Certified Fraud Examiner - Investigation v1.0

Page:    1 / 12   
Exam contains 168 questions
Expand All

Which of the following is a unique challenge of cloud forensics that is not encountered in traditional forensic practices?

  • A. Lack of corroborating evidence
  • B. Lack of trust from cloud providers
  • C. Lack of data control
  • D. Lack of relevant data


Answer : C

If the following statements were included in a fraud examination report of a qualified expert, which of them would be IMPROPER?

  • A. “The organization must address the inadequate segregation of accounting duties to prevent such an event from happening again.”
  • B. “When asked a second time about the amount of funds missing, the suspect contradicted their previous testimony.”
  • C. “In light of all the evidence, the suspect is most likely guilty of fraud against the organization.”
  • D. “The evidence shows that between $1 million and $1.5 million in assets were transferred to an offshore account.”


Answer : D

A law enforcement officer receives a reliable tip form an informant that a government employee is soliciting bribes in exchange for awarding contracts to the employee’s agency. To investigate, the officer poses as a potential contractor and contacts the suspect employee about the possibility of getting a contract with the agency. In the course of the conversation, the suspect demands a cash payment for the officer to be considered for upcoming contracts. If the suspect claims entrapment at trial, then which of the following is MOST LIKELY to occur?

  • A. The suspect’s claim will fail because the investigator is a law enforcement agent
  • B. The suspect’s claim will fail because the investigator had adequate predication.
  • C. The suspect’s claim will succeed because the investigator used deceit.
  • D. The suspect’s claim will succeed because the investigator lacked probable cause.


Answer : A

Which of the following is NOT a function of a fraud examination report?

  • A. To convey all the evidence necessary for other parties to thoroughly evaluate the case
  • B. To corroborate previously known facts
  • C. To add credibility to the fraud examiner’s work
  • D. To communicate the fraud examiner’s qualifications for providing opinions about the case


Answer : D

Jackson, a digital forensic examiner for a government agency, is conducting a criminal investigation into the alleged embezzlement of funds from the government’s Welfare Department (WD). Ginny, a WD employee, is the prime suspect. Jackson obtains a court order authorizing him to seize Ginny’s personal computer for forensic examination. Which of the following is the MOST ACCURATE statement?

  • A. If Ginny’s computer is running, Jackson should perform a graceful shutdown by turning it off using the normal shutdown process.
  • B. If Ginny’s computer is off, Jackson should not turn it on unless he plans to use an encryption device that can guarantee that the system’s hard drive will not be accessed during startup.
  • C. If Ginny’s computer is running, Jackson may retrieve data from the computer directly via its normal interface is the evidence that he needs exists only in the form of volatile data.
  • D. If Ginny’s computer is off and Jackson needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer’s normal interface.


Answer : A

Which of the following is the MOST ACCURATE statement about trying to locate a subject using online records?

  • A. Most public records services do not maintain a list of past addresses.
  • B. The first step in locating someone using online records is to obtain a list of past employers.
  • C. Online records are generally not useful in locating subjects whose address is unknown.
  • D. Obtaining a past address of the subject should be the first step in trying to locate a subject using online records.


Answer : D

Which of the following data analysis functions is used to determine whether company policies are met by employee transactions, such as verifying that traveling employees book their accommodations at approved hotels?

  • A. The gap testing function
  • B. The compliance verification function
  • C. The correlation analysis function
  • D. The Join function


Answer : B

Which of the following statements about fraud response plans is FALSE?

  • A. A fraud response plan must be simple to understand and administer.
  • B. A fraud response plan should specify how every fraud examination should be conducted regardless of the type of fraud.
  • C. A fraud response plan outlines the actions an organization will take when suspicious of fraud have arisen.
  • D. A fraud response plan should create an environment to minimize risk and maximize the potential for success.


Answer : C

Which of the following is the LEAST ACCURATE statement about seizing a computer for examination?

  • A. Before removing a computer system from a scene for further analysis, it is important to document the system’s setup with photographs or diagrams.
  • B. When taking a computer for examination, if the computer is off, it should remain off when it is removed.
  • C. When seizing a computer that is running, it is acceptable for a fraud examiner to review the files contained on the machine prior to seizing it.
  • D. When seizing a computer for examination, the seizing party should look around the area for passwords because many people leave passwords near their computers.


Answer : D

Marilyn, a Certified Fraud Examiner (CFE), is reasonably sure that Shelly, her primary suspect, committed the fraud in question. Before scheduling an admission-seeking interview with Shelly, Marilyn should be reasonably sure of all of the following EXCEPT:

  • A. That the interview’s time and location can be controlled
  • B. That the interview’s subject matter can be controlled
  • C. That all reasonable investigative steps have been taken
  • D. That no other person was involved in the fraud in question


Answer : D

Gunn, a Certified Fraud Examiner (CFE), was hired to trace Kelly’s financial transactions. During his investigation, Gunn obtains records of electronic payments that Kelly made during the past three years. Which of the following are these records MOST LIKELY to reveal?

  • A. The market value of any real property Kelly owns
  • B. The cities and countries in which Kelly conducts business
  • C. The division and distribution of Kelly’s assets
  • D. If Kelly has been skimming funds


Answer : D

If an important witness becomes hostile and argumentative during an interview, the interviewer should generally:

  • A. Try to reason with the witness.
  • B. Terminate the interview.
  • C. Avoid reacting to the witness.
  • D. Refute the witness’s arguments.


Answer : A

Leslie, a fraud examiner for ACME Corporation, suspects that a salesperson for another company has defrauded ACME. Leslie wants to obtain a copy of the suspect individual’s credit report and personal data from a third-party information broker. If Leslie works in a jurisdiction that regulates the distribution of personal credit information, she generally can obtain the information if she has the consent of the individual.

  • A. True
  • B. False


Answer : B

Beta, a Certified Fraud Examiner (CFE), is conducting an admission-seeking interview of Delta, a fraud suspect. In establishing a rationalization, Beta says to Delta, “I know you didn’t do this for yourself, it was for your family. “This technique seeks to establish rationalization by:

  • A. Claiming Delta’s action was for altruistic reasons
  • B. Reducing Delta’s perception of the legal seriousness of the matter
  • C. Reducing Delta’s stress about possibly being fired
  • D. Establishing that Delta’s family was being treated unfairly


Answer : A

If you are seizing a computer for forensic analysis, why is it generally necessary to seize any copiers connected to it?

  • A. Most copiers today are nonimpact copiers, meaning that they store copied images indefinitely.
  • B. Most copiers store, process, and transmit data in a cloud environment.
  • C. Many copiers connect via parallel cables, which store and transmit copy job data.
  • D. Many copiers have internal hard drives that might contain information relevant to a fraud examination.


Answer : D

Page:    1 / 12   
Exam contains 168 questions
Expand All

Talk to us!

Have any questions or issues ? Please dont hesitate to contact us

[email protected]

Certlibrary.com is owned by MBS Tech Limited: Room 1905 Nam Wo Hong Building, 148 Wing Lok Street, Sheung Wan, Hong Kong. Company registration number: 2310926
Certlibrary doesn't offer Real Microsoft Exam Questions. Certlibrary Materials do not contain actual questions and answers from Cisco's Certification Exams.
CFA Institute does not endorse, promote or warrant the accuracy or quality of Certlibrary. CFA® and Chartered Financial Analyst® are registered trademarks owned by CFA Institute.
Terms & Conditions | Privacy Policy