Which of the following types of information would LEAST LIKELY be found when searching external sources without the subject’s consent or a legal order?
- A . A witness’s address
- B . Assets owned by a subject
- C . A subject’s employee personnel file
- D . A competitor’s ownership information
Which of the following data analysis functions is used to determine whether company policies are met by employee transactions, such as verifying that traveling employees book their accommodations at approved hotels?
- A . The correlation analysis function
- B . The Join function
- C . The gap testing function
- D . The compliance verification function
Sam needs to obtain the most accurate court records possible in a particular jurisdiction concerning a fraud suspect. The BEST place for Sam to look is a global database that compiles court cases from various jurisdictions
- A . True
- B . False
Orlando is conducting a fraud examination regarding Fast Freight, a large publicly traded corporation, and wants to find the current officers and directors of the company .
Which of the following would be the best source of information for this purpose?
- A . Commercial filings
- B . Real property records
- C . The company’s corporate bylaws
- D . Regulatory securities records
Caroline, a fraud examiner, is conducting an admission-seeking interview with John, an employee suspected of stealing cash .
Which of the following is the MOST effective phrasing for Caroline to use when posing an admission-seeking question to John?
- A . "Why did you take the money?"
- B . "What do you know about the stolen money?"
- C . "Do you know who took the money”"
- D . "Did you steal the money?"
Assuming that a jurisdiction has prohibited pretexting with financial institutes, which of the following actions would constitute illegal pretexting?
- A . Withdrawing another person’s funds using a stolen bank account number and PIN
- B . Digging through a person’s trash to obtain their bank account information
- C . Making purchases with a credit card account under a fictitious identity
- D . Falsely claiming to be the spouse of an account holder to access bank records
Which of the following data is the MOST DIFFICULT to recover during a digital forensic examination?
- A . Time and date information about files
- B . Websites visited
- C . Files that have been overwritten
- D . Communications sent via instant messenger
Which of the following is INCORRECT with regard to locating individuals using online records?
- A . Before engaging in a search the fraud examine’ should know the mod powerful and useful ‘>Des of searches
- B . If an individual has moved, obtaining a past address is usually of no help
- C . Online records are very useful in locating subjects whose whereabouts are unknown
- D . Obtaining a past address of the subject should be the first step in trying to locate a subject using online records.
Which of the following statements is MOST ACCURATE regarding covert operations?
- A . Fraud examiners should conduct coven operations only after attempting conventional methods of evidence-gathering
- B . Mistakes in covert operations generally do not cause damage to their associated investigations
- C . Covert operations rarely prove beneficial to investigations even when planned properly.
- D . Most jurisdictions provide protections for investigators conducting covert operations that shield them from reputational, financial, and legal consequences.
Which of the following sources of information is usually considered to be the MOST IMPORTANT in tracing a subject’s assets?
- A . Credit card statements
- B . PaystuDs
- C . Surveillance footage
- D . Financial institution records
Arnold, a Certified Fraud Examiner (CFE) for Integra Wealth, learns that Elizabeth, an accounts payable clerk, recently purchased an expensive ski boat Arnold also knows that Elizabeth recently purchased a vacation home on a nearby lake Arnold has sufficient predication to:
- A . Notify management of the possibility that Elizabeth has committed fraudulent acts
- B . Search Elizabeth’s mobile phone for evidence of misconduct.
- C . Accuse Elizabeth directly of having committed fraud
- D . Conduct discreet inquiries into Elizabeth’s responsibilities as an accounts payable clerk
Which of the following is the MOST ACCURATE statement regarding the analysis phase in digital forensic investigations?
- A . The analysis phase of digital forensic investigations should not commence unless it is verified that the suspect devices do not contain relevant data.
- B . During the analysis phase, it is best to use a combination of the various forensic tools that can assist h identifying, extracting, and collecting digital evidence
- C . When analyzing data for evidence, fraud examiners should look for exculpatory evidence but not exculpatory evidence
- D . The primary concern when analyzing digital evidence is to protect the collected information from seizure
Which of the following should be done to prepare an organization for a formal fraud investigation?
- A . Inform the subject that they are under investigation.
- B . Issue an organization-wide communication that notifies all employees about the investigation
- C . Notify all managers about the investigation, explaining why it is happening and who is involved.
- D . Prepare the managers of the employees who will be involved in the investigation
When planning for the interview phase of an investigation, which of the following steps should NOT be taken by the fraud examiner?
- A . Consider what the interview is intended to accomplish and state an objective.
