CFE- Investigation Exam Questions And
Answers
System log - ANS System logs record events executed on an operating system, including
miscellaneous events and those generated during system startup, like hardware and controller
failures. Common types of system events include starting up and shutting down, configuration
updates, and system crashes
Open questions - ANS Open questions are those worded in a way that makes it difficult for
the respondent to answer "yes" or "no." Also, the answer to an open question is not dependent
on the question. The typical open question calls for a monologue response, and it can be
answered in several different ways.
Why would a fraud examiner perform duplicate testing on data? - ANS To identify
transactions with matching values in the same field: This technique can quickly review the file,
or several files joined together, to highlight duplicate values of key fields. In many systems, the
key fields should contain only unique values (no duplicate records).
An admission-seeking interview is specifically designed to: - ANS Obtain a legal admission
of wrongdoing; The admission-seeking interview is designed to obtain a legal admission of
wrongdoing. It also serves various other purposes. For example, it seeks to clear an innocent
person and encourage a culpable person to confess. A culpable individual usually confesses
during the admission-seeking phase of an interview, while an innocent person does not do so
unless threats or coercion are used. Also, the interviewer will seek to obtain a valid confession.
And finally, admission-seeking interviews are designed to convince the confessor to sign a
written statement acknowledging the facts.
Which of the following is LEAST likely to be revealed by analyzing a subject's electronic
payment records? - ANS If the subject is skimming employer funds
Electronic payments (or e-payments) refer to any type of noncash payment that does not
involve a paper check. Electronic payment records can reveal, among other things: - ANS
Assets the subject has purchased
The locations of the subject's assets (e.g., through the payment of real estate taxes, broker's
fees, or utility payments)
The locations of the subject's residences and businesses (e.g., through analyzing the payments
of utility bills)
Loans the subject has obtained (e.g., through analyzing loan payments)
Payments made to nonexistent employees with direct deposit
,The cities and countries in which the subject conducts business (e.g., through analyzing the
payments for carrier services to deliver packages)
Assets ostensibly owned by family members or close associates but effectively controlled, held,
or gifted by the subject
Hotel payments
The true owner of a property (e.g., through analyzing the mortgage payments and payments for
home owner insurance)
Textual analytics - ANS is a method of using software to extract usable information from
unstructured data.
Which of the following is the most appropriate example of an alternative question?
A. "Did you deliberately plan this, or did it just happen?" CORRECT
B. "Did you, or did you not, commit this crime?"
C. "How else might this situation be explained?" INCORRECT
D. "Will you repay the money now or later?" - ANS A. "Did you deliberately plan this, or did
it just happen?"
The alternative question forces the accused to make one of two choices, both of which imply
guilt. One alternative provides the accused with a morally acceptable reason for the misdeed;
the other portrays the accused negatively. Regardless of which answer the accused chooses,
he is acknowledging guilt.
Which of the following is NOT a purpose of the follow-up/recommendations section of a written
fraud examination report? - ANS To calculate the amount of loss caused by any
misconduct identified during the investigation
Liam, a Certified Fraud Examiner, is attempting to get a fraud suspect to admit guilt. Liam
should: - ANS 1.)Show the suspect incriminating evidence
2.)Give the suspect an excuse for his behavior
3.) Directly accuse the suspect
Which of the following best describes the primary purpose of the U.S. Right to Financial Privacy
Act? - ANS To prohibit financial institutions from disclosing financial information about
individual customers to governmental agencies without consent or a judicial order
In admission-seeking interviews, an innocent person often reacts differently to the initial
accusation than a culpable person. Which of the following reactions to the initial accusation is
common to an innocent person? - ANS Strong denials--
innocent people sometimes react with genuine shock at being accused. It is not at all unusual
for an innocent person, wrongfully accused, to react with anger. In contrast to the guilty person,
the typical innocent person will strongly deny committing the act or acts in question.
, Spencer, a fraud examiner, plans to use a confidential informant. The informant agrees to aid
Spencer in exchange for cash. Spencer prepares a receipt for the transfer of cash to the
informant and asks the informant to sign it, but the informant refuses. What should Spencer do?
- ANS Refuse to pay the cash without a receipt, even if it means the informant will not aid
Spencer
What is mutual legal assistance (MLA)? - ANS . A process by which countries request and
provide assistance in law enforcement matters
In most jurisdictions, criminal conviction records are generally not available to the general public
unless a judicial order has been issued. (T/F)? - ANS False; In most jurisdictions, most of
the papers filed in civil suits are accessible as public records; however, criminal and juvenile
actions might not be as open to review. In addition, criminal conviction records are generally
available to the public.
Which of the following situations would the U.S. Privacy Act of 1974 regulate? - ANS A
federal agency distributing the medical and employment history of various individuals. The U.S.
Privacy Act of 1974 establishes a code of information practices that regulates the collection,
maintenance, consumption, and distribution of personally identifiable information that is
maintained by federal agencies. It restricts information about individuals, both employees and
nonemployees, and it applies to governmental agencies and government contractors running a
system of records on behalf of the government.
Facilitators of communication - ANS Facilitators of communication are those
social-psychological forces that make conversations, including interviews, easier to accomplish.
These facilitators require a basic understanding of what motivates people. The facilitators are:
fulfilling expectations, recognition, altruistic appeals, sympathetic understanding, new
experience, catharsis, need for meaning, and extrinsic rewards.
Multi-file processing - ANS is a data analysis software function that allows users to relate
several files by defining relationships in collected data, without the use of the join command.
Which of the following is a valid legal defense to allegations of entrapment against a fraud
examiner who is a federal law enforcement officer? - ANS The fraud examiner acted with
adequate predication.
During the analysis phase in digital forensic investigations, the fraud examiner's primary
concern is to protect the collected information from seizure. (T/F) - ANS False-The primary
concern when analyzing digital evidence is to maintain the integrity of the data at all times.
Fraud examiners must be especially careful with computer equipment because a careless
investigator might inadvertently alter important evidence
The proper method for developing latent fingerprints that have been absorbed into porous
materials, such as paper, is to dust them with fingerprint powder. (T/F) - ANS False, Fraud
