Dark Web Forensics CHFI Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An investigator is analyzing a dark web marketplace that has been seized by law enforcement. The marketplace's database contains user account information, including usernames, hashed passwords, and Bitcoin addresses. Which action would be most effective for identifying the real-world identities of the marketplace users?

   • ACorrelate the Bitcoin addresses with blockchain analysis and exchange KYC records.
   • BPublish the database online and ask the public for help identifying the users.
   • CSearch the usernames on social media platforms and assume any match is the same person.
   • DAttempt to crack the password hashes and use the passwords to access the users' email accounts.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An investigator in the EU is investigating a dark web forum that is hosted in a country with strict data privacy laws. The investigator has accessed the forum and collected personal data of users. What is the primary legal concern?

   • AThe investigator must destroy all evidence because it was obtained from the dark web.
   • BThe investigator cannot use Tor because it is banned in the EU.
   • CThe dark web is illegal in the EU, so the investigation is unlawful.
   • DCompliance with GDPR and the hosting country's data protection laws, which may restrict the transfer and use of personal data.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An investigator is analyzing Bitcoin transactions from a dark web marketplace. The marketplace uses a unique Bitcoin address for each buyer and seller. The investigator has identified a cluster of addresses that appear to belong to a single vendor. Which technique is most likely to have been used to cluster these addresses?

   • AUsing a Bitcoin mixer to trace the addresses back to the vendor.
   • BMonitoring the marketplace's public API for address ownership information.
   • CRequesting the vendor's IP address from the marketplace administrator.
   • DHeuristic analysis of spending patterns, such as common change addresses and multi-input transactions.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A dark web vendor advertises a product and requires payment in Monero. An investigator wants to trace the transaction. What is the primary challenge compared to Bitcoin?

   • AMonero is not accepted by any dark web marketplaces.
   • BMonero transactions are not recorded on a public blockchain.
   • CMonero's default privacy features obscure the sender, amount, and address, making blockchain analysis difficult.
   • DMonero transactions require a mixing service to be anonymous.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A forensic team is preparing to collect evidence from a dark web forum that requires user registration. To maintain the integrity of the investigation and comply with legal standards, what should the team do before creating an undercover account?

   • ADisable all logging on the forensic workstation to prevent detection by the forum administrators.
   • BUse a VPN and Tor simultaneously without documenting the IP addresses used.
   • CCreate the account using a personal email address to speed up the process.
   • DObtain prior approval from the appropriate legal authority and document the authorization.
   Reveal Solution Discussion Select an answer first