Download the certification brochure (Spanish): Click here

Exam Details

• Exam Name: Cyber Forensics Certified Associate (CFCA)
• Exam Format: Multiple choice, online with remote supervision (proctoring)
• Exam Delivery: Safe Exam Browser
• Number of Questions: 60 questions: 70% scenarios / 30% conceptual
• Exam Duration: 90 minutes
• Passing Score: 75% (45 out of 60 correct answers)
• Available Languages: Spanish / English
• Attempts: Maximum 2 attempts (minimum 15 days between attempts)
• Validity: 3 years · 15 CPD credits per year

Main Subjects

• Digital forensics fundamentals (15%): Digital evidence and its characteristics; The investigation cycle (NIST SP 800-86); Legal and ethical framework; Locard, volatility and minimal alteration; ISO/IEC 27037: DEFR and DES roles; Tool landscape.
• Evidence acquisition and preservation (20%): Forensic images and write blockers; Live and static acquisition; Volatile memory and Volatility; Integrity with hash values; Chain of custody; Cloud and mobile devices.
• Forensic analysis of systems and artifacts (25%): NTFS, FAT and ext4; Deleted files and file carving; Windows registry and event logs; Execution and usage artifacts; Linux artifacts; Timelines and anti-forensics.
• Network and traffic forensics (15%): Traffic capture: SPAN and TAP; Analysis with Wireshark; Firewall, proxy and DNS logs; Network indicators of compromise; NetFlow and correlation.
• Incident response and forensic reporting (25%): NIST SP 800-61 lifecycle; Triage and severity; Containment, eradication and recovery; Forensic report; Communication and coordination; Lessons learned and ethics.

Who is this certification for?

• Tier 1 and Tier 2 SOC analysts: Who investigate incidents and need to support them with evidence.
• IT technicians and administrators: Who preserve evidence in their own environment before escalating an incident.
• Professionals moving into cybersecurity: Who are starting out in digital forensic analysis.
• Students and junior security profiles: Seeking a first certification in incident investigation.
• Auditors and compliance professionals: Who need to understand digital evidence and its chain of custody.

Prerequisites

No mandatory prerequisites: no prior experience, training or certification is required. Registration is direct with CertJoin or through an authorized partner. Recommended (not mandatory): basic knowledge of operating systems and networking.