The Dark Web

• A. A separate internet that cannot be reached by standard browsers, requiring a different physical network
• B. Content on overlay networks that are not indexed by standard search engines and require special software to access ✓
• C. The part of the internet where all illegal activity takes place
• D. A government-controlled archive of deleted websites from the early 2000s

Why: The dark web consists of content hosted on overlay networks, such as Tor or I2P, that standard search engines don't index and that need special software to reach. It is not a physically separate internet, and it is not synonymous with illegal activity.

• A. The deep web is another name for the dark web and the two terms are interchangeable
• B. The deep web is any content not indexed by search engines, such as email inboxes and paywalled databases, while the dark web is a small subset reachable only through special networks ✓
• C. The deep web is faster than the dark web because it uses a different protocol
• D. The deep web contains only government documents, while the dark web contains only private messages

Why: The deep web covers all content that search engines don't index, including private accounts, academic databases, and paywalled material. The dark web is a much smaller portion of this that requires specialized networks like Tor to access.

• A. Buying stolen credit card numbers
• B. Allowing journalists and activists in restrictive countries to communicate and access information privately ✓
• C. Distributing malware to unsuspecting users
• D. Hosting illegal marketplaces for weapons

Why: Anonymity networks are used by journalists, whistleblowers, and people living under censorship to communicate safely and reach blocked news sources. The other options describe criminal uses, which are real but not the only or defining purpose of these networks.

• A. It encrypts data and routes it through multiple volunteer-run relays so no single relay knows both the sender and the destination ✓
• B. It deletes all browsing history immediately after each session
• C. It hides your IP address by replacing it with a government-issued identifier
• D. It blocks all websites that contain tracking scripts

Why: Tor uses layered encryption and sends traffic through several relays. Each relay only knows the previous and next hop, so no single point can link a user's identity to their destination. Tor does not erase history, use government identifiers, or block trackers by design.

• A. Any .onion address is guaranteed to be safe and verified by the Tor Project
• B. Using the dark web makes you completely invisible, so no security precautions are needed
• C. Being on the dark web does not automatically make a site illegal, but users still face risks such as scams, malware, and phishing ✓
• D. Dark web sites cannot be accessed without a paid subscription

Why: Many dark web sites are legitimate, such as news outlets and privacy-focused services, but the environment carries real risks including scams, malware, and impersonation. .onion addresses are not vetted, and anonymity depends on careful user behavior rather than being automatic.

• A. To compress data so it transfers faster across the internet
• B. To encrypt data in layers and relay it through multiple nodes so no single node knows both the sender and destination
• C. To store copies of websites on a central server for faster access
• D. To block all incoming connections to a user's computer

• A. A node that decrypts the final layer of traffic before it reaches the destination website
• B. A node that serves as the first hop in a circuit, knowing the user's IP address but not the final destination
• C. A node that blocks malicious exit traffic from reaching users
• D. A node that stores encryption keys for all users on the network

• A. Three hops is the minimum required by the internet protocol
• B. Each additional hop increases speed, so three is the optimal balance
• C. Splitting trust across guard, middle, and exit relays means no single relay can link the user to their destination
• D. Three hops is required to access .onion addresses only

• A. They cannot encrypt any traffic at all
• B. Anonymity does not protect against traffic correlation attacks, malware, or user behavior that reveals identity, such as logging into personal accounts
• C. They only work on Windows operating systems
• D. They permanently delete all browsing history on the device

• A. It creates the user's encryption keys at the start of the session
• B. It removes the final encryption layer and forwards traffic to the destination, so it can see the unencrypted content unless end-to-end encryption such as HTTPS is used
• C. It hides the user's IP address from the entry guard
• D. It stores a permanent log of every site the user visits

• A. A search engine that indexes all websites on the internet
• B. Content on overlay networks that requires special software, such as Tor, to access ✓
• C. A government-run database of classified documents
• D. Any website that has been taken offline or deleted

Why: The dark web consists of sites hosted on overlay networks like Tor or I2P that are not indexed by standard search engines and require specialized software to reach. It is distinct from the deep web, which simply includes pages not indexed by search engines, such as email inboxes and private databases.

• A. To make your device run faster by compressing data
• B. To encrypt your traffic and mask your IP address from the websites you visit ✓
• C. To permanently delete your browsing history from your device
• D. To block all advertisements on the websites you visit

Why: A Virtual Private Network encrypts data between your device and the VPN server, and the websites you visit see the VPN server's IP address instead of yours. This hides your browsing activity from your Internet Service Provider and local network observers, though the VPN provider itself can still see your traffic, so trust in the provider matters.

• A. The encrypted content of a message
• B. Data about data, such as who communicated with whom, when, and for how long ✓
• C. The password used to protect a file
• D. Software code that runs inside a web browser

Why: Metadata describes the circumstances of communication rather than its content. Even when message contents are encrypted, metadata such as timestamps, sender and recipient identifiers, and call durations can reveal sensitive patterns about a person's relationships and behavior, which is why it is a significant focus of surveillance programs.

• A. Reusing the same strong password across multiple accounts for convenience
• B. Disabling two-factor authentication to reduce login steps
• C. Using a password manager to generate and store unique passwords for each account ✓
• D. Sharing your device passwords with trusted friends

Why: Password managers allow users to create long, random, unique passwords for every account without having to memorize them, which limits the damage when one service is breached. Reusing passwords lets a single breach compromise many accounts, and disabling two-factor authentication removes a key layer of protection.

