CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

True

False

Referring to the informant in the memorandum using the informant's initials

Using information from the informant in his final report

Creating a receipt regarding the cash payment

Compensating the informant with cash

Accessibility

Transparency

Exclusivity

Traceability

Ask questions in random order to prevent Larry from knowing what question comes next.

Start with questions about known information and work toward unknown information

Start with general questions and move toward specific questions

Ask questions seeking general information before seeking details

Provide Craig with plenty of notice prior to the interview to not provoke resentment

Conduct the interview with as little notice as possible so Craig will be unprepared

Ask Craig when ho would prefer to be interviewed in an effort to engender cooperation

Avoid interviewing Craig if possible due to Craig's potential volatility

The information expected to be gained from the operation

The identities of any confidential sources to be used in the operation

His first impression regarding the subject's culpability

All of the above

To access any user-posted information on social media sites, fraud examiners must obtain some type of legal order from the jurisdiction in which the user resides.

A fraud examiner cannot be held liable for violating a user's privacy rights if they hack or break into areas of a social networking site designated as private because all social media information is public.

The Privacy of Social Networks Treaty is a binding international treaty that makes it illegal for law enforcement to seek social media log-in credentials from users.

Hacking or breaking into information on social media sites that is restricted as private could result in liability for fraud examiners due to violation of users' privacy rights.

When analyzing data for evidence, fraud examiners should look for exculpatory evidence But not inculpatory evidence

During the analysis phase, it is best to use just one forensic tool for identifying, extracting, and collecting digital evidence

The primary concern when analyzing digital evidence is to maintain the integrity of the data at all times

The analysis phase of digital forensic investigations should not commence unless it is venfied that the suspect devices do not contain relevant data

That all reasonable investigative steps have been taken

That the interview's time and location can be controlled

That no other person was involved in the fraud in question

That the interview's subject matter can be controlled

Correlation analysis

Duplicate testing

Verifying multiples of a number

Ben ford’s Law analysis

Many copiers connect via parallel cables, which store and transmit copy job data.

Most copiers store, process, and transmit data m a cloud environment

Many copiers have internal hard drives that might contain information relevant to a fraud examination

Most copiers today are nonimpact copiers, meaning that they store copied images indefinitely.

Whether the information was presented by a lay witness or an expert witness

Whether the evidence is documentary or testimonial

Whether the evidence is direct or circumstantial

Whether the organization has a general document retention policy in place

Compare book and tax depreciation and indicate variances

Identify paycheck amounts over a certain limit

Review recurring monthly expenses and compare to posted/paid invoices

All of the above

Terminate the suspected employee.

Notify everyone in the affected department

Delay taking any action.

Inform only those who need to know.

Referring to Will using his initials

Obtaining a receipt from Will

Using information provided by Will in her report

Using cash to pay Will

True

False

Finding out where a person lives

Reviewing an individual's personal mobile phone records

Obtaining a company's business filings

Determining who owns a piece of real estate

The configuration of a business program to emulate and Integrate the actions of a human to execute certain business processes, thus increasing efficiency and automating repetitive manual tasks

The use of historical data, along with analyses, statistics, and machine learning components, to build a mathematical model that captures important trends and creates a quantitative forecast

The employment of computer systems to perform human-like tasks such as visual perception and decision-making

The use of layered artificial neural networks to accommodate more data and more sophisticated algorithms to identify complex patterns

Once a criminal case is filed, all records obtained by the government are considered public records

Nonpublic records cannot be obtained by subpoena or legal order in a civil action

In most junsdictions. banks are allowed to turn over a suspect's account information directly to a fraud victim when there is adequate evidence of wrongdoing.

The government usually will not share nonpublic records with a fraud victim during an investigation into the underlying fraud.

When taking a computer for examination, if the computer is off. it should remain off when it is removed.

When seizing a computer that is running, it is acceptable for a fraud examiner to review the files contained on the machine prior to seizing it.

Before removing a computer system from a scene for further analysis, it is important to document the system's setup with photographs or diagrams.

When seizing a computer for examination, the seizing party should took around the area for passwords because many people leave passwords near their computers

"Did you steal the money?"

'What did you do with the money?"

"Why did you take the money?"

"How much of the money do you have left?"

True

False