Real CFE Investigation Exam Dumps For Certified Fraud Examiner - Investigation Exam Preparation

Real CFE Investigation Exam Dumps For Certified Fraud Examiner – Investigation Exam Preparation

Eleanor2024-10-14T15:24:06+00:00

By Eleanor ACFE, Certified Fraud Examiner(CFE)

As one Certified Fraud Examiner (CFE) exam, the Certified Fraud Examiner – Investigation (CFE Investigation) mainly tests your understanding of the basic tools and techniques necessary to gather information and evidence when conducting a fraud examination and identifying perpetrators. To help you prepare for the CFE Investigation exam, ITPrepare has real CFE Investigation exam dumps for good exam preparation. Downloading the CFE Investigation exam dumps pdf document gives you the flexibility to read CFE Investigation exam questions anywhere and anytime as the ACFE CFE Investigation pdf file is portable and printable.

Before downloading the CFE Investigation pdf file, just read the CFE Investigation free dumps:

Page 1 of 6

1. Caroline, a fraud examiner, is conducting an admission-seeking interview with John, an employee suspected of stealing cash .

Which of the following is the MOST effective phrasing for Caroline to use when posing an admission-seeking question to John?

"Why did you take the money?"

"What do you know about the stolen money?"

"Do you know who took the money''"

"Did you steal the money?"

2. Gilbert is preparing to conduct a covert investigation. Before acting, he wants to wnte a memorandum documenting his plan .

Which of the following pieces of information should he include in this memorandum?

The information expected to be gained from the operation

The identities of any confidential sources to be used in the operation

His first impression regarding the subject's culpability

All of the above

3. Butler, a Certified Fraud Examiner (CFE), needs to obtain a copy of a statement that the chief executive officer (CEO) of Accord Investments, a venture capital firm, posted on the firm's website sometime last year. Unfortunately, the quote has been removed from the website .

Which of the following resources would be the BEST choice for Butler to consult to find an earlier version of the web page that he needs?

The invisible archives

The free web

The internet archives

The deep web

4. Why is it necessary to image a seized computer's hard drive for forensic analysis?

To prohibit access to the suspect computer's hard drive by individuals not professionally trained in forensic analysis

To allow for the analysis of data from a suspect computer without altering or damaging the original data in any way

To create pictures of the suspect computer system and its wires and cables

To enable the retrieval of data from the suspect computer directly via its operating system

5. Which of the following is a measure that can help avoid alerting suspected perpetrators who are under investigation?

Terminate the suspected employee.

Notify everyone in the affected department

Delay taking any action.

Inform only those who need to know.

6. Orlando is conducting a fraud examination regarding Fast Freight, a large publicly traded corporation, and wants to find the current officers and directors of the company .

Which of the following would be the best source of information for this purpose?

Commercial filings

Real property records

The company's corporate bylaws

Regulatory securities records

7. Which of the following should be done to prepare an organization for a formal fraud investigation?

Inform the subject that they are under investigation.

Issue an organization-wide communication that notifies all employees about the investigation

Notify all managers about the investigation, explaining why it is happening and who is involved.

Prepare the managers of the employees who will be involved in the investigation

8. Which of the following would be MOST USEFUL m determining who created a specrfic document file?

Operating system partition

Internet activity data

The system log

The document's metadata

9. Assuming that a jurisdiction has prohibited pretexting with financial institutes, which of the following actions would constitute illegal pretexting?

Withdrawing another person's funds using a stolen bank account number and PIN

Digging through a person's trash to obtain their bank account information

Making purchases with a credit card account under a fictitious identity

Falsely claiming to be the spouse of an account holder to access bank records

10. Management at Oak Company has asked Arthur, an internal auditor, to implement a data analysis program to search for warning signs of potential fraud within the company .

Which of the following steps should Arthur conduct first to MOST effectively use data analysis techniques for such an initiative?

Analyze the data.

Cleanse and normalize the data

Build a profile of potential frauds.

Obtain the data.

Page 2 of 6

11. Which of the following data is the MOST DIFFICULT to recover during a digital forensic examination?

Time and date information about files

Websites visited

Files that have been overwritten

Communications sent via instant messenger

12. Due to risks of illicit transactions, most jurisdictions require financial institutions to obtain information about which of the following from an institution with which they have a foreign correspondent relationship?

The institution's branch addresses

The institution's licenses or certifications

The institution's tax statements

The institution's client loan profiles

13. Which of the following is NOT one of the main limitations of conducting a search for public records using online databases?

