Tor Browser Forensics DFE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What type of cryptographic material might be recovered from a memory dump of a Tor Browser session?

   • AThe circuit encryption keys used for the current Tor session
   • BThe user's PGP private key
   • CThe TLS session keys of the destination website
   • DThe private key of the Tor network's directory authority
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A user claims they used Tor Browser in its default 'Private Browsing' mode to visit a website, and that no trace of the visit remains on their computer. During forensic analysis, you find the Tor Browser profile folder still exists on the hard drive. Which statement best describes the forensic reality of this situation?

   • AThe profile folder may contain residual data such as bookmarks, saved passwords, or extension settings that persist even after the private session ends.
   • BThe profile folder contains only the torrc configuration file, which cannot link to user activity.
   • CThe profile folder is completely empty after closing the browser, so no forensic value exists.
   • DThe profile folder is encrypted and cannot be read without the user's password.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network administrator is configuring a firewall to block Tor Browser usage on the corporate network. The administrator wants to block the initial connection to the Tor network while allowing other HTTPS traffic. Which approach is most effective?

   • ABlock all traffic to IP addresses that use self-signed certificates
   • BBlock all TLS traffic on port 443
   • CBlock all traffic to IP addresses that have a high volume of data transfer
   • DBlock all outbound connections to known Tor relay IP addresses and ports
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which network traffic pattern is a common indicator of Tor Browser usage?

   • AFTP connections to anonymous servers
   • BTLS connections to known Tor relay IP addresses on port 443
   • CICMP echo requests to multiple hosts
   • DLarge amounts of UDP traffic to port 53
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic analyst is examining a Windows 10 workstation suspected of being used to access the dark web via Tor Browser. The analyst needs to recover evidence of the user's browsing activity, including the sites visited and any data entered into forms. The Tor Browser was installed with default settings and the user did not enable any special privacy modes. Which location should the analyst prioritize for recovering the most useful browsing artifacts?

   • AThe Windows Registry under HKEY_CURRENT_USER\Software\Mozilla\Firefox
   • BThe Tor Browser cache folder at C:\Tor Browser\Browser\TorBrowser\Data\Browser\cache2
   • CThe system's main user profile at C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles
   • DThe Tor Browser installation directory under C:\Tor Browser\Browser\TorBrowser\Data\Browser
   Reveal Solution Discussion Select an answer first