Weekend Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: netbudy65

CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

Questions 4

Talia has been hired by SBS Inc. to implement a new data analysis program to search for warning signs of potential fraud within the company. Which of the following steps should Talia conduct first to MOST EFFECTIVELY use data analysis techniques for such an initiative?

Options:

A.

Build a profile of potential frauds.

B.

Monitor the data.

C.

Cleanse and normalize the data.

D.

Identify the relevant data

Buy Now
Questions 5

Which of the following statements about the process of obtaining a verbal confession is NOT true?

Options:

A.

The transition from the accusation to the confession should occur when the accused supplies the first detailed information about the offense.

B.

Fraudsters tend to overestimate the amount of funds involved in the offense to relieve themselves of the guilt of their dishonest actions.

C.

If the subject lies about an aspect of the offense in the process of confessing, it is best to proceed initially as if the falsehood has been accepted as truth.

D.

The three general approaches to obtaining a verbal confession are chronologically, by transaction, or by event.

Buy Now
Questions 6

Lisa, a fraud examiner at a private company, receives an anonymous call from a potential whistleblower. The whistleblower is hesitant to reveal their identity but will do so if it can be Kept fully confidential. Which of the following statements is MOST ACCURATE?

Options:

A.

Lisa may offer the whistleblower full confidentiality because they are not a suspect

B.

Lisa should explain that she will try her best to keep the whistleblower"s identity confidential.

C.

Lisa should state that she will not be able to keep the whistleblower's identity confidential because all information must be disclosed to management

D.

Lisa may promise the whistleblower full confidentiality, even if she knows her statement is untrue, because the lie is ultimately beneficial to her employer.

Buy Now
Questions 7

Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of Lucas, a construction company executive, for alleged bribery of foreign officials Nobles obtains a court order authorizing him to seize Lucas's personal computer for forensic examination. Which of the following is the MOST ACCURATE statement?

Options:

A.

If Lucas's computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data

B.

If Lucas's computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interlace.

C.

If Lucas's computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

D.

If Lucas's computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process

Buy Now
Questions 8

A law enforcement officer receives a reliable tip from an informant that a government employee is soliciting bribes in exchange for awarding contracts to the employee's agency. To investigate, the officer poses as a potential contractor and contacts the suspect employee about the possibility of getting a contract with the agency. During the conversation, the suspect demands a cash payment for the officer to be considered for upcoming contracts. If the suspect claims entrapment at trial, then which of the following is MOST LIKELY to occur?

Options:

A.

The suspect's claim will succeed because the investigator used deceit

B.

The suspect's claim will succeed because the investigator lacked probable cause

C.

The suspect's claim will fail because the investigator had adequate predication

D.

The suspect's claim will fail because the investigator is a law enforcement agent

Buy Now
Questions 9

Which of the following is NOT a recommended strategy when conducting admission-seeking interviews?

Options:

A.

Conduct admission-seeking interviews only when time is not a factor.

B.

Ensure that accusations are made under conditions of privacy to avoid potential liability

C.

Minimize empathy while emphasizing the perception of moral wrongdoing

D.

Present a morally acceptable reason for the subject's behavior

Buy Now
Questions 10

Which of the following is a best practice for obtaining a signed statement?

Options:

A.

Make sure that everything is included in the signed statement and that no addendum are made

B.

Have the suspect write out the entire statement in their own handwriting

C.

Have two individuals witness the signing of the document when possible.

D.

Include all of the subject's offenses, whether related or not, in a angle document.

Buy Now
Questions 11

Jana. the controller of XYZ Company, notices that the company's hotel expenses increased substantially from the prior year She wants to check to see if this increase is reasonable by comparing hotel expenses from both years to the number of days XYZ"s employees traveled. Which of the following data analysis functions would be the MOST USEFUL in helping Jana analyze these two variables?

Options:

A.

Correlation analysis

B.

Duplicate testing

C.

Verifying multiples of a number

D.

