A forensic analyst is examining a suspect's computer and finds that the suspect used I2P (Invisible Internet Project) in addition to Tor. Which statement correctly describes a key difference between I2P and Tor?

I2P provides end-to-end encryption, while Tor only encrypts the first hop

I2P uses a centralized directory of relays, while Tor uses a decentralized network

I2P is designed for anonymous publishing and peer-to-peer services, while Tor is primarily for anonymous browsing

I2P is faster than Tor because it uses fewer relays

A forensic analyst is testifying in court about evidence collected from a dark web marketplace. The defense attorney asks how the analyst accessed the marketplace. Which response is most appropriate?

I cannot disclose my methods because they are confidential

I used Tor Browser to access the .onion site, and I documented all my steps

I used a special government tool that is classified

I accessed the site through a friend who is a hacker

An investigator is trying to identify the operator of a dark web marketplace. The marketplace uses Bitcoin for transactions, and the investigator has access to the blockchain. Which approach is most likely to help identify the operator?

Monitor the marketplace's Tor traffic to capture the operator's IP address

Search the marketplace's source code for the operator's name

Use a Bitcoin mixer to anonymize the investigator's own transactions and then interact with the marketplace

Trace Bitcoin transactions to a known exchange and use legal process to obtain account information

An investigator is planning to take down a dark web marketplace. The marketplace is hosted on a server in a country with strict data privacy laws. The investigator's agency has obtained a warrant from their own country. What is the most appropriate next step?

Ask the hosting country's internet service provider to shut down the server

Use a remote access tool to secretly copy the server's data without notifying the hosting country

Proceed with the takedown using the domestic warrant, as the marketplace is illegal

Coordinate with law enforcement in the hosting country through an MLAT or similar mechanism

An investigator has identified a suspect's Bitcoin address used on a dark web marketplace. The investigator wants to trace the funds to a cryptocurrency exchange where the suspect may have a verified account. Which technique is most appropriate?

Hack into the exchange's database to find the account

Use blockchain analysis to follow the flow of funds from the address to known exchange wallets

Ask the dark web marketplace for the suspect's identity

Send a subpoena to the Bitcoin network for the suspect's identity

EC-CouncilDigital Forensics Essentials

Domain 6Objective 1

Dark Web Concepts and Investigation DFE Practice Questions (Page 6)

Part of the Dark Web and Email Forensics domain, which makes up ~16% of our current practice bank.

47questions here

10free pages

7concepts

Questions 26–30

26application · medium
A forensic analyst is examining a suspect's computer and finds that the suspect used I2P (Invisible Internet Project) in addition to Tor. Which statement correctly describes a key difference between I2P and Tor?
Select an answer first
27application · medium
A forensic analyst is testifying in court about evidence collected from a dark web marketplace. The defense attorney asks how the analyst accessed the marketplace. Which response is most appropriate?
Select an answer first
28expert · hard
An investigator is trying to identify the operator of a dark web marketplace. The marketplace uses Bitcoin for transactions, and the investigator has access to the blockchain. Which approach is most likely to help identify the operator?
Select an answer first
29expert · hard
An investigator is planning to take down a dark web marketplace. The marketplace is hosted on a server in a country with strict data privacy laws. The investigator's agency has obtained a warrant from their own country. What is the most appropriate next step?
Select an answer first
30expert · hard
An investigator has identified a suspect's Bitcoin address used on a dark web marketplace. The investigator wants to trace the funds to a cryptocurrency exchange where the suspect may have a verified account. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.