10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The C)DFE exam has 100 questions and runs 2 hours.
These 10 free C)DFE questions are organized by exam domain, so you can see how each part of the Certified Digital Forensics Examiner blueprint is tested. Reveal the answer and explanation under each question.
A forensic examiner receives a seized computer after investigators have documented the scene. Before analyzing files, which action best preserves the integrity of the investigation?
Correct answer: C - Create an evidence copy using appropriate acquisition procedures and preserve the original
A prosecutor asks why a digital file presented in court should be considered reliable. Which concept most directly addresses proving that the file is what it claims to be?
Correct answer: A - Authentication
A responder must quickly identify potentially relevant evidence before full laboratory analysis. Which approach matches this objective?
Correct answer: A - CFFTPM
A forensic examiner receives a physically damaged storage device. Which principle should guide the next step?
Correct answer: D - Apply damaged-drive handling procedures to protect evidence
An examiner collects volatile information from a running system. What acquisition is being performed?
Correct answer: D - Live acquisition
An examiner investigating a Windows compromise needs operating system event records. Which artifacts should be examined first?
Correct answer: B - Windows EVTX and EVT logs
An investigator needs to locate files using complex text patterns rather than a single known word. Which technique is appropriate?
Correct answer: B - REGEX
A forensic team collects evidence from a smartwatch. Which topic most directly applies?
Correct answer: C - Mobile process, tools, IoT/wearables, legal considerations
A laboratory manager verifies forensic examinations follow procedures. Which activity is most directly related?
Correct answer: B - Quality control and peer review
A forensic report describes methods, evidence examined, findings, and conclusions. Which objective does this support?
Correct answer: A - Digital evidence presentation and reporting
The C)DFE exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more C)DFE questions with explanations.
Continue in the free practice test →
View plans