What type of information can be extracted from Tor log files during forensic analysis?

The content of encrypted messages sent through the network.

The IP addresses of Tor relays used in the circuit.

The real IP address of the user.

The private keys of hidden services.

A security analyst is explaining to a manager why a user's activity on a public forum is not considered 'dark web' activity, even though the user used a VPN. Which statement is accurate?

The dark web includes all websites that are not indexed by search engines.

A VPN alone does not make a site part of the dark web; the dark web requires specialized software like Tor and non-indexed hidden services.

Public forums are part of the deep web because they require login.

Any website accessed through a VPN is considered part of the dark web.

Which tool or method is commonly used by investigators to monitor and track activities on dark web forums and marketplaces?

Social media analytics tools that track hashtags.

Web crawlers specifically designed to index .onion sites.

Network intrusion detection systems (NIDS) deployed on the public internet.

Standard search engines like Google.

A new forensic analyst is learning about the structure of the internet. The analyst wants to understand the difference between the deep web and the dark web. Which statement correctly distinguishes them?

The deep web and dark web are the same thing.

The deep web is illegal, while the dark web is legal.

The deep web includes content not indexed by standard search engines, while the dark web requires special software like Tor to access.

The deep web is accessible only through Tor, while the dark web is accessible through standard browsers.

An undercover investigator is tasked with infiltrating a dark web community to identify a vendor. The investigator must maintain their cover while collecting evidence. Which action poses the greatest risk to the investigation?

Accessing the community from the same IP address used for official police work.

Communicating with other members using the same language and slang as the community.

Using a VPN in addition to Tor to add an extra layer of anonymity.

Using a dedicated undercover identity with a unique username and consistent background story.

EC-CouncilCertified Security Specialist

Domain 6Objective 5

Dark Web Forensics ECSS Practice Questions (Page 5)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

47questions here

10free pages

8concepts

Questions 21–25

21foundation · easy
What type of information can be extracted from Tor log files during forensic analysis?
Select an answer first
22application · medium
A security analyst is explaining to a manager why a user's activity on a public forum is not considered 'dark web' activity, even though the user used a VPN. Which statement is accurate?
Select an answer first
23foundation · easy
Which tool or method is commonly used by investigators to monitor and track activities on dark web forums and marketplaces?
Select an answer first
24application · easy
A new forensic analyst is learning about the structure of the internet. The analyst wants to understand the difference between the deep web and the dark web. Which statement correctly distinguishes them?
Select an answer first
25expert · hard
An undercover investigator is tasked with infiltrating a dark web community to identify a vendor. The investigator must maintain their cover while collecting evidence. Which action poses the greatest risk to the investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.