Dark Web Forensics ECSS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An investigator is monitoring a dark web forum that requires registration. The investigator creates an undercover account. To maintain the account's credibility, the investigator must post occasionally. What is the most important consideration when posting?

   • APost frequently to build a reputation quickly.
   • BShare personal details to appear more authentic.
   • CUse the same username across multiple forums to build a consistent identity.
   • DAvoid posting content that could be interpreted as entrapment or that encourages illegal activity.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is setting up a monitoring system to detect employees accessing the dark web through the corporate network. The team wants to identify Tor traffic without blocking it entirely. What is the most effective technical approach?

   • ADeploy network monitoring tools that can identify Tor traffic by analyzing connection patterns and TLS fingerprints.
   • BBlock all traffic to known Tor relay IP addresses using a firewall.
   • CMonitor DNS queries for .onion domains.
   • DUse deep packet inspection to decrypt all HTTPS traffic.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A law enforcement agent is investigating a dark web marketplace that sells stolen credit card data. The marketplace requires payment in Monero. Why might the marketplace prefer Monero over Bitcoin?

   • AMonero transactions are faster than Bitcoin, allowing quicker confirmation of payments.
   • BMonero has lower transaction fees than Bitcoin, making it more economical for high-volume sales.
   • CMonero is more widely accepted by legitimate businesses, making it easier to convert to cash.
   • DMonero transactions are private by default, obscuring the sender, receiver, and amount, making it harder for investigators to trace payments.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a forensic analysis of a suspect's computer, an investigator finds a file named 'hs_ed25519_secret_key' in a Tor data directory. What does this artifact indicate?

   • AThe suspect attempted to mine cryptocurrency.
   • BThe suspect operated a Tor hidden service from this computer.
   • CThe suspect's Tor Browser was configured to use a bridge.
   • DThe suspect used Tor to access hidden services.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An investigator is monitoring a dark web forum to identify a user who posts threats. The investigator has set up a monitoring tool that captures all public posts. The investigator wants to ensure the monitoring is legally defensible. Which action is most important?

   • AObtain a warrant or other legal authorization before monitoring the forum.
   • BUse a VPN to hide the investigator's IP address while monitoring.
   • COnly monitor posts that are publicly visible without logging in.
   • DStore all captured data on an encrypted external drive.
   Reveal Solution Discussion Select an answer first