Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You are investigating a BEC email that claims to be from a supplier. The email's domain is 'supplier-corp.com', but the legitimate supplier uses 'suppliercorp.com'. Which verification step would most quickly reveal this discrepancy?

   • APerform a WHOIS lookup on both domains to compare registration dates and registrant information.
   • BExamine the email's Received headers to trace the originating IP address.
   • CCheck the email's SPF record to see if the sending IP is authorized.
   • DReview the email's content for urgency and payment instructions.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a safe method to inspect a URL embedded in a BEC email?

   • ACopy the link and paste it into a browser's address bar
   • BUse a URL scanning service or expand the link to see the full address
   • CClick the link to see where it leads
   • DOpen the link in a new incognito window
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a primary digital evidence source in a BEC investigation?

   • AOperating system registry hives
   • BDNS zone transfer files
   • CEmail server logs and mailbox metadata
   • DFirewall configuration files
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A company discovered a BEC attack where an attacker impersonated the CEO and requested a wire transfer of $50,000 to a new vendor. The finance team executed the transfer. The investigator has access to email logs, the CEO's mailbox, the finance team's mailbox, and the bank's transaction records. The investigator needs to determine the exact timeline of the attack. What is the most effective approach?

   • AAnalyze the CEO's mailbox for any deleted emails.
   • BCheck the bank's website for transaction history.
   • CCorrelate the timestamps from the email logs with the bank transaction records to establish the sequence of events.
   • DInterview the finance team to recall when they received the email.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A BEC email contains a URL that appears to be a shortened link (e.g., bit.ly/xyz). The email claims to be from a bank and asks the recipient to verify their account. What is the most effective way to analyze this link?

   • AClick the link to see where it goes.
   • BExpand the shortened URL using a URL expander service, then analyze the final URL's domain and reputation.
   • CLook at the link's anchor text to determine the destination.
   • DCheck the email's SPF and DKIM records to verify the sender.
   Reveal Solution Discussion Select an answer first