Certified Fraud Examiner - Investigation Exam CFE Investigation Dumps - Free Latest Dumps for IT Certification Exams

Certified Fraud Examiner – Investigation Exam CFE Investigation Dumps

dumps2023-05-29T10:47:10+08:00

The CFE Investigation exam is one of the four areas for CFE exams, the other three areas are Financial Transactions and Fraud Schemes, Law, and Fraud Prevention and Deterrence. You need to pass the four areas to pass the CFE exam. There are 100 multiple-choice questions in the real CFE Investigation exam, and you have 2 hours to finish this area. You must answer at least 75% of the questions correctly to pass each section. We provide the latest Certified Fraud Examiner – Investigation Exam CFE Investigation dumps for you to pass the test easily. Free CFE Investigation exam dumps are below.

Page 1 of 6

1. Which of the following types of information would LEAST LIKELY be found when searching external sources without the subject's consent or a legal order?

A witness's address

Assets owned by a subject

A subject's employee personnel file

A competitor's ownership information

2. Which of the following data analysis functions is used to determine whether company policies are met by employee transactions, such as verifying that traveling employees book their accommodations at approved hotels?

The correlation analysis function

The Join function

The gap testing function

The compliance verification function

3. Sam needs to obtain the most accurate court records possible in a particular jurisdiction concerning a fraud suspect. The BEST place for Sam to look is a global database that compiles court cases from various jurisdictions

True

False

4. Orlando is conducting a fraud examination regarding Fast Freight, a large publicly traded corporation, and wants to find the current officers and directors of the company .

Which of the following would be the best source of information for this purpose?

Commercial filings

Real property records

The company's corporate bylaws

Regulatory securities records

5. Caroline, a fraud examiner, is conducting an admission-seeking interview with John, an employee suspected of stealing cash .

Which of the following is the MOST effective phrasing for Caroline to use when posing an admission-seeking question to John?

"Why did you take the money?"

"What do you know about the stolen money?"

"Do you know who took the money''"

"Did you steal the money?"

6. Assuming that a jurisdiction has prohibited pretexting with financial institutes, which of the following actions would constitute illegal pretexting?

Withdrawing another person's funds using a stolen bank account number and PIN

Digging through a person's trash to obtain their bank account information

Making purchases with a credit card account under a fictitious identity

Falsely claiming to be the spouse of an account holder to access bank records

7. Which of the following data is the MOST DIFFICULT to recover during a digital forensic examination?

Time and date information about files

Websites visited

Files that have been overwritten

Communications sent via instant messenger

8. Which of the following is INCORRECT with regard to locating individuals using online records?

Before engaging in a search the fraud examine' should know the mod powerful and useful '>Des of searches

If an individual has moved, obtaining a past address is usually of no help

Online records are very useful in locating subjects whose whereabouts are unknown

Obtaining a past address of the subject should be the first step in trying to locate a subject using online records.

9. Which of the following statements is MOST ACCURATE regarding covert operations?

Fraud examiners should conduct coven operations only after attempting conventional methods of evidence-gathering

Mistakes in covert operations generally do not cause damage to their associated investigations

Covert operations rarely prove beneficial to investigations even when planned properly.

Most jurisdictions provide protections for investigators conducting covert operations that shield them from reputational, financial, and legal consequences.

10. Which of the following sources of information is usually considered to be the MOST IMPORTANT in tracing a subject's assets?

Credit card statements

PaystuDs

Surveillance footage

Financial institution records

Page 2 of 6

11. Arnold, a Certified Fraud Examiner (CFE) for Integra Wealth, learns that Elizabeth, an accounts payable clerk, recently purchased an expensive ski boat Arnold also knows that Elizabeth recently purchased a vacation home on a nearby lake Arnold has sufficient predication to:

Notify management of the possibility that Elizabeth has committed fraudulent acts

Search Elizabeth's mobile phone for evidence of misconduct.

Accuse Elizabeth directly of having committed fraud

Conduct discreet inquiries into Elizabeth's responsibilities as an accounts payable clerk

12. Which of the following is the MOST ACCURATE statement regarding the analysis phase in digital forensic investigations?

The analysis phase of digital forensic investigations should not commence unless it is verified that the suspect devices do not contain relevant data.

During the analysis phase, it is best to use a combination of the various forensic tools that can assist h identifying, extracting, and collecting digital evidence

When analyzing data for evidence, fraud examiners should look for exculpatory evidence but not exculpatory evidence

The primary concern when analyzing digital evidence is to protect the collected information from seizure

13. Which of the following should be done to prepare an organization for a formal fraud investigation?

Inform the subject that they are under investigation.

Issue an organization-wide communication that notifies all employees about the investigation

Notify all managers about the investigation, explaining why it is happening and who is involved.

