CFE-Investigation Practice Exam Questions with Answers Certified Fraud Examiner (CFE) - Investigation Certification

To close the interview positively and maintain goodwill

To assess whether the subject is ready to confess

To confirm the credibility of the witness being interviewed

To reduce testimony to a signed, written statement

True

False

The amount of the transfer in question

The type of money order used to make the transfer

The location of the customs port of entry for the transfer

The recipient's government identification number

Counter the denial by arguing with George until further denials are futile

Use a delaying tactic to interrupt the denial

Remind George he has to tell the truth or face perjury.

Allow George to continue denying the charge.

True

False

Establish the interview theme

Condition the witness.

Establish rapport

Exhibit passive listening.

Lisa may offer the whistleblower full confidentiality because they are not a suspect

Lisa should explain that she will try her best to keep the whistleblower"s identity confidential.

Lisa should state that she will not be able to keep the whistleblower's identity confidential because all information must be disclosed to management

Lisa may promise the whistleblower full confidentiality, even if she knows her statement is untrue, because the lie is ultimately beneficial to her employer.

The configuration of a business program to emulate and Integrate the actions of a human to execute certain business processes, thus increasing efficiency and automating repetitive manual tasks

The use of historical data, along with analyses, statistics, and machine learning components, to build a mathematical model that captures important trends and creates a quantitative forecast

The employment of computer systems to perform human-like tasks such as visual perception and decision-making

The use of layered artificial neural networks to accommodate more data and more sophisticated algorithms to identify complex patterns

Time and date information about files

Websites visited

Files that have been overwritten

Communications sent via instant messenger

The interpretation of an interview subject's reactions requires specific skills on the part of the interviewer.

The observation of a subjects body language is often just as important as the observation of the words used by the subject.

Emotive words should be used early in the interview to observe the respondents emotional reaction.

To effectively observe reactions, an interviewer should move from less sensitive to more sensitive questions as the interview progresses.

When civil litigation has commenced, a party often may obtain a subpoena or legal order for an individual's relevant bank records.

A fraud examiner can request a business's bank records even if the business is not legally obligated to comply.

An audit clause can be designed to allow a party to inspect the books of a business partner or vendor.

During the government's criminal investigation, a fraud examiner not employed by the government has a right to access relevant documents that the government has obtained.

"Has the defendant been previously arrested for allegedly committing a white-collar crime?"

"Does the defendant have sufficient property or money to satisfy a money judgment?"

"Is there a relevant statute of limitations?"

"Is the suspect guilty of the fraudulent act?"

The approximate beginning and end dates of the fraud

A statement from Rachel that her conduct was an accident

A general estimate of the amount of money involved

Rachel's motive for the offense

Shane should conduct a forensic shutdown of his computer to preserve the metadata in the social networking sites.

Shane should preserve the information from the social networking sites so that it can be established as authentic if used in court.

Shane should email himself the links of the postings so that he can retrieve them later.

Shane should preserve the information by saving the links of the postings in his 'bookmarks"

True

False

Stephanie is testing Martin to determine whether he is able to ask consistent questions

Stephanie is trying to make sure she understands the question so that she will not make a misstatement.

Stephanie is delaying the answer so that she has more time to think of what to say.

Stephanie is having trouble recalling the events or details related to Martin's questions.

"Is there a relevant statute of limitations9"

"Does the suspect already have a criminal record?"

"Is the suspect guilty of the fraudulent act?''

"Are nonlegal recovery methods or remedies available?''

That all reasonable investigative steps have been taken

That the interview's time and location can be controlled

That no other person was involved in the fraud in question

That the interview's subject matter can be controlled

Is feeling bored by the interview process

Is being deceptive

Does not know the answers to Steve's questions

Is telling the truth

Documentary evidence

Testimonial evidence

Verbal evidence

Inconclusive evidence

True

False

Convincing DDU that the incident had suffcinet justification

Reducing Delta's perception of the legal seriousness of the matter

Depersonalizing the victim

Developing revenge as a motive

Interview Dianne and Sheila separately

Allow Sheila to be present but only if she does not speak

Interview Dianne and Sheila together by himself

Interview Dianne and Sheila together, but bring in a second interviewer

If Kelly has been skimming funds

The cities and countries in which Kelly conducts business

The division and distribution of Kelly's assets

The market value of any real property Kelly owns

In most examinations, fraud examiners should start interviewing the least involved candidates and proceed toward those who are potentially more involved.

When conducting fraud examinations, fraud examiners should start with specific details and move toward more general information.

When conducting fraud examinations, fraud examiners should adhere to the fraud theory approach.

When conducting fraud examinations, fraud examiners should begin with general information that is known and then move to the more specific details.

