Tor Browser Forensics DFE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of Tor Browser's randomized browser fingerprint?

   • ATo improve the performance of the browser
   • BTo make the browser appear as a different browser to each website
   • CTo prevent websites from identifying the browser as Tor Browser
   • DTo allow the browser to bypass CAPTCHAs
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A forensic analyst is examining a Linux system where the user downloaded and ran Tor Browser. The analyst wants to find the user's browsing history and any saved passwords. Which directory should the analyst examine first?

   • A~/tor-browser_en-US/Browser/TorBrowser/Data/Browser/profile.default
   • B~/.config/tor-browser
   • C~/.mozilla/firefox/xxxx.default
   • D/var/lib/tor
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic examiner is investigating a Tor Browser installation on a macOS system. The examiner wants to recover the user's saved passwords. Which file should the examiner look for?

   • Alogins.json in the Tor Browser profile directory
   • Bprefs.js in the Tor Browser profile directory
   • Ccookies.sqlite in the Tor Browser profile directory
   • Dplaces.sqlite in the Tor Browser profile directory
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a significant limitation when trying to identify a user from Tor Browser activity?

   • AThe lack of persistent identifiers that are unique to the user
   • BTor Browser encrypts all data with a master password that is impossible to bypass
   • CTor Browser deletes all traces of activity from the local system
   • DThe user's IP address is hidden by the exit node, making it impossible to trace
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network analyst is monitoring traffic from a corporate workstation that is suspected of using Tor Browser. The analyst observes periodic TLS connections to a single IP address on port 443, each with a distinctive TLS handshake pattern. The connections do not appear to be to any known corporate service. Which indicator is most characteristic of Tor traffic?

   • ATLS handshakes that use a specific cipher suite order and a unique TLS extension list, often consistent across connections.
   • BDNS queries to .onion domains.
   • CHTTP requests with unusual User-Agent strings containing 'Tor'.
   • DLarge volumes of UDP traffic to random ports.
   Reveal Solution Discussion Select an answer first