Phase2 Advantage Cybersecurity and Certifications

Certified Network Forensic Analysis Manager (C-NFAM)

CNFAM Exam Prep Guide

The Certified Network Forensic Analysis Manager training course was originally developed for the U.S. government, and has now been made available to city, county, and state law enforcement agencies. Civilian personnel outside of the law enforcement community are also authorized to attend and will receive practical training for their business environments.

This comprehensive course brings incident response and network forensic core competencies to advanced levels by presenting students with 16 detailed learning objectives. Students will be provided with both experiential knowledge and practical skills that simulate real-world scenarios, investigations, and recovery of evidentiary data in systems and networks. Students will cover topics such as Incident Response Management, Live Data Collection, Analysis Methodology, and Malware Triage. Practical lab exercises utilize the Project Ares® Cyber Range and Wireshark network protocol analyzer software.

NICE Cybersecurity Workforce Framework

The Certified Network Forensic Analysis Manager course is a component of the career progression track that supports the required Categories, Specialty Areas and Work Roles as defined by the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework.  It provides a common language to speak about cyber roles and jobs and can be referenced to define professional requirements in cybersecurity.







Course Outline and Knowledge Points

Click the blue arrow to the left of the domain title to view an expanded list of key knowledge points.

  • Network Forensics vs. Digital Forensics
  • What Constitutes an Incident?
  • What is Incident Response?
  • The Incident Response Life Cycle
  • Concept of the Attack Life Cycle
  • 7 Stages of the Attack Life Cycle
  • Firewall Functionality and Logging
  • Stateful vs. Stateless Inspection
  • Host-, Network-, and Application-Based Firewalls
  • Network Switches and Routers
  • Intrusion Detection and Prevention Systems
  • Unified Threat Management
  • Enterprise Services
  • Dynamic Host Configuration Protocol (DHCP)
  • Domain Name System (DNS)
  • Enterprise Management Applications
  • Antivirus Software
  • Web and Database Servers
  • Security Architecture Frameworks
  • Reference Security Architecture
  • The Secure Development Life Cycle
  • Architectural Design Documentation (ADD)
  • Architectural Domains: The Four Pillars
  • Zero Trust Networks
  • Common Security Incidents
  • Goals of Incident Response
  • Incident Response Team Considerations
  • Indicators of Compromise (IOC’s)
  • Analyzing Data Evidence
  • Tracking Investigative Information
  • Understanding Elements of Proof
  • Incident Scene Management
  • Chain of Custody
  • The Purpose of Investigations
  • Investigative Interview Strategies
  • Documenting Interviews
  • Defining the Network Forensic Mission
  • Internal Communication Procedures
  • External Communication Procedures
  • Forensic Team Deliverables
  • Building a Field Forensic System
  • Preparing the Infrastructure
  • General Process for Performing Analysis
  • Available Sources of Data
  • Outlining the Analysis Approach
  • Selection of Analysis Methods
  • Special Considerations for Artifacts
  • Evaluating Analysis Results
  • The Case for Network Monitoring
  • Types of Network Monitoring
  • Setting Up a Network Monitoring System
  • Network Surveillance
  • Network Sensor Deployment
  • Network Logging Challenges
  • Time Zones and Investigative Timelines
  • Collecting Initial Facts
  • Network and Incident Checklists
  • Malware Details Checklists
  • Maintaining Case Notes
  • Building an Attack Timeline
  • Defining Leads of Value
  • Turning Leads into Indicators
  • The Life Cycle of Indicator Generation
  • Indicator Verification
  • Resolving Internal Leads
  • Reporting Findings to Law Enforcement
  • When to Perform a Live Response
  • Live Response Challenges
  • Selecting a Live Response Tool
  • Data Collection Considerations
  • Common Live Response Data
  • Collection Best Practices
  • Windows System Overview
  • System and Event Logs
  • Windows Registry Evidence
  • Windows Services and Processes
  • Memory Forensics
  • Alternative Persistence Mechanisms
  • Investigating Applications Overview
  • Windows: Application Data Storage
  • General Investigative Methods
  • Investigating Web Browsers
  • Investigating E-Mail Clients
  • Investigating Instant Message Clients
  • Malware Triage Concepts
  • Malware Handling Procedures
  • Malware Distribution and Documentation
  • Physical and Virtual Triage Environments
  • Automated, Manual, Static, and Dynamic Analysis
  • Malware Runtime Monitoring
  • Effective Incident Remediation
  • Assigning a Remediation Owner
  • Remediation Posturing Actions
  • Eradication Plan Development
  • Plan Timing and Execution
  • Strategic Recommendations and Lessons Learned

