Business Email Compromise (BEC) Investigations DFE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company has experienced a BEC attack where the attacker impersonated a vendor and requested a change in payment details. The finance team updated the vendor's bank account information and made a payment. What phase of the BEC attack does this represent?

   • AThe reporting phase, where the incident is documented.
   • BThe phishing phase, where the attacker sends the initial email.
   • CThe reconnaissance phase, where the attacker gathers information.
   • DThe fraudulent transfer phase, where the attacker receives the funds.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following should be included in a BEC investigation report to support legal proceedings?

   • AThe suspect's social media passwords
   • BA detailed timeline of events, including email timestamps and transaction dates
   • CA list of all software installed on the victim's computer
   • DThe personal opinions of the investigator
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An investigator is analyzing a suspicious email header. The 'Received' fields show multiple hops, and the last 'Received' field shows an IP address that is different from the sender's domain's MX server. What does this indicate?

   • AThe email was sent from the same server as the domain's MX server.
   • BThe email was sent from a mobile device.
   • CThe email is definitely legitimate because it went through multiple servers.
   • DThe email may have been relayed through an intermediary server, possibly indicating spoofing.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   During a BEC investigation, you need to identify all relevant evidence sources. The attack involved a spoofed email, a fraudulent wire transfer, and a compromised internal account. Which evidence source would provide the most comprehensive view of the attack timeline?

   • AMail server logs combined with financial transaction logs and authentication logs.
   • BEmail headers only, to trace the origin of the spoofed email.
   • CFinancial transaction logs only, to trace the fraudulent transfer.
   • DAuthentication logs only, to see the compromised account activity.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A BEC email contains a URL that appears to be 'https://company-payments.com/transfer'. The investigator wants to determine if the URL is malicious without clicking it. What should the investigator do?

   • AOpen the URL in a browser to see where it leads.
   • BPerform a WHOIS lookup on the domain and check its reputation using a URL scanner.
   • CCheck the URL's SSL certificate by visiting the site.
   • DCopy the URL into an email and send it to the user to verify.
   Reveal Solution Discussion Select an answer first