CFE- Investigation questions and answers 2025\2026
A+ Grade
System log
- correct answer System logs record events executed on an operating system, including miscellaneous
events and those generated during system startup, like hardware and controller failures. Common types
of system events include starting up and shutting down, configuration updates, and system crashes
Open questions
- correct answer Open questions are those worded in a way that makes it difficult for the respondent to
answer "yes" or "no." Also, the answer to an open question is not dependent on the question. The
typical open question calls for a monologue response, and it can be answered in several different ways.
Why would a fraud examiner perform duplicate testing on data?
- correct answer To identify transactions with matching values in the same field: This technique can
quickly review the file, or several files joined together, to highlight duplicate values of key fields. In many
systems, the key fields should contain only unique values (no duplicate records).
An admission-seeking interview is specifically designed to:
- correct answer Obtain a legal admission of wrongdoing; The admission-seeking interview is designed to
obtain a legal admission of wrongdoing. It also serves various other purposes. For example, it seeks to
clear an innocent person and encourage a culpable person to confess. A culpable individual usually
confesses during the admission-seeking phase of an interview, while an innocent person does not do so
unless threats or coercion are used. Also, the interviewer will seek to obtain a valid confession. And
finally, admission-seeking interviews are designed to convince the confessor to sign a written statement
acknowledging the facts.
Which of the following is LEAST likely to be revealed by analyzing a subject's electronic payment
records?
- correct answer If the subject is skimming employer funds
,Electronic payments (or e-payments) refer to any type of noncash payment that does not involve a
paper check. Electronic payment records can reveal, among other things:
- correct answer Assets the subject has purchased
The locations of the subject's assets (e.g., through the payment of real estate taxes, broker's fees, or
utility payments)
The locations of the subject's residences and businesses (e.g., through analyzing the payments of utility
bills)
Loans the subject has obtained (e.g., through analyzing loan payments)
Payments made to nonexistent employees with direct deposit
The cities and countries in which the subject conducts business (e.g., through analyzing the payments
for carrier services to deliver packages)
Assets ostensibly owned by family members or close associates but effectively controlled, held, or gifted
by the subject
Hotel payments
The true owner of a property (e.g., through analyzing the mortgage payments and payments for home
owner insurance)
Textual analytics
- correct answer is a method of using software to extract usable information from unstructured data.
Which of the following is the most appropriate example of an alternative question?
A. "Did you deliberately plan this, or did it just happen?" CORRECT
B. "Did you, or did you not, commit this crime?"
C. "How else might this situation be explained?" INCORRECT
D. "Will you repay the money now or later?"
- correct answer A. "Did you deliberately plan this, or did it just happen?"
The alternative question forces the accused to make one of two choices, both of which imply guilt. One
alternative provides the accused with a morally acceptable reason for the misdeed; the other portrays
the accused negatively. Regardless of which answer the accused chooses, he is acknowledging guilt.
Which of the following is NOT a purpose of the follow-up/recommendations section of a written fraud
examination report?
,- correct answer To calculate the amount of loss caused by any misconduct identified during the
investigation
Liam, a Certified Fraud Examiner, is attempting to get a fraud suspect to admit guilt. Liam should:
- correct answer 1.)Show the suspect incriminating evidence
2.)Give the suspect an excuse for his behavior
3.) Directly accuse the suspect
Which of the following best describes the primary purpose of the U.S. Right to Financial Privacy Act?
- correct answer To prohibit financial institutions from disclosing financial information about individual
customers to governmental agencies without consent or a judicial order
In admission-seeking interviews, an innocent person often reacts differently to the initial accusation
than a culpable person. Which of the following reactions to the initial accusation is common to an
innocent person?
- correct answer Strong denials--
innocent people sometimes react with genuine shock at being accused. It is not at all unusual for an
innocent person, wrongfully accused, to react with anger. In contrast to the guilty person, the typical
innocent person will strongly deny committing the act or acts in question.
Spencer, a fraud examiner, plans to use a confidential informant. The informant agrees to aid Spencer in
exchange for cash. Spencer prepares a receipt for the transfer of cash to the informant and asks the
informant to sign it, but the informant refuses. What should Spencer do?
- correct answer Refuse to pay the cash without a receipt, even if it means the informant will not aid
Spencer
What is mutual legal assistance (MLA)?
