CFE- INVESTIGATION UPDATED
ACTUAL EXAM QUESTIONS AND
CORRECT ANSWERS
z System log - Correct answer.System logs record events executed on an operating system, including
miscellaneous events and those generated during system startup, like hardware and controller failures.
Common types of system events include starting up and shutting down, configuration updates, and
system crashes
Open questions - Correct answer.Open questions are those worded in a way that makes it difficult for
the respondent to answer "yes" or "no." Also, the answer to an open question is not dependent on the
question. The typical open question calls for a monologue response, and it can be answered in several
different ways.
Why would a fraud examiner perform duplicate testing on data? - Correct answer.To identify
transactions with matching values in the same field: This technique can quickly review the file, or several
files joined together, to highlight duplicate values of key fields. In many systems, the key fields should
contain only unique values (no duplicate records).
An admission-seeking interview is specifically designed to: - Correct answer.Obtain a legal admission of
wrongdoing; The admission-seeking interview is designed to obtain a legal admission of wrongdoing. It
also serves various other purposes. For example, it seeks to clear an innocent person and encourage a
culpable person to confess. A culpable individual usually confesses during the admission-seeking phase
of an interview, while an innocent person does not do so unless threats or coercion are used. Also, the
interviewer will seek to obtain a valid confession. And finally, admission-seeking interviews are designed
to convince the confessor to sign a written statement acknowledging the facts.
Which of the following is LEAST likely to be revealed by analyzing a subject's electronic payment records?
- Correct answer.If the subject is skimming employer funds
,Electronic payments (or e-payments) refer to any type of noncash payment that does not involve a paper
check. Electronic payment records can reveal, among other things: - Correct answer.Assets the subject
has purchased
The locations of the subject's assets (e.g., through the payment of real estate taxes, broker's fees, or
utility payments)
The locations of the subject's residences and businesses (e.g., through analyzing the payments of utility
bills)
Loans the subject has obtained (e.g., through analyzing loan payments)
Payments made to nonexistent employees with direct deposit
The cities and countries in which the subject conducts business (e.g., through analyzing the payments for
carrier services to deliver packages)
Assets ostensibly owned by family members or close associates but effectively controlled, held, or gifted
by the subject
Hotel payments
The true owner of a property (e.g., through analyzing the mortgage payments and payments for home
owner insurance)
Textual analytics - Correct answer.is a method of using software to extract usable information from
unstructured data.
Which of the following is the most appropriate example of an alternative question?
A. "Did you deliberately plan this, or did it just happen?" CORRECT
B. "Did you, or did you not, commit this crime?"
C. "How else might this situation be explained?" INCORRECT
D. "Will you repay the money now or later?" - Correct answer.A. "Did you deliberately plan this, or did it
just happen?"
The alternative question forces the accused to make one of two choices, both of which imply guilt. One
alternative provides the accused with a morally acceptable reason for the misdeed; the other portrays
the accused negatively. Regardless of which answer the accused chooses, he is acknowledging guilt.
,Which of the following is NOT a purpose of the follow-up/recommendations section of a written fraud
examination report? - Correct answer.To calculate the amount of loss caused by any misconduct
identified during the investigation
Liam, a Certified Fraud Examiner, is attempting to get a fraud suspect to admit guilt. Liam should: -
Correct answer.1.)Show the suspect incriminating evidence
2.)Give the suspect an excuse for his behavior
3.) Directly accuse the suspect
Which of the following best describes the primary purpose of the U.S. Right to Financial Privacy Act? -
Correct answer.To prohibit financial institutions from disclosing financial information about individual
customers to governmental agencies without consent or a judicial order
In admission-seeking interviews, an innocent person often reacts differently to the initial accusation than
a culpable person. Which of the following reactions to the initial accusation is common to an innocent
person? - Correct answer.Strong denials--
innocent people sometimes react with genuine shock at being accused. It is not at all unusual for an
innocent person, wrongfully accused, to react with anger. In contrast to the guilty person, the typical
innocent person will strongly deny committing the act or acts in question.
Spencer, a fraud examiner, plans to use a confidential informant. The informant agrees to aid Spencer in
exchange for cash. Spencer prepares a receipt for the transfer of cash to the informant and asks the
informant to sign it, but the informant refuses. What should Spencer do? - Correct answer.Refuse to pay
the cash without a receipt, even if it means the informant will not aid Spencer
What is mutual legal assistance (MLA)? - Correct answer.. A process by which countries request and
provide assistance in law enforcement matters
In most jurisdictions, criminal conviction records are generally not available to the general public unless a
judicial order has been issued. (T/F)? - Correct answer.False; In most jurisdictions, most of the papers
filed in civil suits are accessible as public records; however, criminal and juvenile actions might not be as
open to review. In addition, criminal conviction records are generally available to the public.
