CFE-INVESTIGATION Online Practice Questions and Answers

If your suspect is investing alleged illicit funds in items that will increase their net worth and you need to prove their illicit income circumstantially. which of the following methods of tracing assets would yield the best result?

A. The income method

B. The application of funds method

C. The expenditures method

D. The asset method

Why do fraud examiners perform analysis on unstructured or textual data?

A. To categorize data to reveal patterns sentiments and relationships indicative of fraud

B. To find an admission of fraud in an email or other communication that can be presented m court

C. To figure out whether someone is tying or telling the truth based on context dues

D. To determine whether the footnotes to the financial statements are fatly presented

Which of the following is the MOST ACCURATE statement about imaging suspect computers hard drives?

A. Imaging allows for the analysis of data from a suspect computer without altering or damaging the original data in any way

B. Imaging creates pictures of the suspect computer system and its wires and cables

C. Imaging prohibits access to the suspect computer s hard drive by individuals not professionally trained in forensic analysis

D. Imaging enables the retrieval of data from the suspect computer directly via its operating system.

Which of the following sets of numbers could a fraud examiner most likely benefit from running a Benford's Law analysis on?

A. Employee identification numbers

B. Telephone numbers

C. Vendor invoice amounts

D. Bank account numbers

Martin is a fraud examiner. He contacts Dianne for the purpose of conducting a routine information-gathering interview Dianne says that she wants her coworker, Sheila, whom Martin also plans to Interview to be present during fie interview Martin should:

A. Interview Dianne and Sheila separately

B. Allow Sheila to be present but only if she does not speak

C. Interview Dianne and Shell together by himself

D. Interview Dianne and Sheila together but bring in a second interviewer.

Beta, a Certified Fraud Examiner (CFE) is conducting an admission-seeking interview of Delta, a fraud

suspect. In establishing a rationalization, Beta said to Delta 'I know you didn't do this for yourself; It was for

your family. "

This technique seeks to establish rationalization by:

A. Establishing that Delta's family was being treated unfairly

B. Reducing Deltas perception of the legal seriousness of the matter

C. Reducing Deltas stress about possibly being fired

D. Claiming Delta s action was for altruistic reasons

Which of the following is NOT a step a fraud examiner must take before seizing evidence in a digital forensic investigation?

A. Obtain and become familiar with any applicable legal orders.

B. Determine whether there ate privacy issues related to the items(s) to be searched.

C. Ensure that any software used in a forensic capacity is legitimate.

D. Assemble an investigation team comprised only of outside digital forensic experts.

Barnes a Certified Fraud Examiner (CFE) is using data analysis to identity anomalies that might indicate

fraud In XYZ Company's accounts payable transactions.

Which of the following is the most effective data analysis function that Barnes could use to look for

potential fraud in accounts payable?

A. Identify paycheck amounts over a certain limit

B. Review recurring monthly expenses and compare to posted/paid invoices

C. Compare book and tax deprecation and indicate variances

D. Al of the above

When planning for the interview phase of an Investigation, which of the following steps should NOT be taken by the fraud examiner?

A. Review the case Be to ensure that they have not overlooked Important information

B. Consider what the interview is intended to accomplish and state an objective.

C. Prepare a brief outline of key points to discuss during the interview

D. Ensure that the Interview is held in venue where the subject will feel uncomfortable

Which of the following is the LEAST accurate statement about seeing a computer for examination?

A. When taking a computer for examination it the computer is off should remain off when It is removed.

B. When seizing a computer that is running, it is acceptable to review the files contained on the machine prior to seizing it.

C. When seizing a computer for examination the seizing party should look around the area for passwords because many people leave passwords near their computers.

D. Before removing a computer system from a scene for further analysis. It is important to document, the system's setup with photographs or diagrams

Lisa a fraud examinee at a private company receives an anonymous call from a potential whistIeblower. The whistleblower s hesitant to reveal their identity but will do so if it can be kept fully confidential Which of the following statements is most accurate?

A. Lisa should explain that she will try her best to keep the whisneblower's identity confidential

B. Lisa should state that she will not be able to keep the whistleblower s identity confidential because all information must be disclosed to management

C. Lisa may offer the whistleblower full confidentially because they are not a suspect.

D. Lisa may promise the whistieblower full confidentiality even if she knows net statement is untrue, because the lie is ultimately beneficial to her employer.

Which of the following is TRUE about observing the reactions of interview subjects?

A. Emotive words should be used early in the interview to observe the respondent s emotional reaction.

B. The interpretation of an interview subjects reactions requires specific skills on the part of the interviewer

C. The observation of body language is much less important than observing the words used by the subject

D. To effectively observe reactions an Interviewer should alternate between sensitive and nonsensitive questions early in the Interview

A. Prepaying a home mortgage

B. Transferring assets into another person's name

C. Purchasing a used vehicle

D. Purchasing a life Insurance policy

Verify supporting documentation on outstanding checks written for a material amount is a test used to conduct for:

A. Check disbursement

B. Bank confirmation

C. Bank confirmation

D. Cut-off statements

Which of the following is TRUE of a follow-up/recommendations section in a written fraud examination report?

A. A follow-up/recommendations section calculates the amount of fraud-related loss sustained by the organization

B. A follow-up/recommendations section is a required part of every written fraud examination report

C. A follow-up/recommendations section should stale remedial measures for me organization !o undertake

D. All of the above