Back to Subject

Unit 5: Dark Web Forensics, Investigating Email Crimes and Web Attacks - Practice Quiz

INT250 — Digital Evidence Analysis 50 Questions
0 Correct 0 Wrong 50 Left
0/50

1 Which part of the internet is not indexed by standard search engines and requires specific software, configurations, or authorization to access?

A. Transparent Web
B. Surface Web
C. Deep Web
D. Dark Web

2 What is the primary routing mechanism used by the Tor network to maintain user anonymity?

A. Garlic Routing
B. Tomato Routing
C. Onion Routing
D. Packet Switching

3 Which Top-Level Domain (TLD) is specifically associated with sites hosted on the Tor network?

A. .tor
B. .onion
C. .exe
D. .com

4 In the context of email basics, what does SMTP stand for?

A. Standard Mail Text Protocol
B. Simple Mail Transfer Protocol
C. System Mail Transfer Protocol
D. Secure Mail Transmission Protocol

5 Which protocol is primarily used by email clients to retrieve messages from a mail server?

A. SNMP
B. IMAP
C. FTP
D. SMTP

6 What is the most critical section of an email for forensic analysis when tracing the origin of a message?

A. The Email Header
B. The Email Body
C. The Subject Line
D. The Signature Block

7 Which specific field in an email header usually reveals the IP address of the sender?

A. Received
B. Return-Path
C. To
D. From

8 What is the term for an email attack where the sender manipulates the address to make it appear as if it came from a trusted source?

A. Email Spiking
B. Email Spoofing
C. Email Bombing
D. Email Sniffing

9 In a phishing investigation, what is 'Typosquatting'?

A. Using all caps in the subject line
B. Encrypting the email body
C. Deleting email logs
D. Registering a domain name extremely similar to a legitimate one

10 Which type of phishing attack specifically targets high-profile executives like CEOs or CFOs?

A. Spear Phishing
B. Vishing
C. Smishing
D. Whaling

11 What is the primary function of an Intrusion Detection System (IDS)?

A. To monitor network traffic for suspicious activity
B. To encrypt network data
C. To act as a web server
D. To block all network traffic

12 How does an Intrusion Prevention System (IPS) differ mainly from an IDS?

A. IPS is slower
B. IPS only logs data
C. IPS cannot detect viruses
D. IPS takes active action to stop the threat

13 Which type of IDS detection method relies on a database of known attack patterns?

A. Signature-based detection
B. Anomaly-based detection
C. Heuristic detection
D. Behavior-based detection

14 What is a 'False Positive' in the context of IDS/IPS?

A. A malicious attack that is missed
B. A legitimate activity flagged as malicious
C. A system crash
D. A successful virus removal

15 What does WAF stand for in web security?

A. Wireless Access Firewall
B. Wide Area Firewall
C. Windows Authentication File
D. Web Application Firewall

16 At which layer of the OSI model does a Web Application Firewall (WAF) primarily operate?

A. Layer 7 (Application)
B. Layer 3 (Network)
C. Layer 2 (Data Link)
D. Layer 4 (Transport)

17 Which attack involves injecting malicious SQL queries into input fields to manipulate a database?

A. Buffer Overflow
B. CSRF
C. SQL Injection
D. Cross-Site Scripting (XSS)

18 What type of web attack involves injecting malicious scripts into trusted websites viewed by other users?

A. Brute Force
B. Directory Traversal
C. Cross-Site Scripting (XSS)
D. SQL Injection

19 Which attack forces an end user to execute unwanted actions on a web application in which they are currently authenticated?

A. Packet Sniffing
B. Man-in-the-Middle
C. SQL Injection
D. Cross-Site Request Forgery (CSRF)

20 What is a 'Directory Traversal' attack?

A. Accessing restricted directories and files by manipulating file paths
B. Stealing cookies
C. Injecting SQL commands
D. Overloading the server with requests

21 In Email Forensics, what is the role of an MTA (Mail Transfer Agent)?

A. To display emails to the user
B. To route and transfer emails between servers
C. To read emails
D. To attach files

22 What is the standard port number for SMTP traffic?

A. 443
B. 21
C. 80
D. 25

23 Which component of an IDS is responsible for collecting data from the network?

A. Console
B. Sensor
C. Database
D. Analyzer

24 What is the main disadvantage of Anomaly-based IDS?

A. It is only for wireless networks
B. It has a high rate of false positives
C. It cannot detect new attacks
D. It requires virus signatures