Ben ford’s Law analysis

Buy Now
Questions 12

Assuming that a jurisdiction has prohibited pretexting with financial institutes, which of the following actions would constitute illegal pretexting?

Options:

A.

Withdrawing another person's funds using a stolen bank account number and PIN

B.

Digging through a person's trash to obtain their bank account information

C.

Making purchases with a credit card account under a fictitious identity

D.

Falsely claiming to be the spouse of an account holder to access bank records

Buy Now
Questions 13

Which of the following is NOT a step a fraud examiner must take before seizing evidence in a digital forensic investigation?

Options:

A.

Obtain and become familiar with any legal orders that apply to the investigation

B.

Assemble an investigation team comprised only of outside digital forensic experts

C.

Ensure that only trained professionals employ any software used in a forensic capacity

D.

Determine whether there are privacy issues related to the item(s) to be searched.

Buy Now
Questions 14

The term_____________refers to a process of resolving allegations of fraud from inception to disposition.

Options:

A.

Fraud theory

B.

Forensic investigation

C.

Fraud management

D.

Fraud examination

Buy Now
Questions 15

Vishal, a Certified Fraud Examiner (CFE). has just initiated an interview with Steve, a fraud suspect. After a short introduction. Vishal jokes about the fact that he and Steve are wearing the same tie and then proceeds to ask Steve about the previous night's major sporting event Vishal is attempting to

Options:

A.

Establish the interview theme

B.

Condition the witness.

C.

Establish rapport

D.

Exhibit passive listening.

Buy Now
Questions 16

When a fraud examiner is conducting an examination and is in the process of collecting documents, the fraud examiner should:

Options:

A.

Dust all physical key documents for fingerprints

B.

Establish a document database early in the investigation

C.

Make copies of originals and leave the originals where they were found

D.

Organize all the documents obtained in chronological order

Buy Now
Questions 17

Anne used Will as a confidential informant in her investigation Anne listed information provided by Will in her final report, referring to him using his initials. She paid Will in cash and obtained a receipt for the transaction. Which of Anne's methods was NOT considered a best practice when using informants?

Options:

A.

Referring to Will using his initials

B.

Obtaining a receipt from Will

C.

Using information provided by Will in her report

D.

Using cash to pay Will

Buy Now
Questions 18

Which of the following is the LEAST ACCURATE statement about seizing a computer for examination?

Options:

A.

When taking a computer for examination, if the computer is off. it should remain off when it is removed.

B.

When seizing a computer that is running, it is acceptable for a fraud examiner to review the files contained on the machine prior to seizing it.

C.

Before removing a computer system from a scene for further analysis, it is important to document the system's setup with photographs or diagrams.

D.

When seizing a computer for examination, the seizing party should took around the area for passwords because many people leave passwords near their computers

Buy Now
Questions 19

Which of the following types of data is BEST suited for a BenfordTs Law analysis?

Options:

A.

Employee identification numbers

B.

Telephone numbers

C.

A listing of payment amounts

D.

Vendor addresses

Buy Now
Questions 20

If an important witness becomes hostile and argumentative during an interview, the interviewer should generally.

Options:

A.

Avoid reacting to the witness.

B.

Refute the witness's arguments

C.

Try to reason with the witness

D.

Terminate the interview.

Buy Now
Questions 21

When documenting interviews, it is BEST practice for the interviewer to:

Options:

A.

Document notes for each interview separately, nduding those for electronic recordings.

B.

Write down verbatim all of (he information that the subject provides during the interview

C.

Err on the side of taking too many notes rather than too few.

D.

Note impressions regarding the subject's guilt or innocence.

Buy Now
Questions 22

Which of the following is NOT one of the main limitations of conducting a search for public records using online databases?

Options:

A.

Online public records searches are limited in the jurisdictions they cover.

B.

Public records database companies are difficult to find.

C.

Online coverage of public records varies widely from jurisdiction to jurisdiction

D.

