Dark Web Forensics ECSS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is investigating a dark web marketplace that has been taken down by law enforcement. The analyst wants to identify the marketplace's administrators. Which source of evidence is likely to be most useful?

   • AThe marketplace's public-facing FAQ page.
   • BThe cryptocurrency exchange used by the marketplace.
   • CThe seized server's database containing user registration details and private messages.
   • DThe Tor network's directory servers.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic investigator is preparing to monitor a known dark web forum where stolen corporate credentials are being traded. The investigator needs to collect evidence of the forum's activities without alerting the forum administrators. The investigator has a standard workstation with internet access and a budget for a dedicated investigation machine. What is the most appropriate approach for this task?

   • ACreate an undercover account using the investigator's real email address but a pseudonymous username to maintain a trail.
   • BUse a dedicated virtual machine with Tor Browser, route traffic through a VPN, and access the forum using an undercover account created with anonymized details.
   • CUse a public Wi-Fi network with a standard browser to access the forum, as the anonymity of the network is sufficient for monitoring.
   • DAccess the forum directly from the investigator's primary workstation using the Tor Browser to avoid additional setup costs.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An investigator has captured a dark web page as evidence. To preserve the integrity of the evidence, which step is essential immediately after capture?

   • AGenerate a cryptographic hash of the captured file and record it in the case notes.
   • BRename the file to a descriptive name for easier identification.
   • CPrint the page and place it in a sealed evidence bag.
   • DEmail the file to the prosecutor for review.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A forensic analyst is examining a network capture from a suspect's computer. The analyst notices traffic to a known Tor relay. What does this indicate?

   • AThe suspect may have been using Tor to access the dark web, but further analysis is needed to confirm.
   • BThe suspect was definitely accessing illegal content.
   • CThe suspect's computer is infected with malware that uses Tor.
   • DThe suspect was using a VPN, not Tor.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's security team discovers that an employee has been using the Tor Browser on a work computer. The team wants to determine whether the employee accessed the dark web. Which initial step is most appropriate?

   • ACheck the corporate firewall logs for connections to known Tor relay IPs.
   • BAsk the employee to explain their Tor usage.
   • CCheck the Tor Browser's profile for cached .onion URLs and browsing history.
   • DSeize the computer immediately and image the hard drive without further analysis.
   Reveal Solution Discussion Select an answer first