CFE-Investigation

Question 0

Blue is conducting an admission-seeking interview of Red. Blue asked Red: “Did you just want extra money, or did you do this because you had financial problems?” This is called a(n):

Answer 0

An alternative question.

Question 1

During the introductory portion of an interview, the interviewer must state the purpose of the interview in a general way. This is known as:

Answer 1

Establishing the interview theme.

Question 2

Simone is suspected of financial statement fraud. During an admission-seeking interview with Simone, the investigator states: “A lot of employees count on the company doing well. I know you only did this to help the company succeed. Isn’t that right?” This technique is known as:

Answer 2

Altruism

Question 3

An admission-seeking interview is specifically designed to:

Answer 3

Obtain a legal admission of wrongdoing

Question 4

The goal of establishing an interview theme should be to:

Answer 4

Get the respondent to make a commitment to assist before commencing serious questioning.

Question 5

What is typically the most effective way to document chain of custody for a piece of evidence?

Answer 5

A memorandum with the custodian of the evidence when the evidence is received.

Question 6

Jeff is accused of skimming money from the register. During an admission-seeking interview with Jeff, the investigator states: “This is a huge corporation with more than a hundred stores, so it’s not like a few bucks here and there is going to affect anyone personally. Is that how you saw it?” This technique is known as:

Answer 6

Depersonalizing the victim.

Question 7

Introductory questions are designed to meet four objectives:

Answer 7

To provide an introduction, to establish rapport, to get the respondent to agree verbally to cooperate in the interview (i.e., establish the interview theme), and to observe the respondent’s reactions to questions.

Question 8

What are some types of information deemed to be public under the Freedom of Information Act (FOIA)?

Answer 8

Telephone records, stock ownership records, trust records.

Question 9

What is the term that refers to the net amount a lender disburses to a borrower under the terms of a loan agreement?

Answer 9

Loan proceeds.

Question 10

Where would an investigator likely find a record of a divorce?

Answer 10

County court in the jurisdiction where the divorce was granted.

Question 11

Able, a CFE, asked the following question: “Since you were here when the controls were developed, can you tell me how they came about?” This kind of question is called a

Answer 11

Controlled answer technique

Question 12

Which of the following is generally NOT a recommended practice when organizing documents/evidence?

Answer 12

File all papers chronologically.

Question 13

Which of the following best describes the primary purpose of the Right to Financial Privacy Act?

Answer 13

To prohibit financial institutions from disclosing financial information about individual customers to government agencies without consent or a judicial order

Question 14

Bill wants to search the Internet for articles about check fraud using a search engine. Which of the following search strings will yield the best results?

Answer 14

intitle:check fraud

Question 15

To stimulate conversation during the information phase of the interview, the interviewer should ask:

Answer 15

Open questions that call for a monologue response

Question 16

Darren is conducting a fraud examination of Cooper, at a government entity. Darren has strong reason to believe that Cooper has incriminating evidence on a personal smart phone that he brings to work. Which of the following statements is most accurate?

Answer 16

Darren may search the phone if his organization has a privacy policy informing employees that personal smart phones are subject to search.

Question 17

_____________ is a method of using software to extract usable information from unstructured data.

Answer 17

Textual analytics

Question 18

If permitted by law, a suspect’s Social Security number can most easily be obtained through which of the following online searches?

Answer 18

Credit bureau header search

Question 19

In interviews involving anxiety and uncertainty, individuals might perform displacement activities that reduce nervousness. These types of displacement activities are known as:

Answer 19

Manipulators.

Question 20

What is a data analysis tool that is effective in identifying indirect relationships and relationships with several degrees of separation?

Answer 20

Link analysis.

Question 21

When conducting an interview, there are five general types of questions an interviewer can ask:

Answer 21

Introductory, informational, assessment, closing, and admission-seeking. CAASII

Question 22

There is no legal requirement that a statement:

Answer 22

Be in the handwriting or wording of the declarant.

Question 23

Fraud examination is best described as:

Answer 23

A methodology for resolving fraud allegations from inception to disposition.