Online public records searches are limited in the jurisdictions they cover.

Public records database companies are difficult to find.

Online coverage of public records varies widely from jurisdiction to jurisdiction

The timeliness and accuracy of information in online databases must be validated

14. Arnold, a Certified Fraud Examiner (CFE) for Integra Wealth, learns that Elizabeth, an accounts payable clerk, recently purchased an expensive ski boat Arnold also knows that Elizabeth recently purchased a vacation home on a nearby lake Arnold has sufficient predication to:

Notify management of the possibility that Elizabeth has committed fraudulent acts

Search Elizabeth's mobile phone for evidence of misconduct.

Accuse Elizabeth directly of having committed fraud

Conduct discreet inquiries into Elizabeth's responsibilities as an accounts payable clerk

15. Which of the following BEST describes the data analytics approach known as predictive analytics?

The employment of a learning algorithm that identifies similarities, patterns, or anomalies within a data set on its own, without human involvement

The configuration of a business program to emulate and integrate the actions of a human to execute certain business processes thus increasing efficiency and automating repetitive manual tasks

The use of historical data, along with analyses, statistics, and machine learning components, to build a mathematical model that captures important trends and creates a quantitative forecast

The use of layered artificial neural networks to accommodate more data and more sophisticated algorithms to identify complex patterns

16. Eugene is conducting an admission-seeking interview of a suspect. During the interview, the suspect frequently looks away from Eugene while responding to questions. Eugene can safely conclude that the suspect is dishonest due to his failure to maintain eye contact.

True

False

17. Which of the following statements is MOST ACCURATE regarding how a fraud examiner should prepare for an interview with a subject from a different jurisdiction?

A fraud examiner does not need to research cultural considerations such as personal space and eye contact.

A fraud examiner should find out whether there are limitations on the use of information obtained during an interview

Failing to observe cultural norms is not a concern if the interviewer is from a different country than the interviewee

Consulting with legal counsel is only necessary when an investigation spans multiple junsdictions

18. Sam needs to obtain the most accurate court records possible in a particular jurisdiction concerning a fraud suspect. The BEST place for Sam to look is a global database that compiles court cases from various jurisdictions

True

False

19. Which of the following is the MOST ACCURATE statement about the privacy of information shared through social media?

To access any user-posted information on social media sites, fraud examiners must obtain some type of legal order from the jurisdiction in which the user resides.

A fraud examiner cannot be held liable for violating a user's privacy rights if they hack or break into areas of a social networking site designated as private because all social media information is public.

The Privacy of Social Networks Treaty is a binding international treaty that makes it illegal for law enforcement to seek social media log-in credentials from users.

Hacking or breaking into information on social media sites that is restricted as private could result in liability for fraud examiners due to violation of users' privacy rights.

20. Tara. a Certified Fraud Examiner (CFE). is searching social media sites for evidence in a fraud investigation .

Which of the following is the MOST ACCURATE statement regarding what Tara should do when mining social media sites for evidence of fraud?

Tara should preserve the information by saving the links of the postings as bookmarks in her browser.

Tara should preserve the metadata by printing out the web pages of each of the postings.

Tara should conduct a forensic shutdown of the computer to preserve the metadata m the social networking sites.

Tara should preserve the information from the sites so that it can be established as authentic if used in court.

Page 3 of 6

21. 1.Which of the following types of information would LEAST LIKELY be found when searching external sources without the subject's consent or a legal order?

A witness's address

Assets owned by a subject

A subject's employee personnel file

A competitor's ownership information

22. Which of the following can be obtained from a wire transfer record?

The name of the receiving institution's registered agent

The recipient's government identification number

The name of the sender or originator

The sending institution's accreditation type

23. Which of the following statements is MOST ACCURATE regarding how a fraud examiner should prepare for an interview with a subject from a different jurisdiction?

Failing to observe cultural norms is not a concern if the interviewer is from a different country than the interviewee.

Consulting with legal counsel is only necessary when an investigation spans multiple

A fraud examiner should find out whether the interviewee can insist upon the presence of a legal representative

A fraud examiner does not need to research cultural considerations such as appropriate greetings and eye contact.

24. Which of the following is INCORRECT with regard to locating individuals using online records?

Before engaging in a search the fraud examine' should know the mod powerful and useful '>Des of searches

If an individual has moved, obtaining a past address is usually of no help

Online records are very useful in locating subjects whose whereabouts are unknown

Obtaining a past address of the subject should be the first step in trying to locate a subject using online records.

