Dark Web Concepts and Investigation DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is monitoring dark web forums for threats against their organization. They find a post that mentions a specific exploit that could affect their systems. Which action is most appropriate for the team to take?

   • AContact the poster and ask for more details about the exploit
   • BImmediately patch the affected systems and monitor for indicators of compromise
   • CIgnore the post because dark web threats are rarely credible
   • DReport the post to the dark web forum administrators
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A forensic team is investigating a dark web site that hosts illegal content. They have identified a server in a foreign country. What is the most appropriate next step?

   • AAsk the hosting provider to shut down the server immediately
   • BIgnore the server and focus on local suspects
   • CAttempt to hack into the server to gather evidence
   • DContact the foreign country's law enforcement through mutual legal assistance channels
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An investigator is tracking a suspect who uses Tor and also runs a public website on the surface web. The investigator suspects the suspect uses the same username on both the dark web and the surface web. Which technique would be most effective in linking the two identities?

   • ASearch the surface web for the same username and correlate posting times and writing style
   • BDeploy malware on the suspect's computer to capture their Tor activity
   • CUse a Tor exit node to capture the suspect's traffic when they visit the surface web
   • DMonitor the suspect's Tor traffic at the network level to see which .onion sites they visit
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An investigator is considering using a covert technique to identify a dark web user. The technique involves sending a specially crafted image that, when viewed, contacts a server controlled by the investigator, revealing the user's real IP address. What is the primary legal concern with this technique?

   • AIt may violate the terms of service of the dark web platform
   • BIt may be considered a form of entrapment
   • CIt may violate the user's privacy rights under data protection laws
   • DIt may require a warrant or court order because it involves interception of communications or unauthorized access to a device
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is monitoring a dark web forum for mentions of their company's stolen data. The analyst finds a post offering to sell a database that appears to be from their company. Which action should the analyst take to gather intelligence without alerting the seller?

   • AContact the seller directly and ask for a sample of the data
   • BCreate a fake buyer account and engage in a controlled conversation to gather details
   • CUse a web crawler to automatically download all posts from the forum
   • DAttempt to hack into the seller's account to see their other posts
   Reveal Solution Discussion Select an answer first