Investigating Email Crimes ECSS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is the first step in the investigative process for an email crime?

   • AInterview the suspect
   • BSend a cease-and-desist letter to the sender
   • CPreserve the email and its metadata
   • DAnalyze the email content for malware
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An investigator is examining an email that claims to be from a bank. The email's 'From' header shows the bank's domain, but the 'Received-SPF' header shows 'fail'. The investigator also notices that the 'Authentication-Results' header indicates 'dkim=fail'. What is the most likely conclusion about this email?

   • AThe email is spoofed or forged because it failed SPF and DKIM authentication checks.
   • BThe email is legitimate because it was received from the bank's mail server.
   • CThe email is legitimate because it passed the DMARC alignment check.
   • DThe email is legitimate because the 'From' header matches the bank's domain.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During an email crime investigation, the investigator has a suspect email with an attachment. The investigator needs to extract evidence from the attachment without altering it. Which approach is the most appropriate?

   • AOpen the attachment directly from the email client to view its contents.
   • BConvert the attachment to a PDF and analyze the PDF.
   • CPrint the attachment and analyze the printout.
   • DCopy the attachment to a forensic workstation and analyze a bit-for-bit copy.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   You are tracing a threatening email. The Received headers show the message originated from an IP address that belongs to a public Wi-Fi hotspot. The hotspot does not keep logs. What is the best alternative to identify the sender?

   • AAbandon the investigation because the IP cannot be traced.
   • BLook for other emails from the same IP or similar content that may have been sent from a different location.
   • CSubpoena the hotspot provider for connection logs, even if they say they do not keep logs.
   • DUse the email's Message-ID to search the internet for the sender.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   During email evidence analysis, which of the following is considered metadata that can provide valuable investigative information?

   • AThe email's spelling
   • BThe email's timestamp
   • CThe email's font color
   • DThe email's language
   Reveal Solution Discussion Select an answer first