Prepare the managers of the employees who will be involved in the investigation

14. When planning for the interview phase of an investigation, which of the following steps should NOT be taken by the fraud examiner?

Consider what the interview is intended to accomplish and state an objective.

Review the case file to ensure that important information has not been overlooked

Prepare a detailed list of questions to ask the subject during the interview.

Ensure that the interview is held in a venue where the subject will feel Uncomfortable

15. Eugene is conducting an admission-seeking interview of a suspect. During the interview, the suspect frequently looks away from Eugene while responding to questions. Eugene can safely conclude that the suspect is dishonest due to his failure to maintain eye contact.

True

False

16. During an interview, Alex asked a fraud suspect if he could retrieve the suspect's account records from her bank. The suspect said, "yes." but she did not provide consent in writing

Although the suspect orally consented, the suspect's bank is NOT required to allow Alex to access the suspect's account records at this point.

True

False

17. Elizabeth, a Certified Fraud Examiner (CFE), is conducting an admission-seeking interview with Shannon, a fraud suspect. Shannon is seated approximately five feet away from Elizabeth in an empty room. The room has several pictures and posters on the wall, and the door is closed.

According to admission-seeking interview best practices, what change should Elizabeth make to the interview environment to increase the chances of the interview's success?

Move the interview to a room without pictures or wall hangings to prevent distractions

Open the door so that Shannon feels free to leave at any time

Place a table between her and Shannon to create a psychological barrier

All of the above

18. Why is it necessary to image a seized computer's hard drive for forensic analysis?

To prohibit access to the suspect computer's hard drive by individuals not professionally trained in forensic analysis

To allow for the analysis of data from a suspect computer without altering or damaging the original data in any way

To create pictures of the suspect computer system and its wires and cables

To enable the retrieval of data from the suspect computer directly via its operating system

19. A fraud examiner believes that a suspect might have used illicit funds to construct a commercial building to fit a restaurant .

Which of the following records would be the MOST helpful in confirming the owner of the building?

Local court records

Commercial filings

Building permit records

Voter registration records

20. Cynthia is preparing to conduct a covert investigation. Prior to conducting surveillance of her subject, she creates a memorandum outlining the basis for her operation.

Which of the following pieces of information should she include in her memorandum?

The name of the subject she will be observing

Her first impression regarding the subject's culpability

The identities of any confidential sources to be used in the operation

All of the above

Page 3 of 6

21. Which of the following statements is MOST ACCURATE regarding how a fraud examiner should prepare for an interview with a subject from a different jurisdiction?

A fraud examiner does not need to research cultural considerations such as personal space and eye contact.

A fraud examiner should find out whether there are limitations on the use of information obtained during an interview

Failing to observe cultural norms is not a concern if the interviewer is from a different country than the interviewee

Consulting with legal counsel is only necessary when an investigation spans multiple junsdictions

22. Jackson, a digital forensic examiner for a government agency, is conducting a criminal investigation into the alleged embezzlement of funds from the government's Welfare Department (WD). Ginny. a WD employee, is the prime suspect. Jackson obtains a court order authorizing him to seize Ginny's personal computer for forensic examination .

Which of the following is the MOST ACCURATE statement?

If Ginny's computer is running. Jackson should perform a graceful shutdown by turning it off using the normal shutdown process

If Ginny’s computer is off and Jackson needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interface.

If Ginny's computer is off. Jackson should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

If Ginny's computer is running. Jackson may retrieve data from the computer directly via its normal interface if the evidence that he needs exists only in the form of volatile data

23. Which of the following is the MOST ACCURATE statement about trying to locate a subject using online records?

Most public records services do not maintain a list of past addresses

Obtaining a past address of the subject should be the first step in trying to locate a subject using online records

The first step in locating someone using online records is to obtain a list of past employers

Online records are generally not useful in locating subjects whose address is unknown

24. The term_____________refers to a process of resolving allegations of fraud from inception to disposition.

Fraud theory

Forensic investigation

Fraud management

Fraud examination

25. Which of the following can be obtained from a wire transfer record?

The name of the receiving institution's registered agent

The recipient's government identification number

The name of the sender or originator

The sending institution's accreditation type

26. Which of the following is TRUE of a follow-up/recommendations section in a written fraud examination report?

A follow-up/recommendations section is not a required part of every written fraud examination report

A follow-up/recommendations section calculates the amount of loss caused by any misconduct identified during the investigation

A follow-up/recommendations section must include a list of organizational failings that contnbuted to the fraud

All of the above

27. Which of the following is a reason why a person or organization might engage a fraud examiner to trace illicit transactions?

A victim of fraud wants to facilitate the recovery of criminal proceeds.

An employer wants to know if an employee is falsifying regulatory reports

An attorney wants to evaluate an expert's financial report

An entity needs to find hidden relationships in big data that otherwise would not be discovered.

