Investigating Email Crimes ECSS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are tracing a phishing email. The Received headers show the message passed through three servers. The last Received header (bottom) shows an IP address 203.0.113.9. You want to identify the actual sender. What is the most reliable method?

   • ACheck the Message-ID header for the sender's IP address.
   • BPerform a reverse DNS lookup on the domain in the Return-Path.
   • CUse the From header to identify the sender's email address.
   • DContact the ISP that owns 203.0.113.9 and request connection logs for the timestamp in the Received header.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an email crime investigation, you find an attachment named 'invoice.pdf' in a suspect's Sent Items folder. The file's hash matches a known malware sample. What is the most appropriate next step?

   • AQuarantine the entire email server to prevent spread.
   • BDelete the attachment from the email to prevent further infection.
   • CRun the attachment on a separate machine to confirm it is malware.
   • DDocument the hash, the file path, and the email metadata, then preserve the original file.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An investigator is preparing a report for a case involving fraudulent emails. The report must be admissible in court. Which element is MOST critical to include?

   • AA list of all software used to view the emails.
   • BA detailed chain of custody log showing who handled the evidence and when.
   • CThe suspect's IP address and internet service provider.
   • DA summary of the email content and the investigator's opinion of guilt.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   During an email crime investigation, you find an email with an attachment that contains a hidden macro. You need to analyze the attachment without compromising the evidence. Select all that apply.

   • ACompute the hash of the original attachment and record it.
   • BDelete the attachment after analysis to prevent infection.
   • CDocument the file path, metadata, and the email's Message-ID.
   • DOpen the attachment directly in a word processor to see the macro.
   • EMake a copy of the attachment and analyze the copy in a sandbox.
   Check answers Discussion Select an answer first
6. 5expert · hard

   An investigator is analyzing a suspicious email. The headers show: Received: from mail.attacker.com (mail.attacker.com [192.0.2.1]) by mx.victim.com; Received: from [10.0.0.5] by mail.attacker.com; and the From header is 'ceo@victim.com'. The SPF check for victim.com fails. The investigator wants to trace the true origin. What is the most significant obstacle?

   • AThe originating IP 10.0.0.5 is a private address, so it cannot be traced to a public ISP.
   • BThe SPF failure means the email is untraceable.
   • CThe From header is spoofed, so the email cannot be traced.
   • DThe domain mail.attacker.com is not registered, so the IP cannot be identified.
   Reveal Solution Discussion Select an answer first