When conducting textual analysis, the fraud examiner should come up with a list of fraud keywords to search for.

Textual analytics is used to reveal patterns, sentiments, and relationships indicative of fraud

The purpose of textual analytics is to search for and find an admission of fraud that can be presented in court

Textual analytics provides the ability to uncover warning signs of potentially fraudulent employee behavior

To determine whether the footnotes to the financial statements are fairly presented

To find an admission of fraud m an email or other communication that can be presented in court

To categorize data to reveal patterns, sentiments, and relationships indicative of fraud

To figure out whether someone is lying or telling the truth based on context duet

When taking a computer for examination, if the computer is off. it should remain off when it is removed.

When seizing a computer that is running, it is acceptable for a fraud examiner to review the files contained on the machine prior to seizing it.

Before removing a computer system from a scene for further analysis, it is important to document the system's setup with photographs or diagrams.

When seizing a computer for examination, the seizing party should took around the area for passwords because many people leave passwords near their computers

True

False

True

False

A fraud response plan outlines the actions an organization will take when suspicions of fraud have arisen.

A fraud response plan should create an environment to minimize risk and maximize the potential for success

A fraud response plan must be simple to understand and administer

A fraud response plan should specify how every fraud examination should be conducted regardless of the type of fraud

Employee identification numbers

Telephone numbers

A listing of payment amounts

Vendor addresses

The analysis phase of digital forensic investigations should not commence unless it is verified that the suspect devices do not contain relevant data.

During the analysis phase, it is best to use a combination of the various forensic tools that can assist h identifying, extracting, and collecting digital evidence

When analyzing data for evidence, fraud examiners should look for exculpatory evidence but not exculpatory evidence

The primary concern when analyzing digital evidence is to protect the collected information from seizure

A follow-up recommendations section is a required part of every written fraud examination report

A follow-up/recommendations section calculates the amount of fraud-related loss sustained by the organization

A follow-up/recommendations section should state remedial measures for the organization to undertake

All of the above

Notify management of the possibility that Elizabeth has committed fraudulent acts

Search Elizabeth's mobile phone for evidence of misconduct.

Accuse Elizabeth directly of having committed fraud

Conduct discreet inquiries into Elizabeth's responsibilities as an accounts payable clerk

Suspend all employees involved in the investigation pending the investigation's outcome.

Ensure that the investigation is conducted at the direction of, or under the supervision of. a government official

Avoid using email or other electronic means to transmit confidential case information

Implement a blanket policy prohibiting all employees from discussing anything related to employee investigations

Conduct admission-seeking interviews only when time is not a factor.

Ensure that accusations are made under conditions of privacy to avoid potential liability

Minimize empathy while emphasizing the perception of moral wrongdoing

Present a morally acceptable reason for the subject's behavior

Interview Dierdre and Matthew separately.

Interview Dierdre and Matthew at the same time, but bring in a second interviewer

Interview Dierdre and Matthew at the same time by himself

Allow Matthew to be present as a silent observer.

Tracing loan proceeds can reveal previous civil offenses committed by the subject

Tracing loan proceeds can determine if the proceeds were deposited into hidden accounts

Tracing loan proceeds can uncover previously unknown witnesses

Tracing loan proceeds can determine if hidden accounts were used for loan payments.

The details of witness interviews should be reported in a separate memorandum.

The report should discuss only the evidence that substantiates the fraud allegation

All information provided by witnesses, regardless of relevance, should be included in the report.

Technical terms should be included whenever possible to convey professionalism.

Fraud examiners should conduct coven operations only after attempting conventional methods of evidence-gathering

Mistakes in covert operations generally do not cause damage to their associated investigations

Covert operations rarely prove beneficial to investigations even when planned properly.

Most jurisdictions provide protections for investigators conducting covert operations that shield them from reputational, financial, and legal consequences.

Fraud theory

Forensic investigation

Fraud management

Fraud examination

Fraud examinations should begin with general information that is known, starting at the periphery, and then move to the more specific details.

When conducting fraud examinations, fraud examiners should adhere to the means-and-ends approach

When conducting fraud examinations, fraud examiners should operate under the assumption that the subjects are guilty

In most examinations, fraud examiners should interview those who are more involved in the matters at issue before interviewing those who are less involved.

Build a profile of potential frauds.

Monitor the data.

Cleanse and normalize the data.

Identify the relevant data

The document's metadata

Internet activity data

The system tog

Operating system partition

Many copiers connect via parallel cables, which store and transmit copy job data.

Most copiers store, process, and transmit data m a cloud environment

Many copiers have internal hard drives that might contain information relevant to a fraud examination

Most copiers today are nonimpact copiers, meaning that they store copied images indefinitely.