Email and Social Media Forensics CHFI Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which ethical principle is most important when handling social media evidence?

   • AMaintaining the confidentiality and privacy of the individuals involved
   • BSharing the evidence with the public
   • CUsing the evidence for personal gain
   • DMaximizing the amount of data collected
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a forensic examination of a smartphone, you need to recover social media artifacts from the Facebook and Twitter apps. The phone is an Android device with full disk encryption enabled. The user has recently uninstalled the Facebook app but still uses Twitter. Which approach would yield the most useful data?

   • ACheck the device's call logs and SMS messages for social media links.
   • BPerform a logical acquisition of the device and extract app data from the Android data directories and caches.
   • COnly analyze the browser history for social media activity.
   • DPerform a physical acquisition of the device's raw flash memory.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which email authentication standard helps detect spoofing by allowing a domain owner to publish a policy that specifies which mail servers are authorized to send email on behalf of the domain?

   • APGP (Pretty Good Privacy)
   • BMIME (Multipurpose Internet Mail Extensions)
   • CSPF (Sender Policy Framework)
   • DTLS (Transport Layer Security)
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A user reports receiving a suspicious email that appears to come from the company's CEO, but the reply-to address is an external domain. You examine the full headers. The 'Received' chain shows the message entered the company's mail server from an IP address in a foreign country, and the 'Authentication-Results' header shows 'spf=fail' and 'dkim=fail'. The 'From' header displays the CEO's name and email address. What is the most reliable conclusion from this header analysis?

   • AThe email must have been sent from the CEO's account because the Reply-To is external.
   • BThe email is legitimate because the From header matches the CEO's name and address.
   • CThe email is likely spoofed, but the true original sender cannot be determined solely from the visible Received chain.
   • DThe email was definitely sent by an attacker from the foreign IP address.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A forensic examiner is analyzing a phishing email that bypassed the company's spam filter. The email's headers show 'SPF: pass' and 'DKIM: pass', but the 'From' domain is a lookalike of the company's domain (e.g., 'company.com' vs 'cornpany.com'). The 'Received' chain shows the email originated from a cloud-based email service. The examiner needs to determine if the email is truly from the lookalike domain or if it was spoofed. Which of the following is the most reliable indicator?

   • AThe SPF and DKIM pass results prove the email is from the lookalike domain.
   • BThe 'Reply-To' header, which is often set to a different domain in spoofing attempts.
   • CThe 'Message-ID' header, which is unique and can be traced to the sender's mail client.
   • DThe originating IP address in the Received header, which can be traced to the cloud service provider.
   Reveal Solution Discussion Select an answer first