Tor Browser Forensics DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network administrator is trying to block Tor usage on their corporate network. They have identified that Tor Browser uses a directory of relays to establish circuits. Which approach is most effective for detecting and blocking Tor connections at the network level?

   • ABlock connections to known Tor relay IP addresses and monitor for TLS handshakes with Tor's distinctive fingerprint.
   • BDisable JavaScript in the browser to prevent Tor from functioning.
   • CBlock DNS queries to torproject.org.
   • DBlock all traffic to port 9001, which is the default OR port.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Where can a forensic examiner typically find the Tor daemon's log file on a Windows system?

   • AIn the system32 directory
   • BIn the Tor Browser installation directory under 'logs'
   • CIn the Windows Event Viewer under Application logs
   • DIn the user's AppData\Roaming\TorBrowser\Data\Tor directory
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which configuration file in the Tor Browser bundle contains settings for the Tor daemon, such as the location of the log file?

   • Aprefs.js
   • Btorrc
   • Cbrowser.ini
   • Dtor.ini
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A network forensic analyst is examining a PCAP file from a corporate network. They see a series of TLS connections to a single IP address on port 443. The connections have a consistent TLS fingerprint that matches Tor's known fingerprint. However, the analyst also notices that the connections are short-lived and occur at irregular intervals. Which conclusion is most appropriate?

   • AThe traffic is definitely not Tor because Tor circuits are always long-lived.
   • BThe traffic is from a standard web browser because the TLS fingerprint is not unique to Tor.
   • CThe traffic is likely from a Tor client using a bridge or a pluggable transport that obfuscates the connection pattern.
   • DThe traffic is from a Tor relay, not a client.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic examiner is analyzing a Tor Browser installation on a Linux system. The examiner wants to recover the user's browsing history. Which file should the examiner examine?

   • Aplaces.sqlite in the Tor Browser profile directory
   • Bprefs.js in the Tor Browser profile directory
   • Ccookies.sqlite in the Tor Browser profile directory
   • Dlogins.json in the Tor Browser profile directory
   Reveal Solution Discussion Select an answer first