Pre-Summer Sale 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exams65

ExamsBrite Dumps

Certified Fraud Examiner (CFE) - Investigation Question and Answers

Certified Fraud Examiner (CFE) - Investigation

Last Update Apr 15, 2026
Total Questions : 181

We are offering FREE CFE-Investigation ACFE exam questions. All you do is to just go and sign up. Give your details, prepare CFE-Investigation free exam questions and then go for complete pool of Certified Fraud Examiner (CFE) - Investigation test questions that will help you more.

CFE-Investigation pdf

CFE-Investigation PDF

$36.75  $104.99
CFE-Investigation Engine

CFE-Investigation Testing Engine

$43.75  $124.99
CFE-Investigation PDF + Engine

CFE-Investigation PDF + Testing Engine

$57.75  $164.99
Questions 1

Which of the following is NOT one of the main limitations of conducting a search for public records using online databases?

Options:

A.  

Online public records searches are limited in the jurisdictions they cover.

B.  

Public records database companies are difficult to find.

C.  

Online coverage of public records varies widely from jurisdiction to jurisdiction

D.  

The timeliness and accuracy of information in online databases must be validated

Discussion 0
Questions 2

Bobbie, a fraud examiner, is preparing to interview Craig, a close friend and coworker of the primary suspect in the case. Craig has been described by others as "easily angered" and "intense" How should Bobbie approach her interview of Craig?

Options:

A.  

Provide Craig with plenty of notice prior to the interview to not provoke resentment

B.  

Conduct the interview with as little notice as possible so Craig will be unprepared

C.  

Ask Craig when ho would prefer to be interviewed in an effort to engender cooperation

D.  

Avoid interviewing Craig if possible due to Craig's potential volatility

Discussion 0
Questions 3

Which of the following is a reason why a subject's credit card records and statements can be useful in tracing investigations?

Options:

A.  

Credit card records can provide leads to help identify a subjects hidden assets

B.  

Credit card records can show signs that the subject has skimmed funds.

C.  

Credit card statements show the source of the funds used to pay a credit card bill.

D.  

Credit card statements provide insight into the subject's litigation history

Discussion 0
Questions 4

Which of the following is NOT an advantage to using link analysis in a fraud investigation?

Options:

A.  

Link analysis visually displays financial ratio analysis

B.  

Link analysis is an affective tool to demonstrate complex networks

C.  

Link analysis helps identify indirect relationships with several degrees of separation.

D.  

Link analysis allows the investigator to discover patterns in data.

Discussion 0
Questions 5

Which of the following statements about how fraud examiners should approach fraud examinations is FALSE?

Options:

A.  

In most examinations, fraud examiners should start interviewing the least involved candidates and proceed toward those who are potentially more involved.

B.  

When conducting fraud examinations, fraud examiners should start with specific details and move toward more general information.

C.  

When conducting fraud examinations, fraud examiners should adhere to the fraud theory approach.

D.  

When conducting fraud examinations, fraud examiners should begin with general information that is known and then move to the more specific details.

Discussion 0
Questions 6

Martin, a fraud examiner, is conducting an interview of Stephanie, a fraud suspect. Although Stephanie heard all of the questions during the introductory part of the interview, she began asking Martin to repeat almost every question when they became more focused If Stephanie is being deceptive, which of the choices below is MOST LIKELY the cause of Stephanie's behavior?

Options:

A.  

Stephanie is testing Martin to determine whether he is able to ask consistent questions

B.  

Stephanie is trying to make sure she understands the question so that she will not make a misstatement.

C.  

Stephanie is delaying the answer so that she has more time to think of what to say.

D.  

Stephanie is having trouble recalling the events or details related to Martin's questions.

Discussion 0
Questions 7

Anne used Will as a confidential informant in her investigation Anne listed information provided by Will in her final report, referring to him using his initials. She paid Will in cash and obtained a receipt for the transaction. Which of Anne's methods was NOT considered a best practice when using informants?

Options:

A.  

Referring to Will using his initials

B.  

Obtaining a receipt from Will

C.  

Using information provided by Will in her report

D.  

