Dark Web Forensics CHFI Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A forensic investigator is planning to access a dark web site that is suspected of distributing child exploitation material. The investigator is in a jurisdiction where accessing such material is illegal, even for law enforcement, without a specific exemption. What is the most appropriate course of action?

   • AObtain a court order or legal authorization that explicitly permits access for investigative purposes.
   • BAccess the site using Tor and a VPN to hide the investigator's identity from local authorities.
   • CProceed with the investigation and rely on the public interest defense.
   • DAsk a colleague in another jurisdiction to access the site and share the evidence.
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A colleague asks why some websites are not accessible through a regular browser and require Tor. Which explanation is correct?

   • AThese sites are hosted as Tor hidden services and only respond to connections made through the Tor network.
   • BThese sites are only available in certain countries.
   • CThese sites use encryption that regular browsers cannot handle.
   • DThese sites are blocked by the ISP and require Tor to bypass censorship.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An investigator is monitoring a dark web forum where a user is selling stolen credit card data. The user posts a sample of the data to prove its validity. Which action would be most effective for the investigator to take to identify the user?

   • AAnalyze the sample data for patterns that might indicate the source breach, then use OSINT to link the user's forum handle to other online activities.
   • BImmediately contact the credit card companies and ask for the cardholder's identity.
   • CPurchase the data using a monitored Bitcoin wallet to trace the transaction.
   • DSend the user a private message asking for their identity.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An investigator is monitoring a dark web forum for mentions of a specific stolen data dump. The investigator wants to automate the monitoring. What is the most effective approach?

   • AAsk the forum administrator to notify the investigator of new posts.
   • BManually check the forum every hour.
   • CUse a surface web search engine to find the data dump.
   • DUse a custom script that periodically logs into the forum and searches for the keywords, while using Tor and a dedicated identity.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of using monitoring tools in dark web investigations?

   • ATo automatically track and record activities on dark web sites for intelligence gathering.
   • BTo automatically purchase illegal goods for evidence.
   • CTo encrypt the investigator's communications with the dark web site.
   • DTo block access to dark web sites from the investigator's network.
   Reveal Solution Discussion Select an answer first