- correct answer . A process by which countries request and provide assistance in law enforcement
matters
In most jurisdictions, criminal conviction records are generally not available to the general public unless
a judicial order has been issued. (T/F)?
- correct answer False; In most jurisdictions, most of the papers filed in civil suits are accessible as public
records; however, criminal and juvenile actions might not be as open to review. In addition, criminal
conviction records are generally available to the public.
, Which of the following situations would the U.S. Privacy Act of 1974 regulate?
- correct answer A federal agency distributing the medical and employment history of various
individuals. The U.S. Privacy Act of 1974 establishes a code of information practices that regulates the
collection, maintenance, consumption, and distribution of personally identifiable information that is
maintained by federal agencies. It restricts information about individuals, both employees and
nonemployees, and it applies to governmental agencies and government contractors running a system
of records on behalf of the government.
Facilitators of communication
- correct answer Facilitators of communication are those social-psychological forces that make
conversations, including interviews, easier to accomplish. These facilitators require a basic
understanding of what motivates people. The facilitators are: fulfilling expectations, recognition,
altruistic appeals, sympathetic understanding, new experience, catharsis, need for meaning, and
extrinsic rewards.
Multi-file processing
- correct answer is a data analysis software function that allows users to relate several files by defining
relationships in collected data, without the use of the join command.
Which of the following is a valid legal defense to allegations of entrapment against a fraud examiner
who is a federal law enforcement officer?
- correct answer The fraud examiner acted with adequate predication.
During the analysis phase in digital forensic investigations, the fraud examiner's primary concern is to
protect the collected information from seizure. (T/F)
- correct answer False-The primary concern when analyzing digital evidence is to maintain the integrity
of the data at all times. Fraud examiners must be especially careful with computer equipment because a
careless investigator might inadvertently alter important evidence
The proper method for developing latent fingerprints that have been absorbed into porous materials,
such as paper, is to dust them with fingerprint powder. (T/F)
- correct answer False, Fraud examiners should never try to develop latent fingerprints that have been
absorbed into paper or other porous materials by dusting with fingerprint powder or any other means.
Such efforts will not only be unsuccessful, but they will prevent additional examinations. Instead, fraud
examiners should preserve evidentiary documents that contain latent fingerprints by placing them into
labeled protective containers, such as sealable, acid-free paper envelopes.
A+ Grade
System log
- correct answer System logs record events executed on an operating system, including miscellaneous
events and those generated during system startup, like hardware and controller failures. Common types
of system events include starting up and shutting down, configuration updates, and system crashes
Open questions
- correct answer Open questions are those worded in a way that makes it difficult for the respondent to
answer "yes" or "no." Also, the answer to an open question is not dependent on the question. The
typical open question calls for a monologue response, and it can be answered in several different ways.
Why would a fraud examiner perform duplicate testing on data?
- correct answer To identify transactions with matching values in the same field: This technique can
quickly review the file, or several files joined together, to highlight duplicate values of key fields. In many
systems, the key fields should contain only unique values (no duplicate records).
An admission-seeking interview is specifically designed to:
- correct answer Obtain a legal admission of wrongdoing; The admission-seeking interview is designed to
obtain a legal admission of wrongdoing. It also serves various other purposes. For example, it seeks to
clear an innocent person and encourage a culpable person to confess. A culpable individual usually
confesses during the admission-seeking phase of an interview, while an innocent person does not do so
unless threats or coercion are used. Also, the interviewer will seek to obtain a valid confession. And
finally, admission-seeking interviews are designed to convince the confessor to sign a written statement
acknowledging the facts.
Which of the following is LEAST likely to be revealed by analyzing a subject's electronic payment
records?
- correct answer If the subject is skimming employer funds
,Electronic payments (or e-payments) refer to any type of noncash payment that does not involve a
paper check. Electronic payment records can reveal, among other things:
- correct answer Assets the subject has purchased
The locations of the subject's assets (e.g., through the payment of real estate taxes, broker's fees, or
utility payments)
The locations of the subject's residences and businesses (e.g., through analyzing the payments of utility
bills)
Loans the subject has obtained (e.g., through analyzing loan payments)
Payments made to nonexistent employees with direct deposit
The cities and countries in which the subject conducts business (e.g., through analyzing the payments
for carrier services to deliver packages)
Assets ostensibly owned by family members or close associates but effectively controlled, held, or gifted
by the subject
Hotel payments
The true owner of a property (e.g., through analyzing the mortgage payments and payments for home
owner insurance)
Textual analytics
- correct answer is a method of using software to extract usable information from unstructured data.
