CITP EXAM 3 ACTUAL EXAM
CRIMINAL INVESTIGATOR TRAINING PROGRAM (CITP)
250 Verified Questions & Answers WithRationales
A+ GRADED
This study document brings together 250 carefully worded exam questions drawn
from CITP Exam 3 Actual Exam - Criminal Investigator Training Program (CITP) -
2026/2027 Academic Year - Verified Questions and Answers, with the strongest
emphasis placed on Apply constitutional and statutory law to investigative
scenarios, Evaluate and integrate forensic and digital evidence in complex cases,
Demonstrate proficiency in evidence collection, chain of custody and courtroom
testimony.
Every item follows the wording style and level of reasoning you meet in the real
paper, and each one is paired with a clear rationale so the correct choice is
never a guess. Work through the set at your own pace, mark the questions that
slow you down, then come back to them until the reasoning feels automatic.
Learners who revise this way walk into the exam room recognizing the pattern
behind the questions instead of meeting them for the first time. Keep going -
steady, honest practice is what turns a difficult paper into a comfortable pass.
DOMAINS AND CONTENT AREAS
Domain | Weight |
1. Apply Constitutional and Statutory Law to Investigative Scenarios | 25% |
2. Evaluate and Integrate Forensic and Digital Evidence | 25% |
3. Evidence Collection and Chain of Custody | 20% |
4. Courtroom Testimony and Legal Procedures | 15% |
5. Investigative Techniques and Case Management | 15% |
SECTION 1: APPLY CONSTITUTIONAL AND STATUTORY LAW TO INVESTIGATIVE
SCENARIOS
Q1. During a Title III wiretap, a suspect makes a call to an attorney. The investigator, who
is monitoring, hears the call and learns the attorney is advising the suspect to dispose of
evidence. Under current federal law, which action is most appropriate?
,A. Immediately arrest the suspect and attorney for obstruction of justice.
B. Minimize the call and seek a court order to use the evidence.
C. Include the call in the wiretap affidavit as a probable cause enhancement.
D. Disregard the call entirely because attorney-client privilege is absolute.
Correct Answer: B
Rationale: Under federal wiretap law, privileged communications must be minimized unless
a court authorizes their interception. Even when privilege may not apply (crime-fraud
exception), the investigator cannot use the evidence without judicial approval.
Q2. A forensic examiner receives a digital device that is encrypted with BitLocker. The
suspect provides a password under a court order, but the examiner discovers a hidden
volume protected by a different key. Which legal principle is most directly implicated in
compelling the suspect to provide the second password?
A. The Fifth Amendment self-incrimination clause, as testimony is compelled.
B. The Fourth Amendment search incident to arrest exception.
C. The foregone conclusion doctrine, which may waive Fifth Amendment protection.
D. The plain view doctrine, as the device is lawfully seized.
Correct Answer: C
Rationale: The foregone conclusion doctrine allows compelled decryption when the
government already knows the existence and location of the data, making the act of
production non-testimonial.
Q3. In a homicide investigation, a bloodstain pattern indicates a high-velocity impact
spatter. The suspect claims the victim was shot from a distance of less than two feet. Which
additional analysis would most effectively challenge this claim?
A. Determining the angle of impact using the width-to-length ratio of the spatters.
B. Analyzing the distribution of backspatter on the suspect's clothing.
C. Conducting a luminol test to identify latent bloodstains.
D. Measuring the diameter of the impact sites to estimate the force used.
Correct Answer: B
,Rationale: High-velocity impact spatter is typically associated with gunshots, but
backspatter on the shooter's clothing can indicate firing distance and position. Backspatter
analysis directly tests the proximity claim.
Q4. An investigator is preparing to testify about a forensic analysis conducted by a
colleague who is unavailable. The analysis is based on a novel scientific technique that has
not been widely accepted. Under Daubert, which factor is most critical for the court to
consider?
A. Whether the technique has been subjected to peer review and publication.
B. Whether the colleague is a certified expert in the field.
C. Whether the evidence was collected under a valid search warrant.
D. Whether the investigator personally observed the analysis.
Correct Answer: A
Rationale: Daubert emphasizes testability, peer review, error rates, and general
acceptance. Peer review and publication are central to establishing scientific reliability.
