Dark Web Forensics ECSS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A forensic investigator is planning to conduct undercover operations on a dark web marketplace that is hosted in a foreign jurisdiction. The investigator's agency has legal authority to investigate but is concerned about jurisdictional issues. What is the most critical legal consideration before proceeding?

   • AEnsure the investigator uses a VPN to hide their identity from foreign authorities.
   • BProceed with the investigation because the marketplace is illegal in the investigator's own jurisdiction.
   • CObtain authorization from the relevant authorities in the foreign jurisdiction where the marketplace is hosted.
   • DLimit the investigation to passive monitoring to avoid any legal issues.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An investigator is tracing Bitcoin payments from a dark web marketplace to a suspect's wallet. The investigator has identified a cluster of addresses believed to belong to the suspect. Which additional data source would most strengthen the link between the Bitcoin addresses and the suspect's real identity?

   • AThe suspect's public social media posts about cryptocurrency.
   • BA cryptocurrency exchange's Know Your Customer (KYC) records for deposits from those addresses.
   • CThe suspect's computer's browser history showing visits to blockchain explorers.
   • DThe suspect's electricity bill, which may indicate cryptocurrency mining.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A forensic analyst is investigating a dark web marketplace that uses Bitcoin for transactions. The analyst has identified a Bitcoin address that received payments from the marketplace. What technique can help link this address to a real-world identity?

   • ACluster analysis of the Bitcoin address to identify other addresses controlled by the same entity, then check for interactions with regulated exchanges.
   • BSearch the Bitcoin blockchain for the address's private key.
   • CContact the marketplace to request the buyer's identity.
   • DUse a Bitcoin mixer to trace the address's transactions.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An investigator is preparing to capture evidence from a dark web forum that requires login. The investigator has legal authority to use a seized account. The forum is hosted on a Tor hidden service. The investigator must preserve evidence that will be admissible in court. Which step is most critical to ensure the admissibility of the captured evidence?

   • AUse screen recording software to capture the entire session and store the video on the investigator's workstation.
   • BRecord the exact date and time of the capture and save the files to a USB drive.
   • CPrint the forum pages and have the investigator sign and date each printout.
   • DDocument the chain of custody, hash all captured files, and store them on write-protected media.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is monitoring a dark web marketplace to understand its structure and the types of goods sold. The analyst wants to gather data without interacting with vendors or making purchases. Which approach is most appropriate?

   • AUse web scraping tools to collect public listings and vendor profiles from the marketplace.
   • BCreate an undercover buyer account and place a small test order to see the vendor's response.
   • CContact the marketplace administrator directly to request sales statistics.
   • DAnalyze the marketplace's Bitcoin addresses to estimate revenue without accessing the site.
   Reveal Solution Discussion Select an answer first