Which of the following situations would the U.S. Privacy Act of 1974 regulate? - Correct answer.A federal
agency distributing the medical and employment history of various individuals. The U.S. Privacy Act of
, 1974 establishes a code of information practices that regulates the collection, maintenance,
consumption, and distribution of personally identifiable information that is maintained by federal
agencies. It restricts information about individuals, both employees and nonemployees, and it applies to
governmental agencies and government contractors running a system of records on behalf of the
government.
Facilitators of communication - Correct answer.Facilitators of communication are those social-
psychological forces that make conversations, including interviews, easier to accomplish. These
facilitators require a basic understanding of what motivates people. The facilitators are: fulfilling
expectations, recognition, altruistic appeals, sympathetic understanding, new experience, catharsis,
need for meaning, and extrinsic rewards.
Multi-file processing - Correct answer.is a data analysis software function that allows users to relate
several files by defining relationships in collected data, without the use of the join command.
Which of the following is a valid legal defense to allegations of entrapment against a fraud examiner who
is a federal law enforcement officer? - Correct answer.The fraud examiner acted with adequate
predication.
During the analysis phase in digital forensic investigations, the fraud examiner's primary concern is to
protect the collected information from seizure. (T/F) - Correct answer.False-The primary concern when
analyzing digital evidence is to maintain the integrity of the data at all times. Fraud examiners must be
especially careful with computer equipment because a careless investigator might inadvertently alter
important evidence
The proper method for developing latent fingerprints that have been absorbed into porous materials,
such as paper, is to dust them with fingerprint powder. (T/F) - Correct answer.False, Fraud examiners
should never try to develop latent fingerprints that have been absorbed into paper or other porous
materials by dusting with fingerprint powder or any other means. Such efforts will not only be
unsuccessful, but they will prevent additional examinations. Instead, fraud examiners should preserve
evidentiary documents that contain latent fingerprints by placing them into labeled protective
containers, such as sealable, acid-free paper envelopes.
Which of the following pieces of information is NOT usually contained on the signature card of a
personal bank account? - Correct answer.The thumbprint of the person opening the account
ACTUAL EXAM QUESTIONS AND
CORRECT ANSWERS
z System log - Correct answer.System logs record events executed on an operating system, including
miscellaneous events and those generated during system startup, like hardware and controller failures.
Common types of system events include starting up and shutting down, configuration updates, and
system crashes
Open questions - Correct answer.Open questions are those worded in a way that makes it difficult for
the respondent to answer "yes" or "no." Also, the answer to an open question is not dependent on the
question. The typical open question calls for a monologue response, and it can be answered in several
different ways.
Why would a fraud examiner perform duplicate testing on data? - Correct answer.To identify
transactions with matching values in the same field: This technique can quickly review the file, or several
files joined together, to highlight duplicate values of key fields. In many systems, the key fields should
contain only unique values (no duplicate records).
An admission-seeking interview is specifically designed to: - Correct answer.Obtain a legal admission of
wrongdoing; The admission-seeking interview is designed to obtain a legal admission of wrongdoing. It
also serves various other purposes. For example, it seeks to clear an innocent person and encourage a
culpable person to confess. A culpable individual usually confesses during the admission-seeking phase
of an interview, while an innocent person does not do so unless threats or coercion are used. Also, the
interviewer will seek to obtain a valid confession. And finally, admission-seeking interviews are designed
to convince the confessor to sign a written statement acknowledging the facts.
Which of the following is LEAST likely to be revealed by analyzing a subject's electronic payment records?
- Correct answer.If the subject is skimming employer funds
,Electronic payments (or e-payments) refer to any type of noncash payment that does not involve a paper
check. Electronic payment records can reveal, among other things: - Correct answer.Assets the subject
has purchased
The locations of the subject's assets (e.g., through the payment of real estate taxes, broker's fees, or
utility payments)
The locations of the subject's residences and businesses (e.g., through analyzing the payments of utility
bills)
Loans the subject has obtained (e.g., through analyzing loan payments)
Payments made to nonexistent employees with direct deposit
The cities and countries in which the subject conducts business (e.g., through analyzing the payments for
carrier services to deliver packages)
Assets ostensibly owned by family members or close associates but effectively controlled, held, or gifted
by the subject
Hotel payments
The true owner of a property (e.g., through analyzing the mortgage payments and payments for home
owner insurance)
Textual analytics - Correct answer.is a method of using software to extract usable information from
unstructured data.