Q5. In a financial fraud investigation, the investigator obtains bank records showing a
series of international wire transfers. To trace the funds effectively, which analytical
method is most appropriate?
A. Link analysis to map relationships between accounts and individuals.
B. Time-series analysis to identify seasonal spending patterns.
C. Network analysis solely focusing on communication metadata.
D. Benford's Law to detect anomalies in the transaction amounts.
Correct Answer: A
Rationale: Link analysis is designed to visualize relationships and flow of funds between
entities, making it ideal for tracing wire transfers.
Q6. An investigator is executing a search warrant at a residence. During the search, the
investigator observes contraband in plain view in a room not specified in the warrant.
Under the plain view doctrine, which condition must be met to seize the item?
A. The investigator must have probable cause to believe the item is contraband.
B. The investigator must obtain a separate warrant for the item.
, C. The investigator must wait for the suspect to return before seizing it.
D. The investigator must document the item and leave it in place.
Correct Answer: A
Rationale: Under the plain view doctrine, the officer must have probable cause to believe
the item is contraband and must be lawfully in the location.
Q7. During an interrogation, a suspect invokes their right to counsel. Which action is
permissible under Miranda?
A. Continue questioning about unrelated offenses.
B. Stop all questioning until counsel is provided.
C. Question the suspect with a different detective.
D. Use a polygraph to obtain a confession.
Correct Answer: B
Rationale: Once a suspect invokes the right to counsel, all questioning must cease until
counsel is present.
Q8. An investigator obtains a warrant to search a suspect's cell phone for evidence of
drug trafficking. During the search, the investigator discovers evidence of a separate
murder. Under what doctrine may this evidence be admissible?
A. Plain view doctrine
B. Inevitable discovery
C. Good faith exception
D. Search incident to arrest
Correct Answer: A
Rationale: The plain view doctrine allows seizure of evidence of a different crime if the
officer is lawfully searching and the evidence is immediately apparent.
Q9. A suspect is arrested and informed of their Miranda rights. The suspect states, "I think
I should talk to a lawyer." The investigator continues questioning and obtains a confession.
Under current law, the confession is:
CRIMINAL INVESTIGATOR TRAINING PROGRAM (CITP)
250 Verified Questions & Answers WithRationales
A+ GRADED
This study document brings together 250 carefully worded exam questions drawn
from CITP Exam 3 Actual Exam - Criminal Investigator Training Program (CITP) -
2026/2027 Academic Year - Verified Questions and Answers, with the strongest
emphasis placed on Apply constitutional and statutory law to investigative
scenarios, Evaluate and integrate forensic and digital evidence in complex cases,
Demonstrate proficiency in evidence collection, chain of custody and courtroom
testimony.
Every item follows the wording style and level of reasoning you meet in the real
paper, and each one is paired with a clear rationale so the correct choice is
never a guess. Work through the set at your own pace, mark the questions that
slow you down, then come back to them until the reasoning feels automatic.
Learners who revise this way walk into the exam room recognizing the pattern
behind the questions instead of meeting them for the first time. Keep going -
steady, honest practice is what turns a difficult paper into a comfortable pass.
DOMAINS AND CONTENT AREAS
Domain | Weight |
1. Apply Constitutional and Statutory Law to Investigative Scenarios | 25% |
2. Evaluate and Integrate Forensic and Digital Evidence | 25% |
3. Evidence Collection and Chain of Custody | 20% |
4. Courtroom Testimony and Legal Procedures | 15% |
5. Investigative Techniques and Case Management | 15% |
SECTION 1: APPLY CONSTITUTIONAL AND STATUTORY LAW TO INVESTIGATIVE
SCENARIOS
Q1. During a Title III wiretap, a suspect makes a call to an attorney. The investigator, who
is monitoring, hears the call and learns the attorney is advising the suspect to dispose of
evidence. Under current federal law, which action is most appropriate?
,A. Immediately arrest the suspect and attorney for obstruction of justice.
B. Minimize the call and seek a court order to use the evidence.
C. Include the call in the wiretap affidavit as a probable cause enhancement.
D. Disregard the call entirely because attorney-client privilege is absolute.
Correct Answer: B
Rationale: Under federal wiretap law, privileged communications must be minimized unless
a court authorizes their interception. Even when privilege may not apply (crime-fraud
exception), the investigator cannot use the evidence without judicial approval.
