Dark Web Forensics ECSS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A forensic investigator needs to access a known .onion site to capture its current content as evidence. The investigator's workstation is on a corporate network that blocks direct Tor connections. The investigator must ensure the traffic is not associated with the corporate IP address. Which approach is most appropriate?

   • AConnect to the Tor network from a dedicated analysis machine on a separate, non-corporate internet connection.
   • BUse a Tor bridge relay configured on the workstation and route traffic through the corporate proxy.
   • CUse the Tor Browser on the corporate workstation without any additional configuration.
   • DAccess the .onion site via a public Tor-to-HTTP gateway.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic accountant is analyzing a dark web marketplace's Bitcoin transactions. The marketplace uses a Bitcoin mixer to obscure transactions. What is the primary challenge this creates for investigators?

   • AMixers delete the blockchain, erasing all transaction records.
   • BMixers require users to provide identity verification, which is a benefit for investigators.
   • CMixers convert Bitcoin to Monero, making transactions untraceable.
   • DMixers break the transaction trail, making it difficult to link specific inputs to outputs.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which technology is specifically designed to enable anonymous access to the dark web by routing traffic through a volunteer network of relays?

   • ATor (The Onion Router)
   • BDomain Name System (DNS)
   • CVirtual Private Network (VPN)
   • DSecure Sockets Layer (SSL)
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   During a dark web investigation, an analyst successfully downloads a file from a hidden service that is suspected to contain illegal content. The analyst needs to preserve this evidence for legal proceedings. What is the most critical step to ensure the evidence is admissible in court?

   • AEmail the file to the investigating officer for safekeeping.
   • BOpen the file to verify its contents before documenting anything.
   • CImmediately compute a cryptographic hash of the file and document the acquisition process, including the time, date, and tool used.
   • DStore the file on the analyst's personal cloud storage to ensure it is not lost.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic examiner is analyzing a memory dump from a suspect's computer. The suspect is believed to have used Tor Browser to access dark web sites. Which memory artifact would be most useful to confirm this activity?

   • AThe system's hibernation file, which may contain the entire memory state.
   • BThe browser's cache files on disk.
   • CStrings in memory that contain .onion URLs or Tor configuration data.
   • DThe Windows registry, which may contain Tor settings.
   Reveal Solution Discussion Select an answer first