CNFE study guide
CNFE · Work through your exam, one topic at a time.
The Certified Network Forensic Examiner (CNFE) credential is aimed at practitioners who investigate security incidents from the network side: analysts, incident responders, and forensic examiners who need to reconstruct what happened on a wire rather than on a disk. It suits people who already understand TCP/IP and packet analysis and want a structured way to demonstrate that skill in investigations, litigation support, or expert-witness work. The CNFE study guide has 8 sections and about 2,297 words.
01Network Forensics Fundamentals and Legal Considerations
This domain tests whether you can frame a network investigation so that technical findings survive legal scrutiny. Expect questions on evidence handling, jurisdictional limits, privacy law, and the admissibility of packet-derived conclusions.
307 words, about 2 min02Network Protocols and Traffic Analysis
This domain tests protocol-level reconstruction: can you explain what happened from packets, flows, and logs rather than from an alert label? Expect TCP flag analysis, DNS and DHCP correlation, HTTP/TLS metadata, ICMP behavior, and tunneling indicators.
314 words, about 2 min03Evidence Acquisition and Packet Capture
This domain tests whether you can acquire network evidence defensibly and preserve its fidelity. Questions cover capture placement, hardware and software capture, packet loss, file formats, hashing, and documentation.
304 words, about 2 min04Intrusion Detection and Log Analysis
This domain tests detection logic and log correlation. You must distinguish signature-based alerts from behavioral anomalies, explain IDS/IPS placement, and reconstruct an intrusion from multiple log sources.
286 words, about 1 min05Malware Traffic Analysis and Indicators of Compromise
This domain tests malware traffic analysis: recognizing delivery, command-and-control, and exfiltration from packets, flows, and indicators. Expect beaconing, DNS tunneling, DGA, payload retrieval, and encrypted C2 metadata.
279 words, about 1 min06Incident Response and Network Investigation
This domain tests incident response through a network lens: scoping, containment, evidence preservation, and coordination. Expect questions on IR phases, containment choices, and the order of volatile evidence collection.
287 words, about 1 min07Reporting, Documentation, and Expert Testimony
This domain tests whether you can turn technical work into defensible documentation and testimony. Expect report structure, opinion limits, exhibits, and admissibility standards.
248 words, about 1 min08Forensic Tools and Techniques
This domain tests tool selection and validation. You should know what each tool answers, its limits, and how to document reproducible analysis.
272 words, about 1 min