Dark Web Forensics ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is analyzing a suspect's computer and finds a file named 'torrc' in the Tor installation directory. The examiner wants to understand how the suspect configured Tor. Which information in the torrc file is most relevant for forensic analysis?

   • AThe default Tor Browser download URL.
   • BThe list of configured bridge relays and entry nodes.
   • CThe system's hostname.
   • DThe user's Bitcoin wallet address.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A forensic examiner is analyzing a network capture from a computer that was using Tor. The examiner wants to identify the destination of the user's traffic. Which information in the capture is most useful?

   • AThe IP addresses of the Tor relays in the circuit.
   • BThe DNS queries made by the Tor process.
   • CThe plaintext HTTP requests sent to the destination server.
   • DThe encrypted TLS handshake to the first Tor relay (entry node).
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A digital forensics team is investigating an employee suspected of accessing the dark web from a company workstation. The team has access to the workstation's disk image. Which set of artifacts would be most useful to confirm the employee's dark web activity?

   • AThe employee's social media activity and chat logs.
   • BTor Browser profile files, Windows prefetch files, and the system's pagefile.
   • CThe employee's email archive and recent documents.
   • DThe company's firewall logs and the employee's browser bookmarks.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An investigator needs to capture a dark web page that is only available for a short time and requires a specific session cookie. The investigator has legal authorization. To ensure the evidence is admissible, which action is most important?

   • ACopy the page's HTML source code into a text file.
   • BTake a screenshot of the page and save it as a PDF.
   • CUse a forensic tool that captures the page content along with the full HTTP headers and session cookies.
   • DRecord the page in a video and narrate the investigator's actions.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a common structural feature of dark web marketplaces?

   • AOpen registration for anyone without any vetting process.
   • BVendor ratings and escrow services to build trust between buyers and sellers.
   • CMandatory use of credit cards for all transactions.
   • DCentralized hosting on a single server to ensure reliability.
   Reveal Solution Discussion Select an answer first