Dark Web Forensics CHFI Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A forensic examiner needs to capture evidence from a Tor hidden service that is suspected of hosting illicit content. The examiner wants to minimize the risk of exposing their real IP address and preserve the integrity of the evidence. Which approach best meets these requirements?

   • AAccess the site via a public Wi-Fi hotspot to mask the examiner's identity, then save the webpage as HTML.
   • BUse a dedicated analysis workstation with Tor Browser, route traffic through a VPN, and record hashes of all downloaded files.
   • CConnect directly to the hidden service using a regular browser to avoid Tor-induced latency and then take screenshots.
   • DUse Tor Browser without a VPN because VPNs are detectable and reduce anonymity, then copy files to a USB drive.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Why is international cooperation important in dark web forensics?

   • ABecause the dark web is governed by a single international law.
   • BBecause dark web infrastructure and suspects are often located in multiple countries, requiring cross-border legal assistance.
   • CBecause dark web sites are only hosted on servers in international waters.
   • DBecause only international agencies have the technical skills to investigate the dark web.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is a common characteristic of dark web marketplaces?

   • AThey often use escrow services to hold funds until a transaction is completed.
   • BThey generally require users to provide real-world identification to register.
   • CThey are typically indexed by standard search engines like Google.
   • DThey primarily accept credit card payments for transactions.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A forensic team in Country A is investigating a dark web marketplace hosted on a server in Country B. The team has accessed the site and collected evidence. What is the primary legal consideration?

   • AWhether the marketplace's cryptocurrency transactions can be traced.
   • BWhether the evidence collection violates the laws of Country B or requires mutual legal assistance.
   • CWhether the investigator's VPN is based in Country A.
   • DWhether the dark web is legal to access in Country A.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   An investigator is analyzing a dark web marketplace that has switched from Bitcoin to Monero for all transactions. The investigator has a warrant to seize the marketplace server. What is the most significant impact on the investigation?

   • AThe investigator should abandon the case because Monero is completely untraceable.
   • BThe seizure will make all Monero transactions traceable because the server has the private keys.
   • CThe investigator must use a Monero mixing service to trace the transactions.
   • DThe seizure may provide access to transaction data that is not visible on the public blockchain, but Monero's privacy features may still limit tracing.
   Reveal Solution Discussion Select an answer first