During a BEC investigation, an analyst needs to preserve evidence from a compromised email account. The email service is cloud-based. What should the analyst do first to ensure the evidence is preserved for legal proceedings?

Take screenshots of the emails and store them in a shared folder.

Delete the emails from the user's mailbox to prevent further access.

Place a legal hold on the mailbox and export the relevant emails with their full headers.

Forward the emails to the investigator's personal email account.

An investigator is documenting evidence from a BEC case. The evidence includes emails, logs, and financial records. What is the most important aspect of documentation for legal proceedings?

Storing the evidence on the investigator's personal device.

Summarizing the evidence in a single paragraph.

Maintaining a chain of custody and recording who accessed the evidence and when.

Deleting duplicate emails to reduce clutter.

Which DNS record type is used to verify that a domain is authorized to send email on behalf of itself?

SPF (Sender Policy Framework) record

An employee receives an email that says, 'Your account will be suspended unless you verify your password immediately by clicking this link.' The email is not signed and the sender address is slightly misspelled. What is the most likely classification of this email?

A spam email advertising a product.

A phishing email attempting to harvest credentials.

A legitimate security notification from the IT department.

You are analyzing an email header from a suspected BEC email. The header shows a 'Received' chain with an IP address that resolves to a cloud provider, and the 'From' field displays the CEO's name. Which header field is most useful for determining the actual originating IP address?

The 'Message-ID' field, which uniquely identifies the message.

The first 'Received' field in the header (the bottom-most one) that shows the originating IP.

The 'Return-Path' field, which indicates the envelope sender.

The 'Reply-To' field, which shows the address that replies will be sent to.

EC-CouncilDigital Forensics Essentials

Domain 6Objective 5

Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 1)

Part of the Dark Web and Email Forensics domain, which makes up ~16% of our current practice bank.

54questions here

11free pages

10concepts

Questions 1–5

1application · medium
During a BEC investigation, an analyst needs to preserve evidence from a compromised email account. The email service is cloud-based. What should the analyst do first to ensure the evidence is preserved for legal proceedings?
Select an answer first
2application · medium
An investigator is documenting evidence from a BEC case. The evidence includes emails, logs, and financial records. What is the most important aspect of documentation for legal proceedings?
Select an answer first
3foundation · easy
Which DNS record type is used to verify that a domain is authorized to send email on behalf of itself?
Select an answer first
4application · medium
An employee receives an email that says, 'Your account will be suspended unless you verify your password immediately by clicking this link.' The email is not signed and the sender address is slightly misspelled. What is the most likely classification of this email?
Select an answer first
5application · medium
You are analyzing an email header from a suspected BEC email. The header shows a 'Received' chain with an IP address that resolves to a cloud provider, and the 'From' field displays the CEO's name. Which header field is most useful for determining the actual originating IP address?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.