Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the first step in preserving digital evidence in a BEC investigation?

   • ACreate a forensic image of the relevant storage media
   • BNotify law enforcement
   • CAnalyze the email headers
   • DInterview the victim
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a common indicator of email spoofing in a BEC email?

   • AThe email was sent during business hours
   • BThe email has a professional signature
   • CThe 'From' address is similar to a legitimate one but with a slight variation, such as 'john.doe@company.com' vs 'john.doe@cornpany.com'
   • DThe email contains a large attachment
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A BEC investigation reveals that a fraudulent wire transfer was initiated 10 minutes after a spoofed email was received. The email was sent from an IP address in a foreign country, but the wire transfer was initiated from an internal IP address. What is the most likely explanation?

   • AThe wire transfer was initiated by a different employee who was also fooled by the email.
   • BThe email was sent from a VPN, and the transfer was initiated from the same VPN.
   • CThe attacker used a compromised internal account to initiate the transfer after sending the email from a remote location.
   • DThe email was forwarded internally, and the transfer was initiated by the recipient.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which financial record is most useful for tracing a fraudulent wire transfer in a BEC investigation?

   • APayroll records
   • BCredit card statements
   • CInventory management logs
   • DSWIFT transaction logs
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following sequences best represents the typical phases of a BEC attack?

   • AReconnaissance, phishing, fraudulent request, and fund transfer
   • BExploitation, privilege escalation, lateral movement, and data exfiltration
   • CScanning, enumeration, exploitation, and cleanup
   • DDelivery, exploitation, installation, and command-and-control
   Reveal Solution Discussion Select an answer first