The timeliness and accuracy of information in online databases must be validated

Buy Now
Questions 23

Which of the following is the MOST ACCURATE statement regarding the analysis phase in digital forensic investigations?

Options:

A.

When analyzing data for evidence, fraud examiners should look for exculpatory evidence But not inculpatory evidence

B.

During the analysis phase, it is best to use just one forensic tool for identifying, extracting, and collecting digital evidence

C.

The primary concern when analyzing digital evidence is to maintain the integrity of the data at all times

D.

The analysis phase of digital forensic investigations should not commence unless it is venfied that the suspect devices do not contain relevant data

Buy Now
Questions 24

Naveed, a fraud suspect, has decided to confess to Omar, a Certified Fraud Examiner (CFE). In obtaining a verbal confession from Naveed. Omar should obtain all of the following items of information EXCEPT:

Options:

A.

A general estimate of the amount of money involved

B.

The approximate number of instances

C.

The location of any residual assets

D.

A statement from Naveed that his conduct was an accident

Buy Now
Questions 25

Christopher, a fraud examiner, is conducting an admission-seeking interview with Jennifer, an employee suspected of stealing cash. Which of the following is the LEAST EFFECTIVE phrasing for Christopher to use when posing an admission-seeking question to Jennifer?

Options:

A.

"Did you steal the money?"

B.

'What did you do with the money?"

C.

"Why did you take the money?"

D.

"How much of the money do you have left?"

Buy Now
Questions 26

A fraud examiner believes that a suspect might have used illicit funds to construct a commercial building to fit a restaurant. Which of the following records would be the MOST helpful in confirming the owner of the building?

Options:

A.

Local court records

B.

Commercial filings

C.

Building permit records

D.

Voter registration records

Buy Now
Questions 27

Lmdsey, a Certified Fraud Examiner (CFE). has been retained to investigate allegations of bribery and kickbacks allegedly committed by a member of an organization's procurement department. Lindsey conducts an interview during which one of the accused's colleagues states that they overheard the accused discussing a free tnp received from one of the organization's vendors. Which type of evidence would the interviewee's statement be considered?

Options:

A.

Documentary evidence

B.

Testimonial evidence

C.

Verbal evidence

D.

Inconclusive evidence

Buy Now
Questions 28

Caroline, a fraud examiner, is conducting an admission-seeking interview with John, an employee suspected of stealing cash. Which of the following is the MOST effective phrasing for Caroline to use when posing an admission-seeking question to John?

Options:

A.

"Why did you take the money?"

B.

"What do you know about the stolen money?"

C.

"Do you know who took the money''"

D.

"Did you steal the money?"

Buy Now
Questions 29

Al needs to know the location of the principal office and the initial shareholders of a company he is investigating. Which of the following would be the BEST source of this reformation?

Options:

A.

The organizational filings with the government of the jurisdiction in which the company is incorporated

B.

The contractual documents regarding real properly owned by the corporation

C.

The utility records in the municipality where the corporation has its principal office

D.

The shareholder data form filed with the World Bank

Buy Now
Questions 30

Which of the following is the MOST APPROPRIATE measure when seeking to avoid alerting suspected perpetrators who are under investigation?

Options:

A.

Terminate the suspected employee.

B.

Delay taking any action.

C.

Investigate during nonbusiness hours.

D.

Disclose the investigation to all employees

Buy Now
Questions 31

Which of the following statements concerning access to nonpublic records is FALSE?

Options:

A.

When civil litigation has commenced, a party often may obtain a subpoena or legal order for an individual's relevant bank records.

B.

A fraud examiner can request a business's bank records even if the business is not legally obligated to comply.

C.

An audit clause can be designed to allow a party to inspect the books of a business partner or vendor.

D.

During the government's criminal investigation, a fraud examiner not employed by the government has a right to access relevant documents that the government has obtained.

Buy Now
Questions 32

Which of the following sets of numbers could a fraud examiner MOST LIKELY benefit from running a Benford’s Law analysis on?