28. Susan, a Certified Fraud Examiner (CFE). is conducting an ad mission-seeking interview of Beth, a fraud suspect. After Susan gave Beth a suitable rationalization for her conduct. Beth continued her denials, giving various alibis .

Which of the following would be the LEAST EFFECTIVE technique for Susan to use in this situation?

Displaying evidence that specifically contradicts Beth's alibis

Discussing some of Beth's prior deceptions

Discussing the testimony of other witnesses

Displaying all the evidence she has against Beth at once

29. Charles, a fraud examiner, accuses George of fraud during an admission-seeking

interview. George immediately denies the charge How should Charles respond to George's denial?

Counter the denial by arguing with George until further denials are futile

Use a delaying tactic to interrupt the denial

Remind George he has to tell the truth or face perjury.

Allow George to continue denying the charge.

30. Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of Lucas, a construction company executive, for alleged bribery of foreign officials Nobles obtains a court order authorizing him to seize Lucas's personal computer for forensic examination .

Which of the following is the MOST ACCURATE statement?

If Lucas's computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data

If Lucas's computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interlace.

If Lucas's computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

If Lucas's computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process

Page 4 of 6

31. Which of the following BEST describes the data analytics approach known as predictive analytics?

The employment of a learning algorithm that identifies similarities, patterns, or anomalies within a data set on its own, without human involvement

The configuration of a business program to emulate and integrate the actions of a human to execute certain business processes thus increasing efficiency and automating repetitive manual tasks

The use of historical data, along with analyses, statistics, and machine learning components, to build a mathematical model that captures important trends and creates a quantitative forecast

The use of layered artificial neural networks to accommodate more data and more sophisticated algorithms to identify complex patterns

32. Which of the following types of files is the most difficult to recover during a digital forensic examination?

Overwritten files

Deleted until

Deleted link (shortcut) files

Hidden files

33. Which of the following situations would MOST LIKELY require access to nonpublic records to develop evidence?

Finding out where a person lives

Reviewing an individual's personal mobile phone records

Obtaining a company's business filings

Determining who owns a piece of real estate

34. Jade, a Certrfied Fraud Examiner (CFE). is conducting an internal investigation in which an employee is suspected of stealing inventory and selling it through a possible shell company called Hidden Finds. LLC. When Jade tries to check Hidden Finds' website, a message appears that redirects customers to a web address that ends with onion.

To view the website's content. Jade will need to install a specialized web browser that enables her to access which of the following?

The deep archives

The free web

The dark web

The internet archives

35. Gunn, a Certified Fraud Examiner (CFE). was hired to trace Kelly's financial transactions. During his investigation. Gunn obtains records of electronic payments that Kelly made during the past three years .

Which of the following are these records MOST LIKELY to reveal?

If Kelly has been skimming funds

The cities and countries in which Kelly conducts business

The division and distribution of Kelly's assets

The market value of any real property Kelly owns

36. Anne used Will as a confidential informant in her investigation Anne listed information provided by Will in her final report, referring to him using his initials. She paid Will in cash and obtained a receipt for the transaction .

Which of Anne's methods was NOT considered a best practice when using informants?

Referring to Will using his initials

Obtaining a receipt from Will

Using information provided by Will in her report

Using cash to pay Will

37. Which of the following is a reason why a subject's credit card records are useful in tracing investigations?

Credit card statements show source of the funds used to pay a credit card bill

Credit card records show the movements and habits of the subject

Credit card records provide insight into the subject's litigation history

Credit card records contain information about the division and distribution of the subject's assets

38. Vishal, a Certified Fraud Examiner (CFE). has just initiated an interview with Steve, a fraud suspect. After a short introduction. Vishal jokes about the fact that he and Steve are wearing the same tie and then proceeds to ask Steve about the previous night's major sporting event Vishal is attempting to

Establish the interview theme

Condition the witness.

Establish rapport

Exhibit passive listening.

39. Which of the following is the MOST IMPORTANT question for a fraud examiner to ask before commencing a legal action to recover assets?

"Is there a relevant statute of limitations9"

"Does the suspect already have a criminal record?"

"Is the suspect guilty of the fraudulent act?''

"Are nonlegal recovery methods or remedies available?''

40. Shane, a Certified Fraud Examiner (CFE). is investigating Larsen. who is active on various social networking sites. Shane wants to search and extract information from Larson's social media postings so that it can be used in court as evidence.

Which of the following is the MOST ACCURATE statement regarding what Shane should do when conducting a social media investigation of Larsen?

Shane should conduct a forensic shutdown of his computer to preserve the metadata in the social networking sites.

Shane should preserve the information from the social networking sites so that it can be established as authentic if used in court.

Shane should email himself the links of the postings so that he can retrieve them later.

