Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A finance manager received an email that appears to be from the CEO, urgently requesting a wire transfer to a new vendor. The email's Reply-To address is ceo@company.com, but the From header shows ceo@cornpany.com (with an 'rn'). You are asked to determine if this is a spoofed email. Which combination of checks would most definitively confirm the spoofing?

   • AInspect the email's DKIM signature to see if it passes authentication for the company's domain.
   • BCheck the email's subject line for urgency and the presence of a wire transfer request to determine if it is a BEC attempt.
   • CCompare the Received headers for the originating IP and perform a DNS lookup on the sending domain to verify it resolves to the company's mail server.
   • DVerify the Reply-To address matches the CEO's actual email address in the corporate directory.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a BEC investigation, you need to preserve evidence that will be used in a civil lawsuit. The evidence includes emails, mail server logs, and financial transaction records. Which action is most appropriate for preserving this evidence?

   • ACreate a forensic image of the mail server and financial databases, then store the images in a secure location with a documented chain of custody.
   • BPrint all emails and financial records and file them in a physical binder for the legal team.
   • CExport emails to PST files and transaction records to CSV, then store them on a USB drive.
   • DCopy the relevant emails and transaction records to a shared network drive for easy access by the investigation team.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   During a BEC investigation, you need to preserve email evidence from a cloud-based email service (e.g., Microsoft 365). The legal team requires that the evidence be preserved in a way that maintains metadata and is admissible in court. Which approach is most appropriate?

   • ATake a screenshot of the emails and save them as PDF files.
   • BForward the emails to a personal email account for safekeeping.
   • CUse the cloud provider's eDiscovery or litigation hold feature to preserve the mailboxes, then export the data with metadata using a forensic tool.
   • DPrint the emails and store them in a physical file.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After completing a BEC investigation, the investigator must compile a report for stakeholders and law enforcement. What should the report include?

   • AThe investigator's personal opinion on the suspect's guilt.
   • BA list of all employees who received the email.
   • COnly the financial impact and the amount lost.
   • DA clear summary of findings, evidence collected, and recommended actions.
   Reveal Solution Discussion Select an answer first
6. 25application · medium · select all that apply

   Select all that apply. In a BEC investigation, which of the following are relevant digital evidence sources?

   • AFinancial transaction records showing wire transfers.
   • BThe attacker's physical location.
   • CEmail server logs showing message delivery and routing.
   • DThe employee's personal social media posts.
   • EMetadata from the email, such as the Message-ID and timestamps.
   Check answers Discussion Select an answer first