Which of the following is the most appropriate example of an alternative question?
A. "Did you deliberately plan this, or did it just happen?" CORRECT
B. "Did you, or did you not, commit this crime?"
C. "How else might this situation be explained?" INCORRECT
D. "Will you repay the money now or later?" - Correct answer.A. "Did you deliberately plan this, or did it
just happen?"
The alternative question forces the accused to make one of two choices, both of which imply guilt. One
alternative provides the accused with a morally acceptable reason for the misdeed; the other portrays
the accused negatively. Regardless of which answer the accused chooses, he is acknowledging guilt.
,Which of the following is NOT a purpose of the follow-up/recommendations section of a written fraud
examination report? - Correct answer.To calculate the amount of loss caused by any misconduct
identified during the investigation
Liam, a Certified Fraud Examiner, is attempting to get a fraud suspect to admit guilt. Liam should: -
Correct answer.1.)Show the suspect incriminating evidence
2.)Give the suspect an excuse for his behavior
3.) Directly accuse the suspect
Which of the following best describes the primary purpose of the U.S. Right to Financial Privacy Act? -
Correct answer.To prohibit financial institutions from disclosing financial information about individual
customers to governmental agencies without consent or a judicial order
In admission-seeking interviews, an innocent person often reacts differently to the initial accusation than
a culpable person. Which of the following reactions to the initial accusation is common to an innocent
person? - Correct answer.Strong denials--
innocent people sometimes react with genuine shock at being accused. It is not at all unusual for an
innocent person, wrongfully accused, to react with anger. In contrast to the guilty person, the typical
innocent person will strongly deny committing the act or acts in question.
Spencer, a fraud examiner, plans to use a confidential informant. The informant agrees to aid Spencer in
exchange for cash. Spencer prepares a receipt for the transfer of cash to the informant and asks the
informant to sign it, but the informant refuses. What should Spencer do? - Correct answer.Refuse to pay
the cash without a receipt, even if it means the informant will not aid Spencer
What is mutual legal assistance (MLA)? - Correct answer.. A process by which countries request and
provide assistance in law enforcement matters
In most jurisdictions, criminal conviction records are generally not available to the general public unless a
judicial order has been issued. (T/F)? - Correct answer.False; In most jurisdictions, most of the papers
filed in civil suits are accessible as public records; however, criminal and juvenile actions might not be as
open to review. In addition, criminal conviction records are generally available to the public.
Which of the following situations would the U.S. Privacy Act of 1974 regulate? - Correct answer.A federal
agency distributing the medical and employment history of various individuals. The U.S. Privacy Act of
, 1974 establishes a code of information practices that regulates the collection, maintenance,
consumption, and distribution of personally identifiable information that is maintained by federal
agencies. It restricts information about individuals, both employees and nonemployees, and it applies to
governmental agencies and government contractors running a system of records on behalf of the
government.
Facilitators of communication - Correct answer.Facilitators of communication are those social-
psychological forces that make conversations, including interviews, easier to accomplish. These
facilitators require a basic understanding of what motivates people. The facilitators are: fulfilling
expectations, recognition, altruistic appeals, sympathetic understanding, new experience, catharsis,
need for meaning, and extrinsic rewards.
Multi-file processing - Correct answer.is a data analysis software function that allows users to relate
several files by defining relationships in collected data, without the use of the join command.
Which of the following is a valid legal defense to allegations of entrapment against a fraud examiner who
is a federal law enforcement officer? - Correct answer.The fraud examiner acted with adequate
predication.
During the analysis phase in digital forensic investigations, the fraud examiner's primary concern is to
protect the collected information from seizure. (T/F) - Correct answer.False-The primary concern when
analyzing digital evidence is to maintain the integrity of the data at all times. Fraud examiners must be
especially careful with computer equipment because a careless investigator might inadvertently alter
important evidence
The proper method for developing latent fingerprints that have been absorbed into porous materials,
such as paper, is to dust them with fingerprint powder. (T/F) - Correct answer.False, Fraud examiners
should never try to develop latent fingerprints that have been absorbed into paper or other porous
materials by dusting with fingerprint powder or any other means. Such efforts will not only be
unsuccessful, but they will prevent additional examinations. Instead, fraud examiners should preserve
evidentiary documents that contain latent fingerprints by placing them into labeled protective
containers, such as sealable, acid-free paper envelopes.
Which of the following pieces of information is NOT usually contained on the signature card of a
personal bank account? - Correct answer.The thumbprint of the person opening the account
