Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 11)

Questions 51–54

1. 51application · medium

   An investigator is verifying the authenticity of a sender's email address. The email claims to be from 'support@secure-bank.com'. The investigator performs a WHOIS lookup on 'secure-bank.com' and finds that the domain was registered two days ago. What does this indicate?

   • AThe domain is likely fraudulent because it was recently registered.
   • BThe email is definitely safe because it uses a secure connection.
   • CThe email is from a well-established bank because the domain name is similar.
   • DThe domain is legitimate because it has a valid WHOIS record.
   Reveal Solution Discussion Select an answer first
2. 52expert · medium

   During a BEC investigation, the investigator needs to preserve evidence from a cloud-based email system. The company is subject to legal hold requirements. The investigator must ensure the evidence is admissible in court. What is the best course of action?

   • APlace a legal hold on the relevant mailboxes, then export the emails with full headers and metadata using a forensic tool.
   • BCopy the emails to a USB drive and store it in a safe.
   • CTake screenshots of the emails and save them as PDFs.
   • DPrint the emails and store the hard copies.
   Reveal Solution Discussion Select an answer first
4. 53expert · medium

   After a BEC investigation, the investigator must write a report for both the company's executives and law enforcement. The executives need a business impact summary, while law enforcement needs technical details and evidence. What is the best approach?

   • AWrite two separate reports: one for executives and one for law enforcement.
   • BWrite a brief summary and include all raw data without explanation.
   • CWrite a technical report only and let the executives ask questions.
   • DWrite a single report with an executive summary at the beginning and detailed technical appendices.
   Reveal Solution Discussion Select an answer first
5. 54expert · medium

   A BEC email contains a link that appears to be a shortened URL. The investigator needs to determine the final destination of the URL without accessing it directly. What is the best method?

   • AUse a URL expander service to reveal the full URL, then check its reputation.
   • BPerform a WHOIS lookup on the shortened URL domain.
   • CCopy the link and paste it into an email to the user to verify.
   • DClick the link in a sandboxed browser to see where it goes.
   Reveal Solution Discussion Select an answer first