Email Crime Investigation DFE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When tracing an email back to its source, which piece of information is typically used to identify the sender's approximate location?

   • AThe IP address found in the 'Received' headers
   • BThe sender's display name
   • CThe email's subject line
   • DThe email's attachment size
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An email investigator is analyzing a suspicious email and wants to determine the exact path the email took from the sender to the recipient. Which header field(s) should be examined?

   • AThe 'Subject' and 'Date' headers, which show the message content and timestamp.
   • BThe 'Received' headers, which list each mail server that handled the message in chronological order.
   • CThe 'MIME-Version' header, which indicates the message format.
   • DThe 'To' and 'From' headers, which show the sender and recipient addresses.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which type of tool is specifically designed to recover deleted emails from an email client's local database?

   • APassword cracking tools
   • BEmail forensic analysis tools
   • CDisk defragmentation utilities
   • DNetwork packet analyzers
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   You are a forensic investigator working on a case that involves emails between employees in different countries. The data is stored on a server in the EU. What is a key legal consideration?

   • AYou need a warrant from the country where the suspect lives.
   • BYou must comply with GDPR and other applicable privacy laws when handling the emails.
   • CYou can ignore privacy laws because it is a corporate investigation.
   • DYou must delete all emails after the investigation to comply with GDPR.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has received multiple complaints about phishing emails that appear to come from their own domain. The emails contain malicious links. What is the first step in investigating this email crime?

   • ACollect all phishing emails and preserve them as evidence.
   • BSend a warning email to all employees.
   • CDelete the phishing emails to prevent further spread.
   • DImmediately block the sender's IP address.
   Reveal Solution Discussion Select an answer first