Question 24

What is the facilitator of communication that refers to an individual's need for the esteem of others?

Answer 24

Recognition.

Question 25

Items located at a time when they could not have existed or occurred:

Answer 25

Anachronisms.

Question 26

Examples of data analysis queries that can be performed by data analysis software on payroll accounts to help detect fraud:

Answer 26

Summarize payroll activity by specific criteria for review, Identify changes to payroll or employee files, Compare timecard and payroll rates for possible discrepancies, Prepare check amount reports for amounts over a certain limit and check proper supervisory authorization on payroll disbursements.

Question 27

In interview situations, ___________ are questions that often suggest an answer opposite to the correct one.

Answer 27

Double negative.

Question 28

What law governs the dissemination of an individual's credit information to third parties by consumer reporting agencies?

Answer 28

Federal Credit Reporting Act.

Question 29

Baker is attempting to obtain information about a fraud suspect from a local bank. The records of the bank are covered by which federal law?

Answer 29

Right to Financial Privacy Act.

Question 30

What best describes the primary purpose of the Right to Financial Privacy Act?

Answer 30

To prohibit financial institutions from disclosing financial information about individual customers to government agencies without consent or a judicial order.

Question 31

A fraud examiner discovers a paper document that he believes has both the suspect's indented writings and latent fingerprints on it. Which of the following is the BEST preservation method for him to use when collecting the document?

Answer 31

Place the document into a plastic bag while handling it with protective gloves.

Question 32

In interview situations, ______________ communication is the use of interpersonal space to convey meaning.

Answer 32

Proxemic.

Question 33

The primary concern when analyzing digital evidence is to:

Answer 33

maintain the integrity of the data at all times.

Question 34

A Uniform Commercial Code (UCC) filings search can help identify:

Answer 34

Personal property that an individual or business has financed.

Question 35

A fraud examiner is preparing his full case report at the conclusion of a fraud investigation. When including information regarding the interviews conducted during the examination, the fraud examiner should:

Answer 35

Report the details of each witness interview in a separate memorandum of interview.

Question 36

A fraud examiner is conducting textual analytics on journal entry data and runs a keyword search using the terms override, write off, and reserve. Which leg of the fraud triangle are these fraud keywords typically associated with?

Answer 36

Opportunity.

Question 37

Text-based data is typically considered:

Answer 37

Unstructured data.

Question 38

Understanding the data, determining whether predication exists, and building a profile of potential frauds are all steps of which phase of the data analysis process?

Answer 38

The planning phase

Question 39

What is a method of tracing illicit funds in which deposits to financial institutions are compared to legitimate income?

Answer 39

Bank deposit analysis method

Question 40

The terms induction and deduction are most often associated with which inhibitor to communication?

Answer 40

Inferential confusion..

Question 41

Green, a Certified Fraud Examiner, is conducting an admission-seeking interview of Brown, a fraud suspect. Brown has confessed to having committed the fraud, but he is denying anyone else was involved. However, Green knows this is untrue. What should Green do next?

Answer 41

Proceed as if the falsehood has been accepted as truth and return to it later.

Question 42

Symbols and words—such as the plus sign, the minus sign, and the words "and" and "not"—that help search engines better understand exactly what the user is looking for are known as which of the following?

Answer 42

Boolean operators

Question 43

Which of the following steps takes place during the preparation phase of a data analysis engagement?

Answer 43

Cleansing and normalizing the data

Question 44

During which phase of the data analysis process does the fraud examiner identify, obtain, and verify the relevant or requested data?

Answer 44

The preparation phase

Question 45

Graphology (or graphoanalysis) has been described as a

Answer 45

pseudoscience in which its practitioners have the purported ability to determine a person's character, moral traits, personality, and mental state based upon an analysis of that person's handwriting. It is is often erroneously confused with forensic document examinations, especially by the media.

Question 46

A formal request by the courts of one country seeking judicial assistance from the courts of another country is known as a:

Answer 46

Letter rogatory.

Question 47

As a general rule, the more intelligent the respondent,

Answer 47

the more reliable verbal and nonverbal clues will be.

