Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a BEC investigation, which type of metadata is most useful for establishing the origin of a fraudulent email?

   • AWeb browser history of the recipient
   • BFile system metadata of the recipient's computer
   • CEmail header metadata, including the originating IP address and routing path
   • DPrinter spooler logs
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A BEC email contains an attachment named 'Invoice_2023.docm'. The investigator needs to determine if the attachment is malicious. What is the safest method?

   • ARename the file extension to .txt and open it.
   • BOpen the attachment on the investigator's workstation to check for macros.
   • CForward the attachment to the user to verify if it is expected.
   • DOpen the attachment in a sandbox environment to observe its behavior.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common social engineering cue found in the content of a BEC email?

   • AA request for a routine status update
   • BA polite greeting and professional tone
   • CA clear subject line that matches the content
   • DA sense of urgency, such as 'Immediate action required' or 'Time-sensitive request'
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After completing a BEC investigation, you must compile a report for both the company's executives and law enforcement. What is the best approach for structuring the report?

   • AProvide only the final conclusion and the amount of money lost.
   • BWrite a single technical report with all details, assuming both audiences will read it fully.
   • CInclude an executive summary for management and a detailed technical appendix with evidence and methodology for law enforcement.
   • DCreate a verbal presentation for executives and a written report for law enforcement.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A user reports a suspicious email that appears to come from the CEO. The email asks for an urgent wire transfer. The investigator checks the email headers and notices that the 'Return-Path' and 'Received' fields show a domain that is not the company's domain. What should the investigator do next to confirm the email is spoofed?

   • ACheck the email's content for spelling and grammar errors.
   • BSearch the company's financial records for any recent wire transfers.
   • CPerform a DNS lookup on the sender's domain to check for SPF, DKIM, and DMARC records.
   • DReply to the email to ask the sender to verify their identity.
   Reveal Solution Discussion Select an answer first