Unit 5: Dark Web, Email, and Web Attacks - Practice Quiz

1 What is the dark web?

2 Which software is commonly used to access websites on the Tor dark web?

3 Which statement correctly distinguishes the dark web from the deep web?

4 Which email field identifies the main recipient of a message?

5 Which protocol is commonly used to send email messages?

6 What is an email attachment?

7 What should an investigator do first with a potentially important email?

8 Which part of an email can show the servers through which the message traveled?

9 Why is a hash value calculated for collected email evidence?

10 What is the primary purpose of an Intrusion Detection System (IDS)?

11 What does a network-based IDS mainly monitor?

12 What does an IDS commonly produce when it identifies suspicious behavior?

13 What is the main purpose of an Intrusion Prevention System (IPS)?

14 What is a basic difference between an IDS and an IPS?

15 Why is an IPS commonly placed inline with network traffic?

16 What does a Web Application Firewall (WAF) primarily protect?

17 Which type of traffic is commonly inspected by a WAF?

18 Which web attack attempts to insert malicious database commands into an input field?

19 Which attack injects malicious scripts into web pages viewed by other users?

20 What does a Cross-Site Request Forgery (CSRF) attack attempt to do?

21 A dark-web vendor consistently signs marketplace announcements with the same PGP key. Which artifact found on a suspect's seized laptop would most strongly link the suspect to that vendor identity?

22 An investigator must preserve a dark-web listing that may soon disappear. Which approach provides the strongest evidentiary record?

23 When examining an email's Received headers, how should an investigator usually identify the earliest documented mail server in the route?

24 A recipient received an email through Bcc, but their address does not appear in the message headers. Which source is most likely to confirm that the server delivered the message to that address?

25 An email has a valid DKIM result for news.example. What does this result establish most directly?

26 An investigator receives a suspicious email as an .eml file. What should be done before opening attachments or modifying the evidence?

27 An email displays From: security@bank.example, but SPF passes only for bounce.attacker.example, and no DKIM signature is present. What is the best interpretation?

28 A suspicious email contains a password-protected document. Which initial examination method best reduces risk while preserving useful evidence?

29 Email headers, firewall logs, and authentication logs use different time zones. What should an investigator do before correlating the events?

30 A network IDS detects command-and-control traffic and generates an alert, but the connection continues. Which characteristic best explains this behavior?

31 An anomaly-based IDS begins alerting on a newly deployed backup service because the service transfers unusually large amounts of data at night. What is the most appropriate response?

32 Network traffic to a server is encrypted with TLS, limiting a network IDS's visibility. Which deployment would provide better evidence of malicious activity after decryption?

33 Where should an IPS be positioned if it must automatically stop malicious packets before they reach an internal web server?

34 A new IPS signature may block a legitimate business application. Which rollout strategy best balances protection and availability?

35 A WAF is placed in front of an HTTPS application, but TLS terminates only on the application server. Why might the WAF fail to detect SQL injection in request bodies?

36 A critical web framework vulnerability has been disclosed, but the application cannot be patched until the next maintenance window. What can a WAF provide temporarily?

37 A login query is constructed by concatenating user input into SELECT * FROM users WHERE name='...'. Which change most directly prevents SQL injection?

38 A forum stores a malicious script in a comment. The script executes whenever another user views the discussion. Which attack occurred?

39 A logged-in user visits a malicious page that silently submits a request to change the user's email address on another site. Which control most directly prevents this attack?

40 A web application fetches images from URLs supplied by users. An attacker submits http://169.254.169.254/latest/meta-data/ and obtains cloud credentials. Which vulnerability was exploited?

41 Investigators suspect that two Tor onion marketplaces are operated by the same person. Which evidence most strongly supports this attribution while still requiring corroboration?

42 A live server hosting an onion service is seized under valid legal authority. Which acquisition strategy best preserves evidence that may disappear when the system is powered off?

43 A cryptocurrency withdrawal from a dark-web market enters a CoinJoin transaction and later reaches a regulated exchange. What is the most defensible forensic conclusion?

44 An email is forwarded by a conventional mailing list. SPF fails because the forwarding server is not authorized by the original envelope sender, but an aligned DKIM signature remains valid. Under ordinary DMARC evaluation, what is the expected result?

45 A suspicious message contains five Received: fields, including two attacker-supplied fields below the entry added by the recipient's secure email gateway. Which method best identifies the earliest trustworthy transport hop?

46 A message is signed using DKIM with relaxed header and relaxed body canonicalization. Which modification is most likely to preserve signature validity?

47 Investigators obtain a running laptop and a provider-hosted mailbox in an email-extortion case. Which sequence best supports forensic integrity and completeness?

48 A business email compromise used a malicious OAuth application rather than a stolen password. Which evidence set is most likely to establish the access mechanism and subsequent mailbox activity?

49 An email's Date: field shows 09:15 with a -0500 offset, the receiving gateway logs 14:17 UTC, and the suspect computer clock was seven minutes fast. What is the soundest timeline practice?

50 A MIME attachment's Base64 text has one hash, while the decoded executable has another. Which reporting approach is forensically correct?

51 An IDS examines events of which are truly malicious. Its true-positive rate is , and its false-positive rate is . Approximately what proportion of alerts represent real attacks?

52 TLS inspection is unavailable, but defenders must detect possible command-and-control traffic in encrypted sessions. Which IDS strategy is most appropriate?

53 An attacker sends overlapping IP fragments that the IDS and protected server reassemble differently. Which defense most directly addresses this evasion technique?

54 An inline IPS is configured to fail open if its inspection engine crashes. Which statement most accurately describes the resulting risk trade-off?

55 A critical exploit is active, but a new IPS signature may block legitimate requests sharing similar byte patterns. Which deployment plan best balances rapid protection and operational safety?

56 A reverse proxy decodes a URL once, the WAF inspects that result, and the application decodes it again. An attacker exploits double encoding to bypass a traversal rule. Which remediation is strongest?

57 A retail API validates each purchase request, but attackers send concurrent requests that collectively buy more limited-stock items than exist. Why is a WAF alone unlikely to solve the defect?

58 An application uses prepared statements for values but concatenates a user-controlled sort parameter into an SQL ORDER BY clause. What is the safest correction?

59 A front-end proxy honors Content-Length, while a back-end server prioritizes Transfer-Encoding: chunked. What attack can arise from this parser disagreement, and what is the best primary mitigation?

60 A server-side URL fetcher blocks literal private IP addresses but follows redirects and performs fresh DNS lookups. Which control set best mitigates SSRF, including DNS rebinding?