Tor Browser Forensics DFE Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A forensic examiner is analyzing a Tor Browser installation on a Windows system. The examiner wants to determine if the user configured any custom bridges or relays. Which file should the examiner examine?

   • AThe prefs.js file in the browser profile
   • BThe browser's bookmarks.html file
   • CThe torrc file in the Tor Browser's Data/Tor directory
   • DThe hosts file in the Windows system directory
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A network forensic analyst is reviewing a PCAP file and notices a series of TLS connections to a single IP address on port 443, each with a different Server Name Indication (SNI) field. The connections occur every few minutes and have consistent packet sizes. The analyst suspects Tor Browser usage. Which additional observation would most strongly support this hypothesis?

   • AThe TLS certificates are self-signed and use the same public key across all connections
   • BThe connections originate from a Windows 10 machine with a standard user agent
   • CThe connections have a high volume of data transfer in both directions
   • DThe connections use TLS 1.3 with perfect forward secrecy
   Reveal Solution Discussion Select an answer first