Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has experienced a BEC attack where the attacker impersonated the CEO and requested a wire transfer. The email was sent from a look-alike domain. Which phase of the BEC attack does this scenario primarily represent?

   • AThe recovery phase, where the company tries to recover funds.
   • BThe exfiltration phase, where the attacker steals data.
   • CThe reconnaissance phase, where the attacker gathers information about the CEO.
   • DThe execution phase, where the attacker sends the fraudulent request.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which part of an email header is most useful for tracing the path an email took from sender to recipient?

   • AThe 'Content-Type' field
   • BThe 'MIME-Version' field
   • CThe 'Received' fields
   • DThe 'Subject' field
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An email header shows the 'From' field as 'ceo@company.com' but the 'Reply-To' field is 'ceo@company-accounts.com'. What does this discrepancy indicate?

   • AThe email may be part of a BEC attack because replies are directed to a different domain.
   • BThe email is a newsletter because Reply-To is often different.
   • CThe email is legitimate because the Reply-To is a subdomain.
   • DThe email was sent from a mobile device.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a BEC email, which of the following requests is a classic indicator of a fraudulent transaction?

   • AA request to update a company directory
   • BA request to schedule a meeting
   • CA request to change payment details for an existing vendor
   • DA request to confirm receipt of an email
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of performing a WHOIS lookup on a sender's domain during a BEC investigation?

   • ATo check if the domain has a valid SSL certificate
   • BTo determine the domain's registration details, such as the registrant and creation date
   • CTo find the recipient's email address
   • DTo identify the email server's IP address
   Reveal Solution Discussion Select an answer first