- B . Review the case file to ensure that important information has not been overlooked
- C . Prepare a detailed list of questions to ask the subject during the interview.
- D . Ensure that the interview is held in a venue where the subject will feel Uncomfortable
Eugene is conducting an admission-seeking interview of a suspect. During the interview, the suspect frequently looks away from Eugene while responding to questions. Eugene can safely conclude that the suspect is dishonest due to his failure to maintain eye contact.
- A . True
- B . False
During an interview, Alex asked a fraud suspect if he could retrieve the suspect’s account records from her bank. The suspect said, "yes." but she did not provide consent in writing
Although the suspect orally consented, the suspect’s bank is NOT required to allow Alex to access the suspect’s account records at this point.
- A . True
- B . False
Elizabeth, a Certified Fraud Examiner (CFE), is conducting an admission-seeking interview with Shannon, a fraud suspect. Shannon is seated approximately five feet away from Elizabeth in an empty room. The room has several pictures and posters on the wall, and the door is closed.
According to admission-seeking interview best practices, what change should Elizabeth make to the interview environment to increase the chances of the interview’s success?
- A . Move the interview to a room without pictures or wall hangings to prevent distractions
- B . Open the door so that Shannon feels free to leave at any time
- C . Place a table between her and Shannon to create a psychological barrier
- D . All of the above
Why is it necessary to image a seized computer’s hard drive for forensic analysis?
- A . To prohibit access to the suspect computer’s hard drive by individuals not professionally trained in forensic analysis
- B . To allow for the analysis of data from a suspect computer without altering or damaging the original data in any way
- C . To create pictures of the suspect computer system and its wires and cables
- D . To enable the retrieval of data from the suspect computer directly via its operating system
A fraud examiner believes that a suspect might have used illicit funds to construct a commercial building to fit a restaurant .
Which of the following records would be the MOST helpful in confirming the owner of the building?
- A . Local court records
- B . Commercial filings
- C . Building permit records
- D . Voter registration records
Cynthia is preparing to conduct a covert investigation. Prior to conducting surveillance of her subject, she creates a memorandum outlining the basis for her operation.
Which of the following pieces of information should she include in her memorandum?
- A . The name of the subject she will be observing
- B . Her first impression regarding the subject’s culpability
- C . The identities of any confidential sources to be used in the operation
- D . All of the above
Which of the following statements is MOST ACCURATE regarding how a fraud examiner should prepare for an interview with a subject from a different jurisdiction?
- A . A fraud examiner does not need to research cultural considerations such as personal space and eye contact.
- B . A fraud examiner should find out whether there are limitations on the use of information obtained during an interview
- C . Failing to observe cultural norms is not a concern if the interviewer is from a different country than the interviewee
- D . Consulting with legal counsel is only necessary when an investigation spans multiple junsdictions
Jackson, a digital forensic examiner for a government agency, is conducting a criminal investigation into the alleged embezzlement of funds from the government’s Welfare Department (WD). Ginny. a WD employee, is the prime suspect. Jackson obtains a court order authorizing him to seize Ginny’s personal computer for forensic examination .
Which of the following is the MOST ACCURATE statement?
- A . If Ginny’s computer is running. Jackson should perform a graceful shutdown by turning it off using the normal shutdown process
- B . If Ginny’s computer is off and Jackson needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer’s normal interface.
- C . If Ginny’s computer is off. Jackson should not turn it on unless he plans to use an encryption device that can guarantee that the system’s hard drive will not be accessed during startup.
- D . If Ginny’s computer is running. Jackson may retrieve data from the computer directly via its normal interface if the evidence that he needs exists only in the form of volatile data
Which of the following is the MOST ACCURATE statement about trying to locate a subject using online records?
- A . Most public records services do not maintain a list of past addresses
- B . Obtaining a past address of the subject should be the first step in trying to locate a subject using online records
- C . The first step in locating someone using online records is to obtain a list of past employers
- D . Online records are generally not useful in locating subjects whose address is unknown
The term_____________refers to a process of resolving allegations of fraud from inception to disposition.
- A . Fraud theory
- B . Forensic investigation
- C . Fraud management
- D . Fraud examination
Which of the following can be obtained from a wire transfer record?
- A . The name of the receiving institution’s registered agent
- B . The recipient’s government identification number
- C . The name of the sender or originator
- D . The sending institution’s accreditation type
Which of the following is TRUE of a follow-up/recommendations section in a written fraud examination report?