Options:

A.

Telephone numbers

B.

Vendor invoice amounts

C.

Employee identification numbers

D.

Bank account numbers

Buy Now
Questions 33

John, a fraud investigator, is interviewing Mary, who he suspects has been embezzling company funds. Which of the following is the recommended approach John should use to ask Mary questions?

Options:

A.

Start with questions about unknown information and work toward known information

B.

Ask questions in random order to keep Mary from guessing the next question

C.

Start with specific questions and move toward general questions

D.

Seek general information before seeking specific details

Buy Now
Questions 34

Which of the following statements about how fraud examiners should approach fraud examinations is FALSE?

Options:

A.

In most examinations, fraud examiners should start interviewing the least involved candidates and proceed toward those who are potentially more involved.

B.

When conducting fraud examinations, fraud examiners should start with specific details and move toward more general information.

C.

When conducting fraud examinations, fraud examiners should adhere to the fraud theory approach.

D.

When conducting fraud examinations, fraud examiners should begin with general information that is known and then move to the more specific details.

Buy Now
Questions 35

Which of the following is a reason why a subject's credit card records are useful in tracing investigations?

Options:

A.

Credit card statements show source of the funds used to pay a credit card bill

B.

Credit card records show the movements and habits of the subject

C.

Credit card records provide insight into the subject's litigation history

D.

Credit card records contain information about the division and distribution of the subject's assets

Buy Now
Questions 36

Which of the following is TRUE of a follow-up/recommendations section in a written fraud examination report?

Options:

A.

A follow-up/recommendations section is not a required part of every written fraud examination report

B.

A follow-up/recommendations section calculates the amount of loss caused by any misconduct identified during the investigation

C.

A follow-up/recommendations section must include a list of organizational failings that contnbuted to the fraud

D.

All of the above

Buy Now
Questions 37

Which of the following is the MOST ACCURATE statement about imaging suspect computers' hard drives?

Options:

A.

Imaging enables the retrieval of data from the suspect computer directly via its operating system.

B.

Imaging prohibits access to the suspect computer's hard drive by individuals not professionally trained in forensic analysis

C.

Imaging creates pictures of the suspect computer system and its wires and cables

D.

Imaging allows for the analysis of data from a suspect computer without altering or damaging the original data in any way

Buy Now
Questions 38

Gamma, a Certified Fraud Examiner (CFE>, was conducting an admission-seeking interview of Delta, a fraud suspect. Gamma tells Delta, "It isn't like you took something from a friend or neighbor I can see how you could say. 'Well, this would be okay as long as it is the company and not my coworkers.' Isn't that right?" This technique seeks to establish rationalization by:

Options:

A.

Convincing DDU that the incident had suffcinet justification

B.

Reducing Delta's perception of the legal seriousness of the matter

C.

Depersonalizing the victim

D.

Developing revenge as a motive

Buy Now
Questions 39

Which of the following is a measure that can help avoid alerting suspected perpetrators who are under investigation?

Options:

A.

Terminate the suspected employee.

B.

Notify everyone in the affected department

C.

Delay taking any action.

D.

Inform only those who need to know.

Buy Now
Questions 40

Which of the following is NOT one of the main limitations of conducting a search for public records using online databases?

Options:

A.

Online records companies are difficult to find.

B.

Fraud examiners must validate the accuracy of the records obtained online

C.

The online record might only be a brief abstract of the original.

D.

Fraud examiners often must search for public records in multiple jurisdictions.

Buy Now
Questions 41

When planning for the interview phase of an investigation, which of the following steps should NOT be taken by the fraud examiner?

Options:

A.

Consider what the interview is intended to accomplish and state an objective.

B.

Review the case file to ensure that important information has not been overlooked

C.

Prepare a detailed list of questions to ask the subject during the interview.

D.