Which of the following is the most appropriate example of an alternative question?
A. "Did you deliberately plan this, or did it just happen?" CORRECT
B. "Did you, or did you not, commit this crime?"
C. "How else might this situation be explained?" INCORRECT
D. "Will you repay the money now or later?"
- correct answer A. "Did you deliberately plan this, or did it just happen?"
The alternative question forces the accused to make one of two choices, both of which imply guilt. One
alternative provides the accused with a morally acceptable reason for the misdeed; the other portrays
the accused negatively. Regardless of which answer the accused chooses, he is acknowledging guilt.
Which of the following is NOT a purpose of the follow-up/recommendations section of a written fraud
examination report?
,- correct answer To calculate the amount of loss caused by any misconduct identified during the
investigation
Liam, a Certified Fraud Examiner, is attempting to get a fraud suspect to admit guilt. Liam should:
- correct answer 1.)Show the suspect incriminating evidence
2.)Give the suspect an excuse for his behavior
3.) Directly accuse the suspect
Which of the following best describes the primary purpose of the U.S. Right to Financial Privacy Act?
- correct answer To prohibit financial institutions from disclosing financial information about individual
customers to governmental agencies without consent or a judicial order
In admission-seeking interviews, an innocent person often reacts differently to the initial accusation
than a culpable person. Which of the following reactions to the initial accusation is common to an
innocent person?
- correct answer Strong denials--
innocent people sometimes react with genuine shock at being accused. It is not at all unusual for an
innocent person, wrongfully accused, to react with anger. In contrast to the guilty person, the typical
innocent person will strongly deny committing the act or acts in question.
Spencer, a fraud examiner, plans to use a confidential informant. The informant agrees to aid Spencer in
exchange for cash. Spencer prepares a receipt for the transfer of cash to the informant and asks the
informant to sign it, but the informant refuses. What should Spencer do?
- correct answer Refuse to pay the cash without a receipt, even if it means the informant will not aid
Spencer
What is mutual legal assistance (MLA)?
- correct answer . A process by which countries request and provide assistance in law enforcement
matters
In most jurisdictions, criminal conviction records are generally not available to the general public unless
a judicial order has been issued. (T/F)?
- correct answer False; In most jurisdictions, most of the papers filed in civil suits are accessible as public
records; however, criminal and juvenile actions might not be as open to review. In addition, criminal
conviction records are generally available to the public.
, Which of the following situations would the U.S. Privacy Act of 1974 regulate?
- correct answer A federal agency distributing the medical and employment history of various
individuals. The U.S. Privacy Act of 1974 establishes a code of information practices that regulates the
collection, maintenance, consumption, and distribution of personally identifiable information that is
maintained by federal agencies. It restricts information about individuals, both employees and
nonemployees, and it applies to governmental agencies and government contractors running a system
of records on behalf of the government.
Facilitators of communication
- correct answer Facilitators of communication are those social-psychological forces that make
conversations, including interviews, easier to accomplish. These facilitators require a basic
understanding of what motivates people. The facilitators are: fulfilling expectations, recognition,
altruistic appeals, sympathetic understanding, new experience, catharsis, need for meaning, and
extrinsic rewards.
Multi-file processing
- correct answer is a data analysis software function that allows users to relate several files by defining
relationships in collected data, without the use of the join command.
Which of the following is a valid legal defense to allegations of entrapment against a fraud examiner
who is a federal law enforcement officer?
- correct answer The fraud examiner acted with adequate predication.
During the analysis phase in digital forensic investigations, the fraud examiner's primary concern is to
protect the collected information from seizure. (T/F)
- correct answer False-The primary concern when analyzing digital evidence is to maintain the integrity
of the data at all times. Fraud examiners must be especially careful with computer equipment because a
careless investigator might inadvertently alter important evidence
The proper method for developing latent fingerprints that have been absorbed into porous materials,
such as paper, is to dust them with fingerprint powder. (T/F)
- correct answer False, Fraud examiners should never try to develop latent fingerprints that have been
absorbed into paper or other porous materials by dusting with fingerprint powder or any other means.
Such efforts will not only be unsuccessful, but they will prevent additional examinations. Instead, fraud
examiners should preserve evidentiary documents that contain latent fingerprints by placing them into
labeled protective containers, such as sealable, acid-free paper envelopes.
