A Russian woman who married Enrique Marquez Jr., the man accused of buying rifles used in the Dec. 2 attack, entered the U.S. six years ago on a three-month educational-exchange visa, known as a J-1 visa. After the visa expired she remained for several years in the U.S. without legal status, according to law-enforcement officials.

Mr. Marquez has been charged with entering into a sham marriage with Mariya Chernykh to enable her to apply for permanent residency in the U.S. Mr. Marquez also is charged with conspiring to support terrorism.

Ms. Chernykh isn’t suspected of involvement in the attack, according to law-enforcement officials. But her case highlights the challenge of deterring and identifying people who enter the country legally under a visa but fail to leave by the stipulated date.

“The J-1 category is a huge, catchall category for all sorts of purposes, and it’s relatively easy for people to use,” said immigration scholar Margaret Stock. “Some J-1s come here, they love America and they hear the misinformation that nothing is going to happen if they overstay.“