- A . A follow-up/recommendations section is not a required part of every written fraud examination report
- B . A follow-up/recommendations section calculates the amount of loss caused by any misconduct identified during the investigation
- C . A follow-up/recommendations section must include a list of organizational failings that contnbuted to the fraud
- D . All of the above
Which of the following is a reason why a person or organization might engage a fraud examiner to trace illicit transactions?
- A . A victim of fraud wants to facilitate the recovery of criminal proceeds.
- B . An employer wants to know if an employee is falsifying regulatory reports
- C . An attorney wants to evaluate an expert’s financial report
- D . An entity needs to find hidden relationships in big data that otherwise would not be discovered.
Susan, a Certified Fraud Examiner (CFE). is conducting an ad mission-seeking interview of Beth, a fraud suspect. After Susan gave Beth a suitable rationalization for her conduct. Beth continued her denials, giving various alibis .
Which of the following would be the LEAST EFFECTIVE technique for Susan to use in this situation?
- A . Displaying evidence that specifically contradicts Beth’s alibis
- B . Discussing some of Beth’s prior deceptions
- C . Discussing the testimony of other witnesses
- D . Displaying all the evidence she has against Beth at once
Charles, a fraud examiner, accuses George of fraud during an admission-seeking
interview. George immediately denies the charge How should Charles respond to George’s denial?
- A . Counter the denial by arguing with George until further denials are futile
- B . Use a delaying tactic to interrupt the denial
- C . Remind George he has to tell the truth or face perjury.
- D . Allow George to continue denying the charge.
Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of Lucas, a construction company executive, for alleged bribery of foreign officials Nobles obtains a court order authorizing him to seize Lucas’s personal computer for forensic examination .
Which of the following is the MOST ACCURATE statement?
- A . If Lucas’s computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data
- B . If Lucas’s computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer’s normal interlace.
- C . If Lucas’s computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system’s hard drive will not be accessed during startup.
- D . If Lucas’s computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process
Which of the following BEST describes the data analytics approach known as predictive analytics?
- A . The employment of a learning algorithm that identifies similarities, patterns, or anomalies within a data set on its own, without human involvement
- B . The configuration of a business program to emulate and integrate the actions of a human to execute certain business processes thus increasing efficiency and automating repetitive manual tasks
- C . The use of historical data, along with analyses, statistics, and machine learning components, to build a mathematical model that captures important trends and creates a quantitative forecast
- D . The use of layered artificial neural networks to accommodate more data and more sophisticated algorithms to identify complex patterns
Which of the following types of files is the most difficult to recover during a digital forensic examination?
- A . Overwritten files
- B . Deleted until
- C . Deleted link (shortcut) files
- D . Hidden files
Which of the following situations would MOST LIKELY require access to nonpublic records to develop evidence?
- A . Finding out where a person lives
- B . Reviewing an individual’s personal mobile phone records
- C . Obtaining a company’s business filings
- D . Determining who owns a piece of real estate
Jade, a Certrfied Fraud Examiner (CFE). is conducting an internal investigation in which an employee is suspected of stealing inventory and selling it through a possible shell company called Hidden Finds. LLC. When Jade tries to check Hidden Finds’ website, a message appears that redirects customers to a web address that ends with onion.
To view the website’s content. Jade will need to install a specialized web browser that enables her to access which of the following?
- A . The deep archives
- B . The free web
- C . The dark web
- D . The internet archives
Gunn, a Certified Fraud Examiner (CFE). was hired to trace Kelly’s financial transactions. During his investigation. Gunn obtains records of electronic payments that Kelly made during the past three years .
Which of the following are these records MOST LIKELY to reveal?
- A . If Kelly has been skimming funds
- B . The cities and countries in which Kelly conducts business
- C . The division and distribution of Kelly’s assets
- D . The market value of any real property Kelly owns
Anne used Will as a confidential informant in her investigation Anne listed information provided by Will in her final report, referring to him using his initials. She paid Will in cash and obtained a receipt for the transaction .
Which of Anne’s methods was NOT considered a best practice when using informants?
- A . Referring to Will using his initials
- B . Obtaining a receipt from Will
- C . Using information provided by Will in her report
- D . Using cash to pay Will
Which of the following is a reason why a subject’s credit card records are useful in tracing investigations?
- A . Credit card statements show source of the funds used to pay a credit card bill
- B . Credit card records show the movements and habits of the subject
- C . Credit card records provide insight into the subject’s litigation history
- D . Credit card records contain information about the division and distribution of the subject’s assets
Vishal, a Certified Fraud Examiner (CFE). has just initiated an interview with Steve, a fraud suspect. After a short introduction. Vishal jokes about the fact that he and Steve are wearing the same tie and then proceeds to ask Steve about the previous night’s major sporting event Vishal is attempting to
- A . Establish the interview theme
- B . Condition the witness.
