PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free CDFE Practice Questions

Prepare for the PECB Certified Digital Forensics Examiner (CDFE) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
Not published Pass Rate
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More PECB Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

PECB ISO/IEC 27001 Lead Implementer

Practice QuestionsStudy Guide

PECB ISO/IEC 27001 Lead Auditor

Practice QuestionsStudy Guide

PECB Certified ISO/IEC 27001 Foundation

Practice QuestionsStudy GuideFlashcards

PECB Certified ISO/IEC 42001 Lead Implementer (AI Management)

Practice QuestionsStudy GuideCheat SheetFlashcards

PECB ISO/IEC 42001 Lead Auditor (AI Management)

Practice Questions

PECB Certified ISO/IEC 27701 Lead Auditor (PIMS)

Practice Questions
2026 Statistics

Key Facts: CDFE Exam

20Q, 3 hours

Exam Format

PECB

70%

Passing Score

PECB

USD 1000 exam-only

Exam Fee

PECB

PECB Certified Digital Forensics Examiner (CDFE) certification exam evaluates candidates on official PECB domains and standards. Note: this practice set is an English-language MCQ study adaptation.

Sample CDFE Practice Questions

Try these sample questions to test your CDFE exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1During a network forensic investigation, which artifact provides the most complete ground truth of exactly what bytes traversed the wire, allowing full session reconstruction?
A.NetFlow records exported from the core router
B.Full packet capture (PCAP) collected at a monitored network point
C.Syslog entries from the perimeter firewall
D.DNS resolver cache on the client workstation
Explanation: Full packet capture records every byte of every packet, including payloads, which enables complete session reconstruction, file extraction, and protocol decoding. Flow data and logs only summarize connections and cannot recover content.
2In a TCP three-way handshake, what is the correct sequence of flags exchanged between a client initiating a connection and a server?
A.SYN, ACK, FIN
B.ACK, SYN/ACK, SYN
C.SYN, SYN/ACK, ACK
D.SYN, RST, ACK
Explanation: A TCP connection begins when the client sends a SYN segment, the server replies with SYN/ACK acknowledging the request and offering its own sequence number, and the client completes the handshake with an ACK. Recognizing this sequence in a packet capture lets an examiner distinguish normal connection establishment from scans or anomalous traffic.
3An examiner wants to isolate only DNS queries in a large capture using Wireshark. Which display filter expression accomplishes this?
A.tcp.port == 53
B.dns
C.ip.proto == 53
D.udp contains dns
Explanation: Wireshark display filters work on dissected protocol fields, and the 'dns' filter shows packets the dissector has identified as DNS regardless of transport port. This catches DNS over non-standard ports that a simple port filter would miss.
4Which network protocol and default port combination should an examiner expect when investigating an encrypted remote administration session?
A.Telnet on TCP 23
B.SSH on TCP 22
C.RDP on UDP 3389 only
D.FTP on TCP 21
Explanation: SSH provides encrypted remote shell and tunneling over TCP port 22 by default. In an investigation, SSH traffic shows an encrypted payload after a visible banner exchange, which limits content analysis but still yields metadata such as endpoints, timing, and client/server version strings.
5What is the primary forensic advantage of deploying a network TAP instead of configuring a SPAN (mirror) port on a switch for evidence capture?
A.A TAP encrypts captured traffic so it remains admissible in court
B.A TAP copies all traffic including physical-layer errors without dropping packets under load, and is passive on the wire
C.A TAP automatically timestamps packets with a court-certified clock source
D.A TAP filters malicious traffic so the examiner only stores relevant packets
Explanation: A hardware TAP is a passive device that duplicates the full-duplex bitstream, including malformed frames and error packets, and does not drop traffic when the monitored link is saturated. SPAN ports are switch software features that may drop mirrored packets under load and do not forward physical-layer errors.
6In a packet capture, an examiner sees thousands of SYN packets from one source IP to consecutive ports on a target, each answered with RST/ACK, and no completed handshakes. What activity does this most likely represent?
A.A distributed denial-of-service flood against the target
B.A normal web browsing session with connection reuse
C.A TCP SYN port scan against closed ports
D.ARP cache poisoning in progress
Explanation: A SYN scan (half-open scan) sends SYN packets to many ports; a closed port replies RST/ACK while an open port would reply SYN/ACK. The pattern of sequential ports, RST/ACK replies, and no completed handshakes is the classic signature of reconnaissance scanning.
7Which Zeek log file should an examiner consult first to obtain a consolidated, protocol-agnostic summary of every network connection observed, including duration and byte counts?
A.http.log
B.dns.log
C.conn.log
D.files.log
Explanation: Zeek's conn.log records one entry per connection with timestamps, endpoints, protocol, service, duration, and bytes transferred in each direction. It is the backbone for timeline building and identifying sessions worth deeper inspection in the protocol-specific logs.
8An analyst suspects data exfiltration via DNS tunneling. Which combination of indicators in DNS traffic most strongly supports this hypothesis?
A.Occasional A record queries for well-known domains with low TTLs
B.High volume of TXT or long encoded subdomain queries to a single uncommon domain, with unusually large response payloads
C.Repeated queries for the same hostname from multiple internal hosts
D.DNS queries arriving only during business hours from a single workstation
Explanation: DNS tunneling encodes data into query names and response records, producing abnormally long, high-entropy subdomains, preference for TXT/NULL record types, and a high query rate to one attacker-controlled domain. These traits distinguish tunneling from ordinary resolution traffic.
9During TLS session analysis, what can an examiner still determine from a packet capture of an HTTPS session when no decryption keys are available?
A.The exact URLs and page content requested
B.The plaintext credentials submitted in forms
C.The server hostname via the SNI field, certificate details, endpoints, timing, and data volumes
D.The HTTP method and response status codes
Explanation: TLS encrypts application data, but the handshake typically exposes the Server Name Indication and the server certificate, and the session always exposes endpoints, packet timing, sizes, and volume. This metadata supports infrastructure attribution and exfiltration estimates even without decryption.
10Which evidence pattern best indicates ARP spoofing (ARP cache poisoning) on a local network segment?
A.An increase in TCP retransmissions on one switch uplink
B.A single host issuing many DHCP discover broadcasts
C.Two different MAC addresses alternately claiming the same gateway IP address in gratuitous ARP replies
D.ICMP echo requests with abnormally large payloads
Explanation: ARP spoofing works by sending unsolicited ARP replies that bind the gateway's IP address to the attacker's MAC address. A capture showing conflicting MAC claims for the same IP, especially via gratuitous ARP, is the hallmark indicator and enables man-in-the-middle interception.

