Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In a BEC investigation, why is it important to correlate email communications with financial transaction records?

   • ATo verify the sender's IP address
   • BTo check the recipient's email client version
   • CTo trace the flow of fraudulent funds and identify the recipient accounts
   • DTo determine the email server's uptime
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common type of Business Email Compromise (BEC) attack?

   • ASQL injection, where an attacker extracts data from the email database
   • BCEO fraud, where an attacker impersonates an executive to request a fraudulent wire transfer
   • CDDoS attack, where an attacker floods the email server with traffic
   • DRansomware deployment, where an attacker encrypts the victim's email server
   Reveal Solution Discussion Select an answer first
4. 33expert · medium

   A company has experienced multiple BEC attempts. In one case, the attacker impersonated a vendor and requested a change in payment details. In another, the attacker impersonated the CEO and requested gift cards. The company wants to improve its defenses. What is the most effective measure to prevent both types of attacks?

   • ABlock all emails from external domains.
   • BTrain employees to recognize phishing emails.
   • CIncrease the email spam filter sensitivity.
   • DImplement a verification process for any change in payment details or unusual requests, such as a second-person approval.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An employee receives an email that appears to be from the company's IT department, asking them to verify their password by clicking a link. The email contains a sense of urgency and threats of account suspension. Which content analysis finding is the strongest indicator of a BEC/phishing attempt?

   • AThe email uses the company's logo and official-sounding language.
   • BThe email was sent during business hours.
   • CThe email has a signature block with the IT director's name and title.
   • DThe email requests the user to click a link that goes to a domain not owned by the company.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which email authentication standard helps detect spoofing by verifying that the sending server is authorized to send emails for the domain?

   • APGP (Pretty Good Privacy)
   • BSPF (Sender Policy Framework)
   • CTLS (Transport Layer Security)
   • DS/MIME (Secure/Multipurpose Internet Mail Extensions)
   Reveal Solution Discussion Select an answer first