Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An employee receives an email that appears to be from the company's CFO. The email says, 'I am in a meeting and cannot talk. Please purchase gift cards for our clients and send the codes to me immediately.' What is the most likely social engineering cue in this email?

   • AThe use of the CFO's name in the email.
   • BThe sense of urgency and the request to bypass normal procedures.
   • CThe email was sent during business hours.
   • DThe email contains a link to a website.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An employee received an email that appears to be from a vendor, requesting a change in payment details. The email contains a link to a website that asks for login credentials. The link's domain is different from the vendor's legitimate domain. Which combination of analysis techniques would be most effective in confirming this is a BEC attempt?

   • AVerify the sender's name in the corporate directory.
   • BLook at the email's subject line and urgency cues.
   • CAnalyze the URL for typosquatting and check the website's SSL certificate for the actual domain owner.
   • DCheck the email's SPF and DKIM records to see if they pass.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   An investigator is analyzing a BEC email that appears to be from the company's CEO. The email passed SPF and DKIM checks, but the investigator notices that the 'From' display name is 'CEO' and the actual email address is 'ceo@company-accounts.com', which is not the CEO's real address. What is the most likely explanation?

   • AThe email is a false positive and should be ignored.
   • BThe email was sent from the CEO's personal email account.
   • CThe attacker registered a lookalike domain and configured SPF/DKIM to pass, making the email appear legitimate.
   • DThe email is legitimate because it passed SPF and DKIM.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of a BEC investigation report?

   • ATo provide a technical manual for email server configuration
   • BTo communicate the findings and evidence in a clear and understandable manner to stakeholders and law enforcement
   • CTo list all employees' email addresses
   • DTo advertise the company's security products
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An investigator is examining an email that claims to be from 'admin@payroll.company.com'. The investigator performs a DNS lookup and finds that 'company.com' has an SPF record that does not include the sending server's IP. What does this indicate?

   • AThe email was sent from a backup server.
   • BThe email is likely spoofed because the sending server is not authorized by SPF.
   • CThe email is legitimate because SPF is not required.
   • DThe email is from a different domain that is also owned by the company.
   Reveal Solution Discussion Select an answer first