Course Learning Objectives

Upon successful completion of the C)NFAM training program, participants will be able to:

  • CLO #01: Identify the purpose of enterprise network devices such as firewalls (stateless, stateful, host, network, and application), switches, routers, access control lists, intrusion detection and prevention systems, unified threat management devices, and sources of critical logs.
  • CLO #02: Describe the purpose of enterprise network services such as Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), network-level DNS logging, management applications, antivirus software, quarantine files, and network log files.
  • CLO #03: Demonstrate network forensic and investigation techniques using labs an industry tools such as Wireshark network protocol analyzer, Autopsy forensic software, Windows Registry Editor, file and record carving, document and photo reconstruction, and recovering deleted files.
  • CLO #04: Determine a malware policy based on industry best practices which addresses the identification of malicious files, initial triage, handling procedures, documentation and distribution guidelines, static and dynamic analysis methods, and the use of sandboxes for automated analysis.
  • CLO #05: Summarize investigative practices that include elements of proof, field investigation toolkits, incident scene management, evidence dynamics, chain of custody, investigative interview strategies, non-verbal communication, and Locard’s Principle of Exchange.
  • CLO #06: Evaluate critical sources of forensic evidence including Windows file systems, volatile and persistent memory, event logs, process tracking, web-based applications (browsers, email, and instant messages), malware files, and malicious websites.

Project Ares® Cyber Range Labs

Project Ares® Cyber Range Labs

Students enrolled in classroom or instructor-led online formats of this course will be using the Project Ares® Cyber Range for practical labs.  Project Ares® Cyber Range labs are available to self-study students for an additional fee.

Instructor-Led & Self-Guided Wireshark Lab Exercises

Creating the Virtual Machine for Labs

Color Rules and
Packet Export

The Wireshark
User Interface

Creating Tables
and Graphs

Wireshark Settings

File and Object

Capture Filters

Adding Comments
to Trace Files

Display Filters

Capture Tools

Course Training Materials

Lab Textbook
Course Textbook

Exam Prep Guide
Course Workbook & Labs

Lab Images (if Applicable)
Practice Assessment Quizzes

Knowledge Assessment Exam
40-Hour CPE Credit Certificate

Knowledge Assessment Exam

Exam Description Digital Badge CNFAM

At the conclusion of classroom courses, students will be prepared to sit for the knowledge assessment exam. The online examination will consist of True/False, Multiple Choice, and Fill in the Blank questions. The exam may be taken at any time within one year of purchasing the certification course.

Students will have two hours to complete a computer-based examination consisting of 100 questions. A score of 70% or higher is required to earn the certification. Upon successful completion of the exam, students will receive a hardcopy of their certification and a proctor validation document from the course instructor. Students will also receive a 40-hour CPE Certificate regardless of their exam score.

The examination is “closed book.” However, students will be allowed to use their notes on material presented during the course as well as their Course Workbooks.

Additional Information


5 Days


40 Hours

Certification Exam, Course Materials, and Daily Lunches are included.

Contact Us to Learn More

To find out more about course fees, group rates, and discounted fees for government personnel please contact us via the email and phone number below.

(912) 335-2217