According to the CHFI v11 Dark Web Forensics objectives, governments that enforce strict internet censorship often block access to publicly listed Tor entry (guard) relays by using IP blacklisting, deep packet inspection (DPI), and traffic fingerprinting. In such environments, connecting directly to the Tor network using standard relay information becomes ineffective.
To overcome this restriction, Tor provides bridge nodes (Tor bridges) . Bridges are unlisted Tor entry relays whose IP addresses are not published in the public Tor directory , making them significantly harder for censors to detect and block. CHFI v11 explicitly identifies Tor bridges as a key mechanism for bypassing government surveillance and censorship. Bridges may also use pluggable transports (such as obfs4, meek, or snowflake) that disguise Tor traffic to appear like normal HTTPS or other benign traffic, further evading detection.
The other options are incorrect. Public Tor relay nodes are typically the first targets of censorship and are already blocked. Direct communication with an exit node is not possible because Tor circuits must always begin with an entry point. Collaborating with government authorities contradicts the goal of bypassing surveillance and is not a technical solution discussed in CHFI v11.
CHFI v11 emphasizes that investigators and analysts must understand Tor infrastructure, including bridges, to properly investigate dark web activity and censorship circumvention techniques. Therefore, the correct and CHFI-aligned method is to use bridge nodes to access the Tor network , making Option A the correct answer.

Option A is the most appropriate answer because CHFI v11 places strong emphasis on legal compliance, seeking consent, preserving evidence, chain of custody, and following a sound forensic process . In this scenario, the matter is administrative , the device owner is available , and investigators need access without altering data or resorting to more intrusive technical actions. Under those conditions, obtaining the employee' s voluntary cooperation and passcode disclosure is the most defensible and least disruptive method. The blueprint explicitly includes seeking consent , best practices for handling digital evidence , preserving evidence , and chain of custody under legal and procedural requirements.
This answer also aligns with CHFI's mobile forensics areas covering mobile phone evidence analysis, data acquisition methods, logical and physical acquisition of Android devices, and challenges in mobile forensics . Investigators should first use the least destructive, most lawful, and most forensically sound approach before considering advanced acquisition techniques.
Option B is too intrusive for this fact pattern, C alters device state, and D escalates unnecessarily when consent-based access is already available.

Option A is the best answer because the scenario already suggests that the attacker likely gained access through a remote connection using compromised credentials . The most logical next forensic step is to examine server logs for unusual login patterns , including failed logons, successful remote logins at abnormal times, privileged account use, and suspicious authentication sources. CHFI v11 explicitly includes event logs , types of logon events , evaluating account management events , and SQL Server logs as relevant evidence sources in operating system and application forensics.
Although identifying the source IP may later become important, investigators usually first validate the unauthorized access path through log review and then correlate it with IP data, account activity, and timeline evidence. A complete system scan is too broad as the next step, and reviewing recently accessed files does not directly answer how the attacker entered the database environment.
Because CHFI emphasizes log analysis , authentication event review , and timeline reconstruction when investigating intrusions, the strongest next step is to evaluate the server logs for unusual login patterns that explain how the attacker gained access.

Option B is the best answer because one of the most fundamental forensic acquisition principles is to avoid changing the original evidence . CHFI v11 emphasizes preserving evidence , best practices for handling digital evidence , data acquisition methodology , and maintaining evidence integrity so the results remain defensible in legal or disciplinary proceedings. That principle applies regardless of device type, operating system, or case category.
This rule of thumb is broader and more important than the other options because the correct acquisition approach depends on the system state and circumstances. Live acquisition is not always appropriate.
Focusing only on non-volatile data may cause investigators to miss valuable volatile evidence. Network- based acquisition is not universally the least intrusive or the best approach. What remains constant is the duty to minimize alteration of the original source.
By preserving the original data and performing analysis on properly acquired copies, the investigator protects the integrity, repeatability, and admissibility of the evidence. Therefore, the most accurate CHFI-aligned rule of thumb is that Edward should avoid making changes to the original data during acquisition.

According to the CHFI v11 Network and Web Attacks domain, the primary purpose of deploying and analyzing honeypots , such as Kippo , is to observe, capture, and understand attacker behavior in a controlled environment . Honeypots are intentionally vulnerable systems designed to attract attackers so their actions can be studied without risking production assets.
CHFI v11 emphasizes that honeypot logs provide high-fidelity intelligence because any interaction with a honeypot is inherently suspicious . By analyzing these logs, investigators can identify attack techniques, tools, malware payloads, command sequences, exploitation patterns, brute-force attempts, and post- compromise activities . This information is invaluable for understanding attacker tactics, techniques, and procedures (TTPs) and for strengthening detection, prevention, and response strategies.
While honeypot data may indirectly reveal vulnerabilities or support security optimization, these are secondary benefits . Honeypots are not primarily deployed for compliance reporting or performance monitoring of security controls. CHFI v11 clearly positions honeypot analysis as a threat intelligence and attacker profiling mechanism , enabling organizations to anticipate real-world attacks and improve defensive readiness.
Therefore, the paramount objective of analyzing honeypot logs-fully aligned with CHFI v11-is to identify, track, and understand attacker methodologies and strategies , making Option A the correct answer.