Question 48

Gamma, a CFE, is conducting an investigation involving ABC Company, a publicly traded company. If Gamma requests ABC's annual financial report from the (SEC), the information will be contained on which of the following SEC forms?

Answer 48

10-K

Question 49

Surprise should be employed in any interview that is considered:

Answer 49

Potentially volatile.

Question 50

Which of the data analysis functions is most useful in testing for hidden journal entries?

Answer 50

Gap testing.

Question 51

Process of hiding one piece of information within an apparently innocent file is called:

Answer 51

Steganography.

Question 52

Sensitive questions should be:

Answer 52

Scrupulously avoided until well into the interview. Even then, such questions should be asked only after careful deliberation and planning.

Question 53

When seizing a computer that is running, the seizing party should not:

Answer 53

Perform a graceful shutdown by turning it off using the normal shutdown process. If a system is turned off using normal shutdown routines, a number of temporary files will be deleted and possibly overwritten during the shutdown process, and such files might be important to the investigation.

Question 54

Most commonly, leading questions are used to:

Answer 54

Confirm facts already known.

Question 55

What refers to the inhibitor to communication in which the respondent confuses the order or timeline of experiences?

Answer 55

Chronological confusion

Question 56

A(n) _____________ is a type of visual aid, in the form of a grid, that shows the relationship (or points of contacts) between a number of entities.

Answer 56

Matrix.

Question 57

When tracing financial transactions, the method that involves using the subject's books and records to analyze the relationship between the subject's receipt and subsequent disposition of funds or assets is called?

Answer 57

The direct method.

Question 58

Multi-file processing

Answer 58

is a data analysis software function that allows users to relate several files by defining relationships in collected data, without the use of the join command.

Question 59

Inferential confusion denotes:

Answer 59

confusion and inaccuracies resulting from errors of inference.

Question 60

Used in or suitable to courts of law or public debate is the definition of:

Answer 60

Forensic.

Question 61

The totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe that fraud has occurred:

Answer 61

Predication.

Question 62

The actions an organization will take when suspicion of fraud have arisen:

Answer 62

Fraud response plan.

Question 63

The steps a company takes to employees to suspend the destruction of potentially relevant records when the duty to preserve information arises is called:

Answer 63

A litigation hold.

Question 64

Protects tangible materials that are prepared in anticipation of litigation:

Answer 64

Work product doctrine.

Question 65

Two types of evidence:

Answer 65

Direct and circumstantial.

Question 66

Unintentional changes to a person's writing that are beyond his/her normal variations are called:

Answer 66

Distortions.

Question 67

A true name signature by an individual who intends to deny that signature at a later time is called:

Answer 67

Autoforgery.

Question 68

The following is a common use of public records in fraud examinations:

Answer 68

Tracing and recovering assets.

Question 69

Blue, a Certified Fraud Examiner, has just begun an interview of White. After introducing himself and establishing rapport with White, what should Blue do next?

Answer 69

Establish the interview theme.

Question 70

An example of a data analysis function that can be performed to help detect fraud through examination of payroll accounts?

Answer 70

Identify paycheck amounts over a certain limit.

Question 71

To show that the subject's assets or expenditures exceed his reported income an investigator could use the:

Answer 71

Net-worth analysis.

Question 72

Canceled checks written on a subject's account can:

Answer 72

reveal other bank accounts belonging to the subject.

Question 73

The rules of admissibility for digital evidence are:

Answer 73

Different, but not stricter than such rules for tangible evidence.

Question 74

Is a method of tracing illicit funds in which deposits to financial institutions are compared to legitimate income:

Answer 74

Bank deposit analysis method

Question 75

Under the Fair Credit Reporting Act, an employer does not need an employee's consent to access the employee's credit report if:

Answer 75

the report is obtained as part of an investigation into suspected employee misconduct.

Question 76

Suppose you need to prove a suspect's illicit income circumstantially. Which of the following methods of tracing assets would yield the best result when the suspect is spending his illicit funds on items that would not cause an increase in net worth, such as travel and entertainment?

Answer 76

The expenditures method.

