ACFE CFE-Investigation Exam Questions Instant Access

Question 1

Which of the following is a reason why a subject's credit card records and statements can be useful in tracing investigations?

ACredit card records can provide leads to help identify a subjects hidden assets

BCredit card records can show signs that the subject has skimmed funds.

CCredit card statements show the source of the funds used to pay a credit card bill.

DCredit card statements provide insight into the subject's litigation history

Answer : A

According to the Fraud Examiners Manual:

''Credit card records are important in tracing assets... information on credit card charges might provide leads to identifying hidden assets. For example, if a fraud examiner notices that the subject used his credit card to purchase items at a marina, the fraud examiner should investigate further to determine if the subject owns a boat''.

Therefore, A is correct.

Question 2

Jana. the controller of XYZ Company, notices that the company's hotel expenses increased substantially from the prior year She wants to check to see if this increase is reasonable by comparing hotel expenses from both years to the number of days XYZ"s employees traveled. Which of the following data analysis functions would be the MOST USEFUL in helping Jana analyze these two variables?

ACorrelation analysis

BDuplicate testing

CVerifying multiples of a number

DBen ford's Law analysis

Answer : A

The 2014 International Fraud Examiners Manual provides:

''Fraud examiners can use a correlation analysis to determine the relationships between different variables in raw data... For example, there should be a strong correlation between the independent and dependent variables because there is a direct relationship between them. Hotel costs should increase as the number of days travelled increases.''

CFE Prep -- Investigations echoes this:

''Using the correlation analysis function, fraud examiners can determine the relationships between different variables in the raw data. For example... Hotel costs should increase as the number of days travelled increases.''

Thus, the most useful analysis is Correlation analysis.

Question 3

Which of the following types of files is the most difficult to recover during a digital forensic examination?

AOverwritten files

BDeleted until

CDeleted link (shortcut) files

DHidden files

Answer : A

Both the Manual and CFE Prep guides emphasize that deleted files are recoverable until overwritten. Once overwritten, the original data cannot be retrieved:

''Deleted files are recoverable until they are overwritten because data is not erased... until overwritten. So, deleted files that have been overwritten generally are not recoverable.''

Other file types (deleted shortcuts, hidden files, etc.) can often be recovered, but overwritten files are lost permanently.

Question 4

If you are seizing a computer for forensic analysis, why is it generally necessary to seize any copiers connected to it?

AMany copiers connect via parallel cables, which store and transmit copy job data.

BMost copiers store, process, and transmit data m a cloud environment

CMany copiers have internal hard drives that might contain information relevant to a fraud examination

DMost copiers today are nonimpact copiers, meaning that they store copied images indefinitely.

Answer : C

The 2014 International Fraud Examiners Manual and CFE Prep - Investigations explicitly state:

''Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. ... when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.''

Thus, the correct answer is C.

Question 5

A fraud examiner is based m the United States, a non-European Union (EU) country, and is collecting personal information from their company's human resources (HR) files about an employee based in Spain, an EU country Based on these facts, the fraud examiner would need to comply with the EU's General Data Protection Regulation (GDPR) when conducting their internal investigation.

ATrue

BFalse

Answer : A

Explanation with Extracts = The 2014 Fraud Examiners Manual states:

''The EU Data Protection Directive ... regulates the processing, using, and transferring of personal data within the European Union, and it places limits on transmitting personal data to non-EU countries''.

Therefore, a U.S.-based examiner handling HR data of an EU employee must comply with EU GDPR requirements.

Question 6

Which of the following is NOT one of the main limitations of conducting a search for public records using online databases?

AOnline records companies are difficult to find.

BFraud examiners must validate the accuracy of the records obtained online

CThe online record might only be a brief abstract of the original.

DFraud examiners often must search for public records in multiple jurisdictions.

Answer : A

Limitations of online public record searches include:

Need to search multiple jurisdictions.

Records are often only abstracts.

Information must be verified for accuracy.There is no mention that online record vendors are ''difficult to find.'' In fact, many such vendors exist.

Question 7

Which of the following statements about fraud response plans is FALSE?

AA fraud response plan outlines the actions an organization will take when suspicions of fraud have arisen.

BA fraud response plan should create an environment to minimize risk and maximize the potential for success

CA fraud response plan must be simple to understand and administer

DA fraud response plan should specify how every fraud examination should be conducted regardless of the type of fraud

Answer : D

The CFE Prep Guide clarifies:

''A fraud response plan outlines the actions... when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success''.

Thus, statement D is false.

ACFE Certified Fraud Examiner - Investigation CFE-Investigation Exam Questions