- C . Establish rapport
- D . Exhibit passive listening.
Which of the following is the MOST IMPORTANT question for a fraud examiner to ask before commencing a legal action to recover assets?
- A . "Is there a relevant statute of limitations9"
- B . "Does the suspect already have a criminal record?"
- C . "Is the suspect guilty of the fraudulent act?”
- D . "Are nonlegal recovery methods or remedies available?”
Shane, a Certified Fraud Examiner (CFE). is investigating Larsen. who is active on various social networking sites. Shane wants to search and extract information from Larson’s social media postings so that it can be used in court as evidence.
Which of the following is the MOST ACCURATE statement regarding what Shane should do when conducting a social media investigation of Larsen?
- A . Shane should conduct a forensic shutdown of his computer to preserve the metadata in the social networking sites.
- B . Shane should preserve the information from the social networking sites so that it can be established as authentic if used in court.
- C . Shane should email himself the links of the postings so that he can retrieve them later.
- D . Shane should preserve the information by saving the links of the postings in his ‘bookmarks"
Baker, a Certified Fraud Examiner (CFE). contacts Dierdre for the purpose of conducting a routine, information-gathering interview Dierdre expresses a desire that her coworker.
Matthew, whom Baker also plans to interview, be interviewed at the same time Baker should:
- A . Interview Dierdre and Matthew separately.
- B . Interview Dierdre and Matthew at the same time, but bring in a second interviewer
- C . Interview Dierdre and Matthew at the same time by himself
- D . Allow Matthew to be present as a silent observer.
Which of the following is NOT a step a fraud examiner must take before seizing evidence in a digital forensic investigation?
- A . Obtain and become familiar with any legal orders that apply to the investigation
- B . Assemble an investigation team comprised only of outside digital forensic experts
- C . Ensure that only trained professionals employ any software used in a forensic capacity
- D . Determine whether there are privacy issues related to the item(s) to be searched.
Al needs to know the location of the principal office and the initial shareholders of a company he is investigating .
Which of the following would be the BEST source of this reformation?
- A . The organizational filings with the government of the jurisdiction in which the company is incorporated
- B . The contractual documents regarding real properly owned by the corporation
- C . The utility records in the municipality where the corporation has its principal office
- D . The shareholder data form filed with the World Bank
If your suspect is spending suspected illicit funds on consumables (e.g.. travel and entertainment) and you need to prove their illicit income circumstantially, which of the following methods of tracing assets would yield the BEST result?
- A . expenditures method
- B . The consumables method
- C . The income method
- D . The asset method
Marilyn, a Certified Fraud Examiner (CFE). is reasonably sure that Shelly, her primary suspect, committed the fraud in question Before scheduling an admission-seeking interview with Shelly. Marilyn should be reasonably sure of all of the following EXCEPT:
- A . That all reasonable investigative steps have been taken
- B . That the interview’s time and location can be controlled
- C . That no other person was involved in the fraud in question
- D . That the interview’s subject matter can be controlled
Tara. a Certified Fraud Examiner (CFE). is searching social media sites for evidence in a fraud investigation .
Which of the following is the MOST ACCURATE statement regarding what Tara should do when mining social media sites for evidence of fraud?
- A . Tara should preserve the information by saving the links of the postings as bookmarks in her browser.
- B . Tara should preserve the metadata by printing out the web pages of each of the postings.
- C . Tara should conduct a forensic shutdown of the computer to preserve the metadata m the social networking sites.
- D . Tara should preserve the information from the sites so that it can be established as authentic if used in court.
Andrew wants to use a confidential informant in his investigation. He plans to compensate the informant with cash and obtain a receipt. He also plans to identify his source in a memorandum and his final report using only the informant’s initials .
Which of Andrew’s plans is NOT considered a best practice when using an informant?
- A . Referring to the informant in the memorandum using the informant’s initials
- B . Using information from the informant in his final report
- C . Creating a receipt regarding the cash payment
- D . Compensating the informant with cash
Which of the following is NOT one of the main limitations of conducting a search for public records using online databases?
- A . Online public records searches are limited in the jurisdictions they cover.
- B . Public records database companies are difficult to find.
- C . Online coverage of public records varies widely from jurisdiction to jurisdiction
- D . The timeliness and accuracy of information in online databases must be validated
Which of the following is the MOST ACCURATE statement about the privacy of information shared through social media?