25. Charles, a fraud examiner, accuses George of fraud during an admission-seeking

interview. George immediately denies the charge How should Charles respond to George's denial?

Counter the denial by arguing with George until further denials are futile

Use a delaying tactic to interrupt the denial

Remind George he has to tell the truth or face perjury.

Allow George to continue denying the charge.

26. Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of Lucas, a construction company executive, for alleged bribery of foreign officials Nobles obtains a court order authorizing him to seize Lucas's personal computer for forensic examination .

Which of the following is the MOST ACCURATE statement?

If Lucas's computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data

If Lucas's computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interlace.

If Lucas's computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

If Lucas's computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process

27. Which of the following is the MOST IMPORTANT question for a fraud examiner to ask before commencing a legal action to recover assets?

"Is there a relevant statute of limitations9"

"Does the suspect already have a criminal record?"

"Is the suspect guilty of the fraudulent act?''

"Are nonlegal recovery methods or remedies available?''

28. Shane, a Certified Fraud Examiner (CFE). is investigating Larsen. who is active on various social networking sites. Shane wants to search and extract information from Larson's social media postings so that it can be used in court as evidence.

Which of the following is the MOST ACCURATE statement regarding what Shane should do when conducting a social media investigation of Larsen?

Shane should conduct a forensic shutdown of his computer to preserve the metadata in the social networking sites.

Shane should preserve the information from the social networking sites so that it can be established as authentic if used in court.

Shane should email himself the links of the postings so that he can retrieve them later.

Shane should preserve the information by saving the links of the postings in his 'bookmarks"

29. Which of the following is TRUE of a follow-up/recommendations section in a written fraud examination report?

A follow-up/recommendations section is not a required part of every written fraud examination report

A follow-up/recommendations section calculates the amount of loss caused by any misconduct identified during the investigation

A follow-up/recommendations section must include a list of organizational failings that contnbuted to the fraud

All of the above

30. Anne used Will as a confidential informant in her investigation Anne listed information provided by Will in her final report, referring to him using his initials. She paid Will in cash and obtained a receipt for the transaction .

Which of Anne's methods was NOT considered a best practice when using informants?

Referring to Will using his initials

Obtaining a receipt from Will

Using information provided by Will in her report

Using cash to pay Will

Page 4 of 6

31. A fraud examiner believes that a suspect might have used illicit funds to construct a commercial building to fit a restaurant .

Which of the following records would be the MOST helpful in confirming the owner of the building?

Local court records

Commercial filings

Building permit records

Voter registration records

32. Which of the following statements about the process of obtaining a verbal confession is TRUE?

The only acceptable approaches to obtaining a verbal confession are chronologically or by transaction

The transition from the accusation to the confession should occur when the accused supplies the first detailed information about the offense.

If the subject lies about an aspect of the offense in the process of confessing, it is best to correct the records immediately before proceeding

Fraudsters tend to overestimate the amount of funds involved in the offense to relieve themselves of the guilt of their dishonest actions.

33. Which of the following is the MOST ACCURATE statement about trying to locate a subject using online records?

Most public records services do not maintain a list of past addresses

Obtaining a past address of the subject should be the first step in trying to locate a subject using online records

The first step in locating someone using online records is to obtain a list of past employers

Online records are generally not useful in locating subjects whose address is unknown

34. Which of the following is a reason why a person or organization might engage a fraud examiner to trace illicit transactions?

A victim of fraud wants to facilitate the recovery of criminal proceeds.

An employer wants to know if an employee is falsifying regulatory reports

An attorney wants to evaluate an expert's financial report

An entity needs to find hidden relationships in big data that otherwise would not be discovered.

35. Assuming that a jurisdiction has prohibited pretexting against financial institutions, which of the following actions would constitute illegal pretexting?

Intentionally making false statements on loan applications

Stealing a person's mail lo obtain the person's bank account number

Impersonating an account holder to access their bank records

Setting up a bank account in an assumed name

36. Which of the following is the MOST ACCURATE statement regarding the analysis phase in digital forensic investigations?

The analysis phase of digital forensic investigations should not commence unless it is verified that the suspect devices do not contain relevant data.