• A. Encryption that only protects messages while they are stored on a company's servers
• B. A system where only the communicating devices hold the keys needed to read messages, so the service provider cannot read them ✓
• C. A method of encrypting only the first and last words of each message
• D. A government-mandated backdoor that allows law enforcement to read all messages

Why: With end-to-end encryption, messages are encrypted on the sender's device and decrypted only on the recipient's device, so intermediaries such as the messaging company cannot access the plaintext. This is a core privacy feature in applications like Signal, though metadata may still be visible to the provider.

• A. It makes your browser load pages faster by compressing data
• B. It hides your IP address from your Internet Service Provider before you connect to Tor
• C. It automatically blocks all malware downloads
• D. It allows you to access websites that are not indexed by search engines

• A. It uses HTTPS encryption
• B. It has a professional-looking logo
• C. It creates urgent pressure to enter login credentials or personal information
• D. It has a long privacy policy

• A. Updates change the color scheme of your browser
• B. Updates patch security vulnerabilities that attackers could exploit
• C. Updates remove the need for antivirus software
• D. Updates increase the speed of onion site loading

• A. Open it immediately to see what it contains
• B. Disable your antivirus so the file can install properly
• C. Avoid downloading files, since they can contain malware, and scan any file you must open
• D. Share it with friends to verify whether it is safe

• A. It enables full JavaScript functionality on all sites for the best experience
• B. It disables JavaScript entirely, reducing the attack surface for exploits
• C. It only enables JavaScript for sites you have bookmarked
• D. It replaces JavaScript with a faster scripting language

• A. Their prices are always higher than surface web stores
• B. Scam and exit-scam risk: sellers or site operators can take payment and disappear with no recourse
• C. Products are always stored in standard shipping containers that are easily detected
• D. Transactions are always reversed by the blockchain automatically

• A. A marketplace operator closing the site to perform routine maintenance
• B. A seller leaving the platform after receiving a good review rating
• C. A site operator collecting deposits from users and then shutting down the platform, taking all funds
• D. A buyer leaving a negative review after a legitimate purchase

• A. To guarantee that sellers receive payment immediately, regardless of delivery
• B. To hold buyer funds temporarily until the transaction is confirmed, reducing the risk of non-delivery fraud
• C. To avoid paying taxes on transactions
• D. To make it impossible for law enforcement to trace payments

• A. Trusting vendors with a high number of listings regardless of feedback
• B. Relying solely on the vendor's own claims about their reputation
• C. Reviewing feedback history over time and noting patterns, since fake or recently created accounts can be easily manufactured
• D. Assuming that any vendor with a PGP key is automatically trustworthy

• A. Marketplaces automatically report users' identities to the public
• B. Law enforcement actively monitors and can prosecute buyers and sellers, and marketplaces are frequently seized in operations
• C. Accessing a marketplace is illegal only if you pay in cryptocurrency
• D. Legal risk applies only to vendors, never to buyers

• A. Dark web
• B. Deep web ✓
• C. Surface web
• D. Clear web

Why: The deep web includes all content not indexed by standard search engines, such as private accounts, academic databases, and login-protected pages. The dark web is a small subset of the deep web that requires special software like Tor to access.

• A. It speeds up broadband connections for home users
• B. It routes traffic through multiple encrypted relays to obscure users' locations and identities ✓
• C. It indexes websites so they appear in search engine results
• D. It stores copies of websites in case the original server goes offline

Why: Tor (The Onion Router) bounces traffic through a series of volunteer-operated relays with layered encryption, making it difficult to trace a user's IP address or identify the destination server.

• A. To compress the data and save storage space
• B. To preserve the original evidence and maintain its integrity for analysis and court admissibility ✓
• C. To make the device run faster during investigation
• D. To encrypt the data so it cannot be altered

Why: A forensic image is an exact copy that preserves all data, including deleted files and slack space. Analysts work on the copy so the original evidence remains unaltered, and hash values verify that the copy matches the source.

• A. Only the lead investigator may ever touch the evidence
• B. Every transfer and access to evidence must be documented with who, when, and why ✓
• C. Evidence should be stored on a personal device for convenience
• D. Original evidence should be modified to make it easier to read

Why: Chain of custody documentation tracks every person who handles evidence and every transfer, ensuring the evidence has not been tampered with and remains admissible in legal proceedings.

• A. To determine the file size of stored evidence
• B. To verify that a copy of data is identical to the original and has not been altered ✓
• C. To translate encrypted files into readable text
• D. To identify the operating system used on a device

Why: A cryptographic hash acts as a digital fingerprint. If the hash of a forensic copy matches the hash of the original, the copy is an exact duplicate, which supports the integrity of evidence presented in court.

• A. Collecting as much data as possible to maximize findings
• B. Minimizing harm to individuals and respecting privacy, even when data is publicly accessible
• C. Publishing all raw data immediately to ensure transparency
• D. Avoiding any institutional review because the data is anonymous

• A. Participants are always legally required to sign contracts
• B. Researchers often cannot identify or contact the people whose posts or data they analyze
• C. Consent is never needed for any form of online research
• D. Dark web users always consent by default through their use of Tor

• A. To receive faster access to illegal marketplaces
• B. To assess risks to human subjects and ensure compliance with legal and ethical standards
• C. To avoid having to document their methodology
• D. To obtain permission to purchase stolen data

• A. Sharing full datasets publicly so others can verify findings
• B. Anonymizing or aggregating data, limiting access, and securely storing it
• C. Keeping data indefinitely in unsecured personal folders
• D. Using the data to identify and expose individuals named in it

• A. Ignore it, since the research protocol only covers data analysis
• B. Follow institutional guidelines and consider reporting to appropriate authorities while consulting ethics or legal advisors
• C. Engage with the criminals to gather more evidence for a publication
• D. Post the evidence publicly to warn people immediately