Email Crime Investigation DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has received a complaint about an employee sending harassing emails to a coworker. The IT team is asked to investigate. What is the first step in the email crime investigation process?

   • ADefine the scope and objectives of the investigation, including the types of email crimes alleged.
   • BDelete the emails from the server to prevent further harassment.
   • CImmediately confront the accused employee with the complaint.
   • DAsk the accused employee to explain their actions.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is tracing a suspicious email that was sent to multiple employees. The email headers show a 'Received' chain with several hops, but the originating IP address is a private IP (e.g., 192.168.x.x). What does this indicate, and what should the analyst do next?

   • AThe email is spoofed because private IPs cannot be used in email headers.
   • BThe email was sent from a public cloud service; the analyst should contact the cloud provider.
   • CThe email originated from within the internal network; the analyst should correlate the private IP with internal DHCP logs to identify the sending device.
   • DThe email is legitimate because private IPs are only used by trusted internal servers.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are investigating a harassment complaint involving emails sent from a company account. The mailbox is on a corporate Exchange server. You need to preserve evidence for potential litigation. Which action best preserves the forensic integrity of the email evidence?

   • APrint the emails and store the printouts in a locked cabinet.
   • BForward the emails to your personal account for safekeeping.
   • CCopy the emails to a USB drive and keep it in your desk drawer.
   • DPlace a legal hold on the mailbox and export a PST with metadata, then hash the export.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A user receives an email that appears to be from a colleague, but the email's 'Reply-To' address is different from the colleague's known address. The email asks the user to click a link. What is the most likely explanation?

   • AThe email is likely spoofed, and the Reply-To address is used to direct replies to the attacker.
   • BThe email is a false positive from the spam filter.
   • CThe email is legitimate, and the colleague simply changed their email address.
   • DThe email is a legitimate marketing email from the colleague's company.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization is facing a lawsuit and must preserve email evidence. The IT team is asked to place a legal hold on a specific user's mailbox. The mailbox is hosted in Microsoft 365. What is the most appropriate action to ensure the emails are preserved?

   • AExport the mailbox to a PST file and store it on a network share.
   • BApply a litigation hold to the user's mailbox, which preserves all content including deleted items.
   • CChange the user's password to prevent them from deleting emails.
   • DDisable the user's account to prevent access.
   Reveal Solution Discussion Select an answer first