Q2. A forensic examiner receives a digital device that is encrypted with BitLocker. The
suspect provides a password under a court order, but the examiner discovers a hidden
volume protected by a different key. Which legal principle is most directly implicated in
compelling the suspect to provide the second password?
A. The Fifth Amendment self-incrimination clause, as testimony is compelled.
B. The Fourth Amendment search incident to arrest exception.
C. The foregone conclusion doctrine, which may waive Fifth Amendment protection.
D. The plain view doctrine, as the device is lawfully seized.
Correct Answer: C
Rationale: The foregone conclusion doctrine allows compelled decryption when the
government already knows the existence and location of the data, making the act of
production non-testimonial.
Q3. In a homicide investigation, a bloodstain pattern indicates a high-velocity impact
spatter. The suspect claims the victim was shot from a distance of less than two feet. Which
additional analysis would most effectively challenge this claim?
A. Determining the angle of impact using the width-to-length ratio of the spatters.
B. Analyzing the distribution of backspatter on the suspect's clothing.
C. Conducting a luminol test to identify latent bloodstains.
D. Measuring the diameter of the impact sites to estimate the force used.
Correct Answer: B
,Rationale: High-velocity impact spatter is typically associated with gunshots, but
backspatter on the shooter's clothing can indicate firing distance and position. Backspatter
analysis directly tests the proximity claim.
Q4. An investigator is preparing to testify about a forensic analysis conducted by a
colleague who is unavailable. The analysis is based on a novel scientific technique that has
not been widely accepted. Under Daubert, which factor is most critical for the court to
consider?
A. Whether the technique has been subjected to peer review and publication.
B. Whether the colleague is a certified expert in the field.
C. Whether the evidence was collected under a valid search warrant.
D. Whether the investigator personally observed the analysis.
Correct Answer: A
Rationale: Daubert emphasizes testability, peer review, error rates, and general
acceptance. Peer review and publication are central to establishing scientific reliability.
Q5. In a financial fraud investigation, the investigator obtains bank records showing a
series of international wire transfers. To trace the funds effectively, which analytical
method is most appropriate?
A. Link analysis to map relationships between accounts and individuals.
B. Time-series analysis to identify seasonal spending patterns.
C. Network analysis solely focusing on communication metadata.
D. Benford's Law to detect anomalies in the transaction amounts.
Correct Answer: A
Rationale: Link analysis is designed to visualize relationships and flow of funds between
entities, making it ideal for tracing wire transfers.
Q6. An investigator is executing a search warrant at a residence. During the search, the
investigator observes contraband in plain view in a room not specified in the warrant.
Under the plain view doctrine, which condition must be met to seize the item?
A. The investigator must have probable cause to believe the item is contraband.
B. The investigator must obtain a separate warrant for the item.
, C. The investigator must wait for the suspect to return before seizing it.
D. The investigator must document the item and leave it in place.
Correct Answer: A
Rationale: Under the plain view doctrine, the officer must have probable cause to believe
the item is contraband and must be lawfully in the location.
Q7. During an interrogation, a suspect invokes their right to counsel. Which action is
permissible under Miranda?
A. Continue questioning about unrelated offenses.
B. Stop all questioning until counsel is provided.
C. Question the suspect with a different detective.
D. Use a polygraph to obtain a confession.
Correct Answer: B
Rationale: Once a suspect invokes the right to counsel, all questioning must cease until
counsel is present.
Q8. An investigator obtains a warrant to search a suspect's cell phone for evidence of
drug trafficking. During the search, the investigator discovers evidence of a separate
murder. Under what doctrine may this evidence be admissible?
A. Plain view doctrine
B. Inevitable discovery
C. Good faith exception
D. Search incident to arrest
Correct Answer: A
Rationale: The plain view doctrine allows seizure of evidence of a different crime if the
officer is lawfully searching and the evidence is immediately apparent.
Q9. A suspect is arrested and informed of their Miranda rights. The suspect states, "I think
I should talk to a lawyer." The investigator continues questioning and obtains a confession.
Under current law, the confession is:
