A forensic investigator is setting up a secure environment to access the dark web for a case. The investigator wants to ensure that no traces of the activity remain on the host system. Which setup is most appropriate?

Use a virtual machine with default settings and no snapshot.

Use a standard VPN and a regular browser to access .onion sites.

Install Tor Browser on the main operating system and use private browsing mode.

Use a live bootable USB with Tails OS and Tor Browser.

During an investigation of a dark web forum, an analyst notices that vendors require buyers to use a Bitcoin mixing service before making payments. What is the primary purpose of this requirement?

To reduce transaction fees for the buyer.

To speed up transaction confirmations on the Bitcoin network.

To convert Bitcoin into a more stable cryptocurrency like Tether.

To obscure the trail of Bitcoin transactions, making it harder for investigators to trace payments.

A forensic examiner is collecting evidence from a dark web site that is hosted on a Tor hidden service. The examiner wants to preserve the evidence in a way that can be authenticated later. Which method is most appropriate?

Take screenshots of each page and save them in a Word document.

Capture a full-screen video of the session and compute SHA-256 hashes of all downloaded files.

Print the web pages and sign them as evidence.

Copy the entire Tor Browser profile folder to a USB drive.

Which of the following is a key consideration when preserving the anonymity of an investigator during dark web evidence acquisition?

Using a dedicated, isolated virtual machine with Tor Browser and no personal identifying information.

Disabling all encryption on the connection to speed up the process.

Logging into the dark web site with the investigator's real email address.

Using the investigator's personal computer with a standard browser to access the site.

EC-CouncilComputer Hacking Forensic Investigator

Domain 5Objective 2

Dark Web Forensics CHFI Practice Questions (Page 10)

Part of the Web and Dark Web Forensics domain, which makes up ~13% of our current practice bank.

49questions here

10free pages

8concepts

Questions 46–49

46application · medium
A forensic investigator is setting up a secure environment to access the dark web for a case. The investigator wants to ensure that no traces of the activity remain on the host system. Which setup is most appropriate?
Select an answer first
47application · medium
During an investigation of a dark web forum, an analyst notices that vendors require buyers to use a Bitcoin mixing service before making payments. What is the primary purpose of this requirement?
Select an answer first
48expert · hard
A forensic examiner is collecting evidence from a dark web site that is hosted on a Tor hidden service. The examiner wants to preserve the evidence in a way that can be authenticated later. Which method is most appropriate?
Select an answer first
49foundation · easy
Which of the following is a key consideration when preserving the anonymity of an investigator during dark web evidence acquisition?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.