25 Which web attack aims to make a machine or network resource unavailable to its intended users?

A. Phishing
B. Privilege Escalation
C. DoS (Denial of Service)
D. SQL Injection

26 What does a 'Logic Bomb' generally refer to in cyber crime?

A. A physical explosive
B. A failed hacking attempt
C. Malicious code set to execute when specific conditions are met
D. A type of firewall

27 Which of the following is a tool often used for network intrusion detection?

A. Snort
B. Word
C. Excel
D. Photoshop

28 In the context of the Dark Web, what is an 'Exit Node'?

A. The server where traffic leaves the Tor network to reach the open internet
B. The first server you connect to
C. A firewall rule
D. An offline server

29 What is the first step in an email crime investigation?

A. Seizing the suspect's computer
B. Acquiring and preserving the email evidence
C. Arresting the suspect
D. Deleting the spam

30 Which email protocol leaves the original email on the server by default?

A. FTP
B. HTTP
C. POP3
D. IMAP

31 What is 'Session Hijacking'?

A. Taking over a user's active web session by stealing the session ID
B. Breaking a password
C. Phishing for credit cards
D. Stealing a laptop

32 Which of the following is a passive security device?

A. IDS
B. Proxy Server
C. Firewall
D. IPS

33 In a SQL injection attack, what does the input ' OR '1'='1 typically achieve?

A. It encrypts the data
B. It deletes the database
C. It shuts down the server
D. It evaluates to True, bypassing authentication

34 Which type of XSS attack stores the malicious script permanently on the target server (e.g., in a forum post)?

A. Local XSS
B. Stored (Persistent) XSS
C. DOM-based XSS
D. Reflected XSS

35 What is the purpose of 'DKIM' in email security?

A. To encrypt the email body
B. To verify that an email message was not forged or altered
C. To archive emails
D. To block spam

36 A 'Zero-day' attack refers to:

A. An attack on a closed network
B. An attack that happens at midnight
C. An attack exploiting a vulnerability unknown to the software vendor
D. An attack that takes zero seconds

37 Which part of the email header is easiest to spoof?

A. From address
B. DKIM Signature
C. Message-ID
D. Received-By IP

38 What does a Host-based IDS (HIDS) monitor?

A. Traffic at the ISP level
B. Activity and logs on a specific individual device
C. Traffic on the entire subnet
D. Wireless signals only

39 What is 'Bitcoin's' primary role in the Dark Web?

A. It is the hosting provider
B. It is a common method for anonymous payment
C. It acts as a firewall
D. It is the software used to browse

40 Which attack involves an attacker intercepting communication between two parties?

A. DDoS
B. Man-in-the-Middle (MITM)
C. Logic Bomb
D. Phishing

41 What is 'Business Email Compromise' (BEC)?

A. Spam advertising
B. A scam compromising legitimate business email accounts to conduct unauthorized transfers
C. Email server maintenance
D. A virus that deletes emails

42 The 'Deep Web' includes:

A. Only social media
B. Only illegal content
C. Google search results
D. Anything not indexed by search engines (e.g., medical records, academic databases)

43 Which mechanism in a WAF allows only pre-approved traffic and blocks everything else?

A. Greylisting
B. Whitelisting
C. Redlisting
D. Blacklisting

44 In web attacks, what is a 'Brute Force' attack?

A. Guessing passwords by trying every possible combination
B. Injecting SQL code
C. Sending a virus via email
D. Physically breaking the server

45 What distinguishes a Distributed Denial of Service (DDoS) from a standard DoS?

A. DDoS uses a single attacker machine
B. DDoS uses multiple compromised systems (botnet) to attack
C. DDoS targets emails only
D. DDoS is slower

46 Which file on a web server determines which parts of the site crawlers are permitted to access?

A. index.html
B. style.css
C. config.php
D. robots.txt

47 What is the primary utility of 'Packet Sniffing' in forensics?

A. To edit files remotely
B. To capture and analyze data traffic moving across a network
C. To encrypt hard drives
D. To clean viruses

48 In email forensics, 'MUA' stands for:

A. Mail Unified Access
B. Mail User Agent
C. Mail Upload Agent
D. Master User Authorization

49 Which vulnerability allows an attacker to include a file, usually exploiting a 'dynamic file inclusion' mechanism implemented in the target application?

A. Syn Flood
B. Dictionary Attack
C. Local File Inclusion (LFI)
D. Brute Force

50 The 'Silk Road' was a famous marketplace located on:

A. Facebook
B. The Dark Web
C. The Surface Web
D. A private LAN
Previous MCQ
Unit 4
Next MCQ
Unit 6