Why must an investigator obtain proper legal authorization before accessing a suspect's email account?

To prevent the suspect from deleting emails

To ensure the investigator has the latest software

To comply with privacy laws and ensure evidence is admissible in court

To avoid the cost of using forensic tools

You are investigating a case of internal fraud. The suspect's email account is on a company server. You have been asked to collect evidence. What is the most important legal consideration before you begin?

Ensure you have proper authorization, such as a warrant or company policy consent.

Make a backup of the entire server to avoid missing any data.

Notify the suspect immediately so they can preserve their own emails.

Ask the suspect for their password to access the account.

Which technique is commonly used to forge the sender information in an email?

Modifying the 'From' header to display a false sender address

Using a large font in the email body

Adding multiple recipients to the 'Cc' field

What is a common sign that an email may be spoofed?

The email has a high priority flag

The email was sent during business hours

The 'From' address does not match the 'Return-Path' address

The email contains a large attachment

EC-CouncilDigital Forensics Essentials

Domain 6Objective 3

Email Crime Investigation DFE Practice Questions (Page 9)

Part of the Dark Web and Email Forensics domain, which makes up ~16% of our current practice bank.

44questions here

9free pages

7concepts

Questions 41–44

41foundation · easy
Why must an investigator obtain proper legal authorization before accessing a suspect's email account?
Select an answer first
42application · medium
You are investigating a case of internal fraud. The suspect's email account is on a company server. You have been asked to collect evidence. What is the most important legal consideration before you begin?
Select an answer first
43foundation · easy
Which technique is commonly used to forge the sender information in an email?
Select an answer first
44foundation · easy
What is a common sign that an email may be spoofed?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.