During the analysis phase, it is best to use a combination of the various forensic tools that can assist h identifying, extracting, and collecting digital evidence

When analyzing data for evidence, fraud examiners should look for exculpatory evidence but not exculpatory evidence

The primary concern when analyzing digital evidence is to protect the collected information from seizure

37. Marilyn, a Certified Fraud Examiner (CFE). is reasonably sure that Shelly, her primary suspect, committed the fraud in question Before scheduling an admission-seeking interview with Shelly. Marilyn should be reasonably sure of all of the following EXCEPT:

That all reasonable investigative steps have been taken

That the interview's time and location can be controlled

That no other person was involved in the fraud in question

That the interview's subject matter can be controlled

38. If your suspect is spending suspected illicit funds on consumables (e.g.. travel and entertainment) and you need to prove their illicit income circumstantially, which of the following methods of tracing assets would yield the BEST result?

expenditures method

The consumables method

The income method

The asset method

39. Which of the following statements is MOST ACCURATE regarding covert operations?

Fraud examiners should conduct coven operations only after attempting conventional methods of evidence-gathering

Mistakes in covert operations generally do not cause damage to their associated investigations

Covert operations rarely prove beneficial to investigations even when planned properly.

Most jurisdictions provide protections for investigators conducting covert operations that shield them from reputational, financial, and legal consequences.

40. Which of the following is the MOST ACCURATE statement about how fraud examiners shook! approach fraud examinations?

Fraud examinations should begin with general information that is known, starting at the periphery, and then move to the more specific details.

When conducting fraud examinations, fraud examiners should adhere to the means-and-ends approach

When conducting fraud examinations, fraud examiners should operate under the assumption that the subjects are guilty

In most examinations, fraud examiners should interview those who are more involved in the matters at issue before interviewing those who are less involved.

Page 5 of 6

41. Which of the following situations would MOST LIKELY require access to nonpublic records to develop evidence?

Finding out where a person lives

Reviewing an individual's personal mobile phone records

Obtaining a company's business filings

Determining who owns a piece of real estate

42. Which of the following types of files is the most difficult to recover during a digital forensic examination?

Overwritten files

Deleted until

Deleted link (shortcut) files

Hidden files

43. Which of the following is a reason why a subject's credit card records are useful in tracing investigations?

Credit card statements show source of the funds used to pay a credit card bill

Credit card records show the movements and habits of the subject

Credit card records provide insight into the subject's litigation history

Credit card records contain information about the division and distribution of the subject's assets

44. Which of the following sources of information is usually considered to be the MOST IMPORTANT in tracing a subject's assets?

Credit card statements

PaystuDs

Surveillance footage

Financial institution records

45. Baker, a Certified Fraud Examiner (CFE). contacts Dierdre for the purpose of conducting a routine, information-gathering interview Dierdre expresses a desire that her coworker.

Matthew, whom Baker also plans to interview, be interviewed at the same time Baker should:

Interview Dierdre and Matthew separately.

Interview Dierdre and Matthew at the same time, but bring in a second interviewer

Interview Dierdre and Matthew at the same time by himself

Allow Matthew to be present as a silent observer.

46. Vishal, a Certified Fraud Examiner (CFE). has just initiated an interview with Steve, a fraud suspect. After a short introduction. Vishal jokes about the fact that he and Steve are wearing the same tie and then proceeds to ask Steve about the previous night's major sporting event Vishal is attempting to

Establish the interview theme

Condition the witness.

Establish rapport

Exhibit passive listening.

47. Gunn, a Certified Fraud Examiner (CFE). was hired to trace Kelly's financial transactions. During his investigation. Gunn obtains records of electronic payments that Kelly made during the past three years .

Which of the following are these records MOST LIKELY to reveal?

If Kelly has been skimming funds

The cities and countries in which Kelly conducts business

The division and distribution of Kelly's assets

The market value of any real property Kelly owns

48. The term_____________refers to a process of resolving allegations of fraud from inception to disposition.

Fraud theory

Forensic investigation

Fraud management

Fraud examination

49. When planning for the interview phase of an investigation, which of the following steps should NOT be taken by the fraud examiner?

Consider what the interview is intended to accomplish and state an objective.

Review the case file to ensure that important information has not been overlooked

Prepare a detailed list of questions to ask the subject during the interview.

Ensure that the interview is held in a venue where the subject will feel Uncomfortable

50. Andrew wants to use a confidential informant in his investigation. He plans to compensate the informant with cash and obtain a receipt. He also plans to identify his source in a memorandum and his final report using only the informant's initials .

