During an investigation of a dark web marketplace, an analyst discovers that payments are made in Monero rather than Bitcoin. What is the primary implication for the investigation?

Blockchain analysis will be more difficult because Monero's ledger obscures transaction amounts and addresses.

The transactions can be traced more easily because Monero is a permissioned blockchain with known participants.

Monero transactions are recorded on the Bitcoin blockchain, so existing Bitcoin analysis tools can be used.

The analyst can subpoena the Monero network to obtain transaction records.

A network administrator notices a large amount of encrypted traffic from a single workstation to various IP addresses around the world. The administrator suspects the user is using Tor. Which statement accurately describes how Tor traffic appears on the network?

The traffic is encrypted and appears as random data to the destination, but the destination can see the source IP of the Tor exit node.

The traffic is sent directly to the destination without any intermediate nodes.

The traffic is indistinguishable from regular HTTPS traffic to the ISP.

The traffic is unencrypted at the entry node, so the ISP can read the content.

An investigator is analyzing a dark web marketplace that uses an escrow system for transactions. What is the primary purpose of this escrow system?

To hide the transaction from blockchain analysis.

To ensure the marketplace administrator gets a commission.

To launder the cryptocurrency through multiple wallets.

To build trust between buyers and sellers by holding funds until the buyer confirms receipt.

An investigator is explaining to a colleague how a Tor hidden service (onion service) keeps its location secret. Which statement is accurate?

The hidden service uses a VPN to hide its IP from the Tor network.

The hidden service's IP address is encrypted and stored in a public DNS record.

The hidden service connects to a set of introduction points and advertises them in the Tor network; clients connect through a rendezvous point.

The hidden service only communicates through the exit node, which hides its IP.

EC-CouncilComputer Hacking Forensic Investigator

Domain 5Objective 2

Dark Web Forensics CHFI Practice Questions (Page 7)

Part of the Web and Dark Web Forensics domain, which makes up ~13% of our current practice bank.

49questions here

10free pages

8concepts

Questions 31–35

31foundation · easy
In Tor's onion routing, which node is responsible for sending the traffic to its final destination on the clearnet?
Select an answer first
32application · medium
During an investigation of a dark web marketplace, an analyst discovers that payments are made in Monero rather than Bitcoin. What is the primary implication for the investigation?
Select an answer first
33application · medium
A network administrator notices a large amount of encrypted traffic from a single workstation to various IP addresses around the world. The administrator suspects the user is using Tor. Which statement accurately describes how Tor traffic appears on the network?
Select an answer first
34application · easy
An investigator is analyzing a dark web marketplace that uses an escrow system for transactions. What is the primary purpose of this escrow system?
Select an answer first
35application · medium
An investigator is explaining to a colleague how a Tor hidden service (onion service) keeps its location secret. Which statement is accurate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.