10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The C)NFE exam has 100 questions and runs 2 hours.
These 10 free C)NFE questions are organized by exam domain, so you can see how each part of the Certified Network Forensics Examiner blueprint is tested. Reveal the answer and explanation under each question.
A forensic examiner defines scope, identifies evidence sources, and establishes investigative objectives before collecting data. Which methodology is being applied?
Correct answer: A - OSCAR network forensic methodology
Adding headers as data moves down network layers and removing them during receipt describes which concept?
Correct answer: A - Encapsulation and de-encapsulation
Which tool is designed to capture packets from a network interface using libpcap?
Correct answer: A - tcpdump
A running server may contain valuable volatile evidence that would disappear after shutdown. What should the examiner prioritize?
Correct answer: A - Live acquisition of volatile information
An analyst reviews packet details, flows, and application-layer behavior to reconstruct an incident. What activity is this?
Correct answer: A - Network traffic analysis
An investigation focuses on Spanning Tree Protocol manipulation on a switch. Which area is involved?
Correct answer: A - Layer 2 protocol analysis
When analyzing an 802.11 capture, which evidence is most relevant?
Correct answer: A - Wireless frames and associated traffic
A NIDS alert identifies suspicious traffic. What evidence should validate the activity?
Correct answer: A - Packet captures and NIDS evidence
Why collect router, firewall, and server logs in a centralized repository?
Correct answer: A - To correlate distributed events
Evidence collected from a router involved in suspicious routing activity belongs to which investigation area?
Correct answer: A - Investigating network devices
The C)NFE exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more C)NFE questions with explanations.
Continue in the free practice test →
View plans