About the CDFE Exam

The PECB Certified Digital Forensics Examiner (CDFE) certification evaluates professional competence in governance, implementation, auditing, and management according to PECB standards.

Questions

20 scored questions

Time Limit

3 hours

Passing Score

70%

Exam Fee

USD 1000 exam-only (PECB (Professional Evaluation and Certification Board))

CDFE Exam Content Outline

~20%

Forensic Investigation Preparation & Incident Response

Forensic readiness, lab setup, tool validation, legal authorization, and initial response protocols.

~25%

Digital Evidence Acquisition & Chain of Custody

Live vs dead acquisition, disk imaging, memory capture, mobile forensics, hashing, write-blocking, and chain of custody documentation.

~25%

Forensic Artifact Analysis

File system analysis (NTFS, EXT, APFS), registry analysis, memory forensics, event log inspection, browser and email artifact extraction.

~15%

Evidence Recovery & Anti-Forensic Mitigation

Deleted file recovery, carving, analyzing hidden/encrypted data, recognizing anti-forensics techniques (timestomping, wiping, obfuscation).

~15%

Forensic Reporting & Legal Testimony

Documentation standards, expert witness guidelines, structuring forensic reports, presenting findings, and maintain evidence integrity for legal proceedings.

How to Pass the CDFE Exam

What You Need to Know

  • Passing score: 70%
  • Exam length: 20 questions
  • Time limit: 3 hours
  • Exam fee: USD 1000 exam-only

Keys to Passing

  • Complete 500+ practice questions
  • Score 80%+ consistently before scheduling
  • Focus on highest-weighted sections
  • Use our AI tutor for tough concepts

CDFE Study Tips from Top Performers

1Review the official PECB candidate handbook
2Practice scenario-based questions across all domains
3Pace yourself to answer all questions within the time limit

Frequently Asked Questions

What is the format of the PECB Digital Forensics Examiner exam?

The official exam consists of 20 questions over 3 hours. This practice set provides 100 English-language MCQs as a study aid.

Is this practice test free?

Yes, 100% free with detailed explanations.