Which of Andrew's plans is NOT considered a best practice when using an informant?

Referring to the informant in the memorandum using the informant's initials

Using information from the informant in his final report

Creating a receipt regarding the cash payment

Compensating the informant with cash

Page 6 of 6

51. Elizabeth, a Certified Fraud Examiner (CFE), is conducting an admission-seeking interview with Shannon, a fraud suspect. Shannon is seated approximately five feet away from Elizabeth in an empty room. The room has several pictures and posters on the wall, and the door is closed.

According to admission-seeking interview best practices, what change should Elizabeth make to the interview environment to increase the chances of the interview's success?

Move the interview to a room without pictures or wall hangings to prevent distractions

Open the door so that Shannon feels free to leave at any time

Place a table between her and Shannon to create a psychological barrier

All of the above

52. Which of the following statements concerning access to nonpublic records is MOST ACCURATE?

Once a criminal case is filed, all records obtained by the government are considered public records

Nonpublic records cannot be obtained by subpoena or legal order in a civil action

In most junsdictions. banks are allowed to turn over a suspect's account information directly to a fraud victim when there is adequate evidence of wrongdoing.

The government usually will not share nonpublic records with a fraud victim during an investigation into the underlying fraud.

53. Which of the following data analysis functions is used to determine whether company policies are met by employee transactions, such as verifying that traveling employees book their accommodations at approved hotels?

The correlation analysis function

The Join function

The gap testing function

The compliance verification function

54. Jackson, a digital forensic examiner for a government agency, is conducting a criminal investigation into the alleged embezzlement of funds from the government's Welfare Department (WD). Ginny. a WD employee, is the prime suspect. Jackson obtains a court order authorizing him to seize Ginny's personal computer for forensic examination .

Which of the following is the MOST ACCURATE statement?

If Ginny's computer is running. Jackson should perform a graceful shutdown by turning it off using the normal shutdown process

If Ginny’s computer is off and Jackson needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interface.

If Ginny's computer is off. Jackson should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

If Ginny's computer is running. Jackson may retrieve data from the computer directly via its normal interface if the evidence that he needs exists only in the form of volatile data

55. Which of the following is NOT a step a fraud examiner must take before seizing evidence in a digital forensic investigation?

Obtain and become familiar with any legal orders that apply to the investigation

Assemble an investigation team comprised only of outside digital forensic experts

Ensure that only trained professionals employ any software used in a forensic capacity

Determine whether there are privacy issues related to the item(s) to be searched.

56. Al needs to know the location of the principal office and the initial shareholders of a company he is investigating .

Which of the following would be the BEST source of this reformation?

The organizational filings with the government of the jurisdiction in which the company is incorporated

The contractual documents regarding real properly owned by the corporation

The utility records in the municipality where the corporation has its principal office

The shareholder data form filed with the World Bank

57. Jade, a Certrfied Fraud Examiner (CFE). is conducting an internal investigation in which an employee is suspected of stealing inventory and selling it through a possible shell company called Hidden Finds. LLC. When Jade tries to check Hidden Finds' website, a message appears that redirects customers to a web address that ends with onion.

To view the website's content. Jade will need to install a specialized web browser that enables her to access which of the following?

The deep archives

The free web

The dark web

The internet archives

58. Cynthia is preparing to conduct a covert investigation. Prior to conducting surveillance of her subject, she creates a memorandum outlining the basis for her operation.

Which of the following pieces of information should she include in her memorandum?

The name of the subject she will be observing

Her first impression regarding the subject's culpability

The identities of any confidential sources to be used in the operation

All of the above

59. During an interview, Alex asked a fraud suspect if he could retrieve the suspect's account records from her bank. The suspect said, "yes." but she did not provide consent in writing

Although the suspect orally consented, the suspect's bank is NOT required to allow Alex to access the suspect's account records at this point.

True

False

60. Susan, a Certified Fraud Examiner (CFE). is conducting an ad mission-seeking interview of Beth, a fraud suspect. After Susan gave Beth a suitable rationalization for her conduct. Beth continued her denials, giving various alibis .

Which of the following would be the LEAST EFFECTIVE technique for Susan to use in this situation?

Displaying evidence that specifically contradicts Beth's alibis

Discussing some of Beth's prior deceptions

Discussing the testimony of other witnesses

Displaying all the evidence she has against Beth at once

Real CFE Investigation Exam Dumps For Certified Fraud Examiner – Investigation Exam Preparation