- A . To access any user-posted information on social media sites, fraud examiners must obtain some type of legal order from the jurisdiction in which the user resides.
- B . A fraud examiner cannot be held liable for violating a user’s privacy rights if they hack or break into areas of a social networking site designated as private because all social media information is public.
- C . The Privacy of Social Networks Treaty is a binding international treaty that makes it illegal for law enforcement to seek social media log-in credentials from users.
- D . Hacking or breaking into information on social media sites that is restricted as private could result in liability for fraud examiners due to violation of users’ privacy rights.
Which of the following statements concerning access to nonpublic records is MOST ACCURATE?
- A . Once a criminal case is filed, all records obtained by the government are considered public records
- B . Nonpublic records cannot be obtained by subpoena or legal order in a civil action
- C . In most junsdictions. banks are allowed to turn over a suspect’s account information directly to a fraud victim when there is adequate evidence of wrongdoing.
- D . The government usually will not share nonpublic records with a fraud victim during an investigation into the underlying fraud.
Which of the following is a measure that can help avoid alerting suspected perpetrators who are under investigation?
- A . Terminate the suspected employee.
- B . Notify everyone in the affected department
- C . Delay taking any action.
- D . Inform only those who need to know.
Management at Oak Company has asked Arthur, an internal auditor, to implement a data analysis program to search for warning signs of potential fraud within the company .
Which of the following steps should Arthur conduct first to MOST effectively use data analysis techniques for such an initiative?
- A . Analyze the data.
- B . Cleanse and normalize the data
- C . Build a profile of potential frauds.
- D . Obtain the data.
Which of the following is the MOST ACCURATE statement about how fraud examiners shook! approach fraud examinations?
- A . Fraud examinations should begin with general information that is known, starting at the periphery, and then move to the more specific details.
- B . When conducting fraud examinations, fraud examiners should adhere to the means-and-ends approach
- C . When conducting fraud examinations, fraud examiners should operate under the assumption that the subjects are guilty
- D . In most examinations, fraud examiners should interview those who are more involved in the matters at issue before interviewing those who are less involved.
Due to risks of illicit transactions, most jurisdictions require financial institutions to obtain information about which of the following from an institution with which they have a foreign correspondent relationship?
- A . The institution’s branch addresses
- B . The institution’s licenses or certifications
- C . The institution’s tax statements
- D . The institution’s client loan profiles
Butler, a Certified Fraud Examiner (CFE), needs to obtain a copy of a statement that the chief executive officer (CEO) of Accord Investments, a venture capital firm, posted on the firm’s website sometime last year. Unfortunately, the quote has been removed from the website .
Which of the following resources would be the BEST choice for Butler to consult to find an earlier version of the web page that he needs?
- A . The invisible archives
- B . The free web
- C . The internet archives
- D . The deep web
Which of the following statements is MOST ACCURATE regarding how a fraud examiner should prepare for an interview with a subject from a different jurisdiction?
- A . Failing to observe cultural norms is not a concern if the interviewer is from a different country than the interviewee.
- B . Consulting with legal counsel is only necessary when an investigation spans multiple
- C . A fraud examiner should find out whether the interviewee can insist upon the presence of a legal representative
- D . A fraud examiner does not need to research cultural considerations such as appropriate greetings and eye contact.
Gilbert is preparing to conduct a covert investigation. Before acting, he wants to wnte a memorandum documenting his plan .
Which of the following pieces of information should he include in this memorandum?
- A . The information expected to be gained from the operation
- B . The identities of any confidential sources to be used in the operation
- C . His first impression regarding the subject’s culpability
- D . All of the above
Which of the following would be MOST USEFUL m determining who created a specrfic document file?
- A . Operating system partition
- B . Internet activity data
- C . The system log
- D . The document’s metadata
Which of the following statements about the process of obtaining a verbal confession is TRUE?
- A . The only acceptable approaches to obtaining a verbal confession are chronologically or by transaction
- B . The transition from the accusation to the confession should occur when the accused supplies the first detailed information about the offense.
- C . If the subject lies about an aspect of the offense in the process of confessing, it is best to correct the records immediately before proceeding
- D . Fraudsters tend to overestimate the amount of funds involved in the offense to relieve themselves of the guilt of their dishonest actions.
Assuming that a jurisdiction has prohibited pretexting against financial institutions, which of the following actions would constitute illegal pretexting?
- A . Intentionally making false statements on loan applications
- B . Stealing a person’s mail lo obtain the person’s bank account number
- C . Impersonating an account holder to access their bank records
- D . Setting up a bank account in an assumed name