An email with a spoofed sender address has been received. You need to trace the actual originating IP. Which header field is most reliable for this purpose?

The bottommost 'Received' header

A security team is investigating a business email compromise (BEC) attack. The attacker spoofed the CEO's email address and sent a wire transfer request. The email passed SPF and DKIM checks. What is the most likely reason the email passed these checks?

The email was sent from a public Wi-Fi network, which bypasses SPF/DKIM.

The email was sent from a compromised third-party service that is not related to the CEO's domain.

The email was sent from a server that is not authorized by SPF, but DKIM still passed.

The attacker compromised the CEO's actual email account or used a lookalike domain that passes SPF/DKIM.

An organization is investigating a case of internal email harassment. The investigator plans to collect emails from the accused employee's mailbox. Which legal and ethical principle is most important to consider before proceeding?

Notify the accused employee before collecting any emails to maintain transparency.

Collect all emails from the entire company to avoid missing relevant evidence.

Ensure the collection is authorized by appropriate management and complies with applicable privacy laws.

Use the employee's own computer to access their mailbox directly.

A forensic examiner is analyzing a suspect's email database from a desktop client like Microsoft Outlook. The examiner needs to recover emails that were deleted but may still exist in the mailbox. Which file should the examiner prioritize for analysis?

The .eml file, which is a single email message file.

The .msg file, which is a single email message file.

The .ost file, which is a cached copy of the server mailbox.

The .pst file, which stores the user's mailbox data locally and may contain recoverable deleted items.

EC-CouncilDigital Forensics Essentials

Domain 6Objective 3

Email Crime Investigation DFE Practice Questions (Page 1)

Part of the Dark Web and Email Forensics domain, which makes up ~16% of our current practice bank.

44questions here

9free pages

7concepts

Questions 1–5

1application · medium
An email with a spoofed sender address has been received. You need to trace the actual originating IP. Which header field is most reliable for this purpose?
Select an answer first
2expert · hard
A security team is investigating a business email compromise (BEC) attack. The attacker spoofed the CEO's email address and sent a wire transfer request. The email passed SPF and DKIM checks. What is the most likely reason the email passed these checks?
Select an answer first
3application · medium
An organization is investigating a case of internal email harassment. The investigator plans to collect emails from the accused employee's mailbox. Which legal and ethical principle is most important to consider before proceeding?
Select an answer first
4expert · hard
You are investigating a case involving emails stored in a Microsoft Exchange database. The suspect has deleted some emails, and you need to recover them. Which tool is specifically designed to parse Exchange databases and recover deleted items?
Select an answer first
5application · medium
A forensic examiner is analyzing a suspect's email database from a desktop client like Microsoft Outlook. The examiner needs to recover emails that were deleted but may still exist in the mailbox. Which file should the examiner prioritize for analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.