Shane should preserve the information by saving the links of the postings in his 'bookmarks"

Page 5 of 6

41. Baker, a Certified Fraud Examiner (CFE). contacts Dierdre for the purpose of conducting a routine, information-gathering interview Dierdre expresses a desire that her coworker.

Matthew, whom Baker also plans to interview, be interviewed at the same time Baker should:

Interview Dierdre and Matthew separately.

Interview Dierdre and Matthew at the same time, but bring in a second interviewer

Interview Dierdre and Matthew at the same time by himself

Allow Matthew to be present as a silent observer.

42. Which of the following is NOT a step a fraud examiner must take before seizing evidence in a digital forensic investigation?

Obtain and become familiar with any legal orders that apply to the investigation

Assemble an investigation team comprised only of outside digital forensic experts

Ensure that only trained professionals employ any software used in a forensic capacity

Determine whether there are privacy issues related to the item(s) to be searched.

43. Al needs to know the location of the principal office and the initial shareholders of a company he is investigating .

Which of the following would be the BEST source of this reformation?

The organizational filings with the government of the jurisdiction in which the company is incorporated

The contractual documents regarding real properly owned by the corporation

The utility records in the municipality where the corporation has its principal office

The shareholder data form filed with the World Bank

44. If your suspect is spending suspected illicit funds on consumables (e.g.. travel and entertainment) and you need to prove their illicit income circumstantially, which of the following methods of tracing assets would yield the BEST result?

expenditures method

The consumables method

The income method

The asset method

45. Marilyn, a Certified Fraud Examiner (CFE). is reasonably sure that Shelly, her primary suspect, committed the fraud in question Before scheduling an admission-seeking interview with Shelly. Marilyn should be reasonably sure of all of the following EXCEPT:

That all reasonable investigative steps have been taken

That the interview's time and location can be controlled

That no other person was involved in the fraud in question

That the interview's subject matter can be controlled

46. Tara. a Certified Fraud Examiner (CFE). is searching social media sites for evidence in a fraud investigation .

Which of the following is the MOST ACCURATE statement regarding what Tara should do when mining social media sites for evidence of fraud?

Tara should preserve the information by saving the links of the postings as bookmarks in her browser.

Tara should preserve the metadata by printing out the web pages of each of the postings.

Tara should conduct a forensic shutdown of the computer to preserve the metadata m the social networking sites.

Tara should preserve the information from the sites so that it can be established as authentic if used in court.

47. Andrew wants to use a confidential informant in his investigation. He plans to compensate the informant with cash and obtain a receipt. He also plans to identify his source in a memorandum and his final report using only the informant's initials .

Which of Andrew's plans is NOT considered a best practice when using an informant?

Referring to the informant in the memorandum using the informant's initials

Using information from the informant in his final report

Creating a receipt regarding the cash payment

Compensating the informant with cash

48. Which of the following is NOT one of the main limitations of conducting a search for public records using online databases?

Online public records searches are limited in the jurisdictions they cover.

Public records database companies are difficult to find.

Online coverage of public records varies widely from jurisdiction to jurisdiction

The timeliness and accuracy of information in online databases must be validated

49. Which of the following is the MOST ACCURATE statement about the privacy of information shared through social media?

To access any user-posted information on social media sites, fraud examiners must obtain some type of legal order from the jurisdiction in which the user resides.

A fraud examiner cannot be held liable for violating a user's privacy rights if they hack or break into areas of a social networking site designated as private because all social media information is public.

The Privacy of Social Networks Treaty is a binding international treaty that makes it illegal for law enforcement to seek social media log-in credentials from users.

Hacking or breaking into information on social media sites that is restricted as private could result in liability for fraud examiners due to violation of users' privacy rights.

50. Which of the following statements concerning access to nonpublic records is MOST ACCURATE?

Once a criminal case is filed, all records obtained by the government are considered public records

Nonpublic records cannot be obtained by subpoena or legal order in a civil action

In most junsdictions. banks are allowed to turn over a suspect's account information directly to a fraud victim when there is adequate evidence of wrongdoing.

The government usually will not share nonpublic records with a fraud victim during an investigation into the underlying fraud.

Page 6 of 6

51. Which of the following is a measure that can help avoid alerting suspected perpetrators who are under investigation?

Terminate the suspected employee.

Notify everyone in the affected department

Delay taking any action.

Inform only those who need to know.

Certified Fraud Examiner – Investigation Exam CFE Investigation Dumps

Certified Fraud Examiner – Investigation Exam CFE Investigation Dumps

Share this post

Leave a Reply Cancel reply

Related Posts

Microsoft MB-820 Exam Dumps – Microsoft Dynamics 365 Business Central Developer

SAP Certified Application Associate C_BYD15_1908 Exam Guides

Online CTAL-TTA Exam Dumps Help You Study All Related Skills