake, what is the correct sequence of flags exchanged between a client initiating a connection and a server?
Correct Answer:
SYN, SYN/ACK, ACK
Question 3
An examiner wants to isolate only DNS queries in a large capture using Wireshark. Which display filter expression accomplishes this?
Correct Answer:
dns
Question 4
Which network protocol and default port combination should an examiner expect when investigating an encrypted remote administration session?
Correct Answer:
SSH on TCP 22
Question 5
What is the primary forensic advantage of deploying a network TAP instead of configuring a SPAN (mirror) port on a switch for evidence capture?
Correct Answer:
A TAP copies all traffic including physical-layer errors without dropping packets under load, and is passive on the wire
Question 1
Exam overview

About this Exam

Prepare with the CDFE Practice Questions - PECB Certified Digital Forensics Examiner (CDFE) Exam practice quiz. This question bank includes 100 questions covering examiner, memory, file, image, and windows. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

CDFE Practice Questions - PECB Certified Digital Forensics Examiner (CDFE) Exam

This practice set contains 100 questions from the matching question bank and focuses on examiner, memory, file, image, and windows. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions