Tor Browser Forensics DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During an investigation, you find a Tor Browser profile on a suspect's computer. You want to determine the exact time the user visited a specific .onion site. Which file or database would provide the most precise timestamp for that visit?

   • AThe browser console log
   • BThe Windows Prefetch file for Tor Browser
   • CThe tor log file
   • Dplaces.sqlite in the Tor Browser profile
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic examiner is constructing a timeline of a suspect's Tor Browser activity. The examiner has the following artifacts: the tor log file, the browser's history database (places.sqlite), and the browser's cache. Which artifact should the examiner use to establish the earliest possible start time of the Tor Browser session?

   • AThe modification timestamp of the torrc file
   • BThe creation timestamp of the places.sqlite file
   • CThe last modified timestamp of the cache folder
   • DThe tor log file's first entry, which records the Tor daemon's startup
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is reviewing network logs and notices a series of TLS connections from a workstation to various IP addresses on port 443. The connections have a consistent pattern: the ClientHello messages use a non-standard cipher suite order and include a specific TLS extension that is rarely seen in normal browsers. The analyst suspects Tor usage. Which additional network indicator would strengthen this hypothesis?

   • AThe connections are persistent and have a long duration, with data flowing in both directions at regular intervals.
   • BThe connections have a very short duration and transfer small amounts of data.
   • CThe connections use UDP instead of TCP.
   • DThe connections resolve to IP addresses in the same geographic region as the workstation.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of Tor bridges?

   • ATo encrypt traffic between the client and the destination website
   • BTo allow users to access the Tor network in countries where Tor is blocked
   • CTo provide faster connections by bypassing the middle relay
   • DTo provide a backup exit node in case the primary exit fails
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A network forensic analyst is examining a PCAP file and sees a TLS connection to an IP address on port 9001. The analyst suspects this is a Tor relay connection. Which additional indicator would confirm this?

   • AThe TLS certificate is self-signed and the connection uses a Tor-specific cipher suite
   • BThe connection has a high data transfer volume
   • CThe connection originates from a known Tor Browser user agent
   • DThe connection uses TLS 1.3 with a standard cipher suite
   Reveal Solution Discussion Select an answer first