Ensure that the interview is held in a venue where the subject will feel Uncomfortable

Buy Now
Questions 42

Tonya, a suspect in a kickback scheme, is being interviewed by Carlos, a fraud examiner. As the interview progresses. Carlos notices that Tonya is exhibiting signs of stress, such as repeatedly touching her face, crossing and uncrossing her legs, and darting her eyes around the room Carlos should conclude that Tonya's behavior is the result of deception

Options:

A.

True

B.

False

Buy Now
Questions 43

Jackson, a digital forensic examiner for a government agency, is conducting a criminal investigation into the alleged embezzlement of funds from the government's Welfare Department (WD). Ginny. a WD employee, is the prime suspect. Jackson obtains a court order authorizing him to seize Ginny's personal computer for forensic examination. Which of the following is the MOST ACCURATE statement?

Options:

A.

If Ginny's computer is running. Jackson should perform a graceful shutdown by turning it off using the normal shutdown process

B.

If Ginny’s computer is off and Jackson needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interface.

C.

If Ginny's computer is off. Jackson should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

D.

If Ginny's computer is running. Jackson may retrieve data from the computer directly via its normal interface if the evidence that he needs exists only in the form of volatile data

Buy Now
Questions 44

Allison, a Certified Fraud Examiner (CFE). is investigating a potential procurement fraud scheme. While interviewing a subject, she asks. "Why did you choose to do business with that vendor?" This can BEST be described as a(n):

Options:

A.

Open question

B.

Complex question

C.

Leading question

D.

Closed question

Buy Now
Questions 45

Which of the following is FALSE regarding link analysis?

Options:

A.

Link analysis is a poor tool to use for investigating a money laundering scheme

B.

Link analysis can be used to map connections between entities that share an address

C.

Link analysis helps identify indirect relationships with several degrees of separation

D.

Link analysis is an effective tool for demonstrating complex networks

Buy Now
Questions 46

Janet suspects that a local restaurant is being used as a front business for a criminal operation. Which of the following types of records would be the MOST LIKELY to help Janet discover who owns the restaurant building?

Options:

A.

Commercial filings

B.

Building permit records

C.

Local court records

D.

Voter registration records

Buy Now
Questions 47

Which of the following can be obtained from a wire transfer record?

Options:

A.

The name of the receiving institution's registered agent

B.

The recipient's government identification number

C.

The name of the sender or originator

D.

The sending institution's accreditation type

Buy Now
Questions 48

Which of the following is NOT an advantage to using link analysis in a fraud investigation?

Options:

A.

Link analysis visually displays financial ratio analysis

B.

Link analysis is an affective tool to demonstrate complex networks

C.

Link analysis helps identify indirect relationships with several degrees of separation.

D.

Link analysis allows the investigator to discover patterns in data.

Buy Now
Questions 49

Cynthia is preparing to conduct a covert investigation. Prior to conducting surveillance of her subject, she creates a memorandum outlining the basis for her operation Which of the following pieces of information should she include in her memorandum?

Options:

A.

The name of the subject she will be observing

B.

Her first impression regarding the subject's culpability

C.

The identities of any confidential sources to be used in the operation

D.

All of the above

Buy Now
Questions 50

In response to an accusation made during an admission-seeking interview, the subject begins to voice a denial to the charge. How should the interviewer react to the first indication of a subject's denial?

Options:

A.

Allow the subject 1o continue denying the charge

B.

Argue the point directly with the subject until a confession is obtained

C.

Remind the subject of the laws against perjury.

D.

Interrupt the denial by using a delaying tactic.

Buy Now
Questions 51

Which of the following is a unique challenge of cloud forensics that is not encountered in traditional forensic practices?

Options:

A.

Lack of corroborating evidence

B.

Lack of data control

C.

Lack of trust from cloud providers

D.

Lack of relevant data

Buy Now
Exam Code: CFE-Investigation
Exam Name: Certified Fraud Examiner (CFE) - Investigation
Last Update: Oct 16, 2025
Questions: 170

PDF + Testing Engine

$134.99

Testing Engine

$99.99

PDF (Q&A)

$84.99