Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   You are documenting evidence for a BEC investigation that will be reported to law enforcement. Which documentation practice is most critical for ensuring the evidence is admissible?

   • AEmail the evidence files to the legal team for review.
   • BStore all evidence on a personal laptop for easy access.
   • CRecord the hash values of all evidence files and maintain a detailed chain of custody log.
   • DSummarize the findings in a clear report for stakeholders.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company suspects a BEC attack led to a fraudulent wire transfer. The investigator has email logs and financial transaction records. What is the primary goal of correlating these data sources?

   • ATo establish a timeline and link the email request to the specific transaction.
   • BTo recover the deleted emails from the server.
   • CTo determine the email server's IP address.
   • DTo identify the email's spam score.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company discovered a fraudulent wire transfer of $50,000 to an unknown account. The finance team found an email instructing the transfer, but the email appears to be from the CFO. You need to trace the fraudulent transfer. Which approach is most effective?

   • AAsk the CFO if they authorized the transfer.
   • BCheck the bank's website for a list of recent transactions.
   • CCorrelate the timestamp of the email with the wire transfer initiation time and the IP address of the person who initiated the transfer.
   • DSearch the email server logs for any emails sent to the CFO's address.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Why is it important to document the chain of custody for BEC evidence?

   • ATo prove that the evidence has not been tampered with and to maintain its admissibility in court
   • BTo determine the email's origin
   • CTo calculate the financial loss
   • DTo identify the attacker's identity
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An employee received an email from a 'client' with an attachment named 'Invoice.pdf.exe'. The email urges the employee to open the attachment immediately to avoid late fees. What is the most appropriate action for the investigator to take?

   • AOpen the attachment on a test machine to see what it does.
   • BQuarantine the email and analyze the attachment in a sandbox environment to determine if it contains malware.
   • CReply to the email to ask the sender if the attachment is legitimate.
   • DDelete the email immediately to prevent any risk.
   Reveal Solution Discussion Select an answer first