A forensic examiner is analyzing a suspect's hard drive and finds a file with a .onion URL. The examiner wants to determine if the suspect accessed the dark web. Which finding would provide the strongest evidence of Tor usage?

Network logs from the ISP showing connections to known Tor entry nodes.

Presence of the Tor Browser executable and a directory containing cached .onion pages.

Browser history entries for .onion domains in the default system browser.

A text file containing a list of .onion URLs.

An investigator is tracking a ransomware group that communicates on a dark web forum and demands payment in Bitcoin. The investigator has identified a Bitcoin address used by the group. Which step would be most useful to determine if the group has cashed out the funds?

Monitor the Bitcoin address for outgoing transactions to known exchanges.

Search the forum for posts mentioning the Bitcoin address.

Contact the forum administrator to ask about the group's activities.

Check the Bitcoin address's balance on a blockchain explorer.

A cybersecurity analyst is tasked with monitoring for mentions of their company's stolen data on the dark web. Which approach is most appropriate for this task?

Ask the company's ISP to monitor dark web traffic for the company's data.

Use a commercial dark web monitoring service that indexes known marketplaces and forums.

Set up a Google Alert for the company name and 'dark web'.

Manually browse every .onion site daily using a personal computer.

An investigator is using OSINT to gather information about a dark web vendor's identity. The vendor uses a unique username across multiple platforms. What is the most effective OSINT technique?

Search for the username on surface web search engines, social media, and forums to find cross-platform traces.

Use a dark web search engine to find the username on the dark web only.

Use a cryptocurrency mixer to trace the vendor's Bitcoin transactions.

Use a VPN to hide the investigator's IP while searching.

Why might a user choose to use a VPN in addition to the Tor Browser when accessing the dark web?

To provide a direct connection to dark web sites without using Tor.

To increase the speed of the Tor network by bypassing relay nodes.

To hide the fact that they are using Tor from their internet service provider (ISP).

To ensure that the exit node cannot see the user's traffic.

EC-CouncilComputer Hacking Forensic Investigator

Domain 5Objective 2

Dark Web Forensics CHFI Practice Questions (Page 4)

Part of the Web and Dark Web Forensics domain, which makes up ~13% of our current practice bank.

49questions here

10free pages

8concepts

Questions 16–20

16expert · hard
A forensic examiner is analyzing a suspect's hard drive and finds a file with a .onion URL. The examiner wants to determine if the suspect accessed the dark web. Which finding would provide the strongest evidence of Tor usage?
Select an answer first
17application · medium
An investigator is tracking a ransomware group that communicates on a dark web forum and demands payment in Bitcoin. The investigator has identified a Bitcoin address used by the group. Which step would be most useful to determine if the group has cashed out the funds?
Select an answer first
18application · medium
A cybersecurity analyst is tasked with monitoring for mentions of their company's stolen data on the dark web. Which approach is most appropriate for this task?
Select an answer first
19application · medium
An investigator is using OSINT to gather information about a dark web vendor's identity. The vendor uses a unique username across multiple platforms. What is the most effective OSINT technique?
Select an answer first
20foundation · easy
Why might a user choose to use a VPN in addition to the Tor Browser when accessing the dark web?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.