Question 77

Which of the following is a type of information that can be obtained from the historical Web?

Answer 77

Web content posted on a website that has been removed.

Question 78

When an individual purchases real estate, he becomes a registrant in which of the following records?

Answer 78

Tax assessor records, real property records, and property tax records.

Question 79

________ is a data analysis software function that allows users to relate several files by defining relationships in collected data, without the use of the join command.

Answer 79

Multi-file processing.

Question 80

Suppose you suspect there is a ghost employee scheme taking place in your organization and you want to compare the payroll records to the employee master file. Which data analysis technique would you use to match these two data records?

Answer 80

The join function.

Question 81

Which of the following witnesses should be interviewed by surprise?

Answer 81

Volatile.

Question 82

Which of the following computer events logs records events executed on an operating system, such as starting up and shutting down, configuration updates, and system crashes?

Answer 82

System log.

Question 83

It sends user requests to several other search engines and aggregate the results for display:

Answer 83

Metasearch engines.

Question 84

It can be used to visually map connections between entities that share an address:

Answer 84

Link analysis.

Question 85

In interviews, ______________ communication involves the use of volume, pitch, and voice quality to convey meaning.

Answer 85

Paralinguistic

Question 86

The historical Web refers to archived pages that:

Answer 86

have since been updated or are no longer available online.

Question 87

When preparing a room for an admission-seeking interview, the suspect's chair should be:

Answer 87

Within full view of the interviewer.

Question 88

Blue, a nonunion suspect, arrived at an admission-seeking interview with his manager and insisted that the manager be allowed to sit in. Should this interview be allowed to continue?

Answer 88

No, because the presence of a third party could have liability consequences.

Question 89

Using the correlation analysis function, investigators can determine the relationships between:

Answer 89

different variables in the raw data.

Question 90

It is a process by which countries request and provide assistance in criminal law enforcement matters.

Answer 90

Mutual legal assistance (MLA)

Question 91

These types of questions seek to establish the credibility of the respondent.

Answer 91

Assessment.

Question 92

Suppose you need to prove a suspect's illicit income circumstantially. Which of the following methods of tracing assets would yield the best result when the suspect is using his illicit funds to accumulate wealth and acquire assets, thus causing his net worth to increase?

Answer 92

The asset method.

Question 93

Which of the following is an example of a data analysis function that can be performed to detect fraud through examination of accounts payable?

Answer 93

Identify debits to expense accounts outside of set default accounts.

Question 94

A data analysis function that determines whether company policies are met by employee transactions (EX: expenditure accounts)

Answer 94

Compliance verification.

Question 95

It establishes a code of information practices that regulates the collection, maintenance, consumption, and distribution of personally identifiable information that is maintained by federal agencies

Answer 95

Privacy Act of 1974

Question 96

In interview situations, ______________ is defined as a "relation marked by harmony, conformity, accord, or affinity."

Answer 96

Rapport

Question 97

Suppose you suspect there is a ghost employee scheme taking place in your organization and you want to compare the payroll records to the employee master file. Which data analysis technique would you use to match these two data records

Answer 97

The join function.

Question 98

Which of the following is a recommended tactic for interrupting an accused's denials during an admission-seeking interview?

Answer 98

Delays, interruptions, and reasoning.

Question 99

The net-worth analysis method of tracing illicit funds is recommended as a primary method of proof when most of the subject's income is deposited in a financial institution and the subject's books and records are unavailable, withheld, incomplete, or maintained on a cash basis.

Answer 99

False, answered incorrectly on practice exam.

Question 100

Which of the following is a good practice for taking notes during an interview?

Answer 100

Avoid making notes regarding opinions or impressions about a witness.

Question 101

When determining a subject's net worth for asset-tracing purposes, all assets should be valued at current market value to eliminate any question about estimates.

Answer 101

False, answered incorrectly on practice exam.

Question 102

In interview situations, it is usually advisable to err on the side of taking too many notes rather than too few.

Answer 102

False, answered incorrectly on practice exam.

Question 103

Which of the following is a type of information that can be obtained from the deep Web?

Answer 103

Websites without any links pointing to them