Dark Web Forensics CHFI Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An investigator is monitoring a dark web forum for discussions about a new ransomware strain. The forum requires registration. What is the most effective and legally sound approach?

   • ACreate an undercover account with a plausible persona and interact minimally to gain access.
   • BRequest the forum administrator for a guest account.
   • CUse OSINT to find cached versions of the forum posts on the surface web.
   • DUse a web crawler to index the forum without registering.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An investigator is running an undercover operation on a dark web forum. The investigator's cover identity has been active for months and has built trust with vendors. However, the investigator accidentally reveals a personal detail that could link the cover to their real identity. What is the most appropriate immediate action?

   • AImmediately arrest the vendors and end the operation.
   • BAbandon the cover identity and start a new one after documenting the incident.
   • CDelete the post containing the personal detail and continue the operation.
   • DExplain the personal detail as a deliberate test by the forum administrators.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An investigator is preparing to capture evidence from a dark web forum that requires login. The investigator has a court order to access the forum and collect evidence. The forum is known to be hostile to law enforcement and may attempt to deanonymize visitors. The investigator has a dedicated investigation workstation with Tor Browser and a VPN. What is the most important precaution to ensure the evidence is admissible and the investigator remains safe?

   • AUse the same workstation for personal browsing to avoid raising suspicion.
   • BTake screenshots only, without recording the URL or timestamp, to avoid leaving traces.
   • CDisable the VPN to avoid slowing down the connection, and rely solely on Tor.
   • DUse a dedicated virtual machine with a snapshot, and route all traffic through Tor and the VPN, while documenting every step.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An investigator is monitoring a dark web marketplace to identify a vendor selling stolen data. The vendor uses a pseudonym and accepts Bitcoin. Which combination of techniques would be most effective for linking the vendor's Bitcoin address to a real-world identity?

   • AUse a blockchain explorer to view the vendor's transaction history and directly see their name.
   • BSearch the vendor's username on social media and assume any match is the same person.
   • CRequest the marketplace administrator to reveal the vendor's IP address.
   • DPerform blockchain analysis to trace transactions to exchanges and combine with OSINT from the vendor's forum posts.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A forensic team is setting up a secure environment to access the dark web. They have a limited budget and need to ensure the highest level of anonymity and evidence integrity. Which setup best balances these requirements?

   • AA virtual machine on a corporate workstation with snapshots taken before each session.
   • BA cloud-based virtual desktop with Tor Browser installed.
   • CA standard Windows laptop with Tor Browser and a VPN, with browser history disabled.
   • DA dedicated laptop running Tails OS from a USB stick, with all network traffic forced through Tor and no persistent storage.
   Reveal Solution Discussion Select an answer first