Using cash to pay Will

Discussion 0
Questions 8

Naveed, a fraud suspect, has decided to make an admission to Omar, a Certified Fraud Examiner (CFE). Which of the following items of information should Omar obtain from Naveed during the verbal admission?

Options:

A.  

A general estimate of the amount of money involved in the fraud

B.  

Facts about the fraud known to co-conspirators and witnesses

C.  

A statement from Naveed indicating that his conduct was an accident

D.  

Controls that would have prevented Naveed from committing the fraud

Discussion 0
Questions 9

Marilyn, a Certified Fraud Examiner (CFE). is reasonably sure that Shelly, her primary suspect, committed the fraud in question Before scheduling an admission-seeking interview with Shelly. Marilyn should be reasonably sure of all of the following EXCEPT:

Options:

A.  

That all reasonable investigative steps have been taken

B.  

That the interview's time and location can be controlled

C.  

That no other person was involved in the fraud in question

D.  

That the interview's subject matter can be controlled

Discussion 0
Questions 10

In response to an accusation made during an admission-seeking interview, the subject begins to voice a denial to the charge. How should the interviewer react to the first indication of a subject's denial?

Options:

A.  

Allow the subject 1o continue denying the charge

B.  

Argue the point directly with the subject until a confession is obtained

C.  

Remind the subject of the laws against perjury.

D.  

Interrupt the denial by using a delaying tactic.

Discussion 0
Questions 11

Jackson, a digital forensic examiner for a government agency, is conducting a criminal investigation into the alleged embezzlement of funds from the government's Welfare Department (WD). Ginny. a WD employee, is the prime suspect. Jackson obtains a court order authorizing him to seize Ginny's personal computer for forensic examination. Which of the following is the MOST ACCURATE statement?

Options:

A.  

If Ginny's computer is running. Jackson should perform a graceful shutdown by turning it off using the normal shutdown process

B.  

If Ginny’s computer is off and Jackson needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interface.

C.  

If Ginny's computer is off. Jackson should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

D.  

If Ginny's computer is running. Jackson may retrieve data from the computer directly via its normal interface if the evidence that he needs exists only in the form of volatile data

Discussion 0
Questions 12

Which of the following statements about the limitations of using online databases for public record searches is MOST ACCURATE?

Options:

A.  

Public records featured in electronic formats include too much detail to be efficiently analyzed.

B.  

Availability of public records through online databases varies widely across jurisdictions.

C.  

The public records produced by online database searches rarely contain correct information.

D.  

It is very difficult to find a legitimate online database for accessing public records.

Discussion 0
Questions 13

Marcus is trying to locate the financial statements of Acme Airlines, a multinational publicly traded corporation. Which of the following sources would be MOST EFFECTIVE for finding this information?

Options:

A.  

Commercial filings

B.  

Civil litigation records

C.  

Organizational filings

D.  

Regulatory securities records

Discussion 0
Questions 14

Jason is an investigator who is conducting an interview with Dina. a fraud suspect. After introducing himself. Jason attempts to be amiable by asking about Dina's favorite sports team and complimenting her eyeglass frames. Jason is attempting to:

Options:

A.  

Establish the interview theme.

B.  

Establish rapport.

C.  

Calibrate the witness.

D.  

Exhibit passive listening

Discussion 0
Questions 15

Which of the following questions is MOST HELPFUL for fraud examiners to ask themselves when determining the legality of electronically recording a conversation?

Options:

A.  

"Can the recording include both audio and video?

B.  

"Will the recording equipment produce a digital file?"

C.  

"Will the recorded conversation take place before or after work?"

D.  

"How long is the anticipated recording expected to last?"

Discussion 0
Questions 16

If your suspect is spending suspected illicit funds on consumables (e.g.. travel and entertainment) and you need to prove their illicit income circumstantially, which of the following methods of tracing assets would yield the BEST result?

Options:

A.  

expenditures method

B.  

The consumables method

C.  

The income method

D.  

The asset method

Discussion 0
Questions 17

Which of the following is a reason why a person or organization might engage a fraud examiner to trace illicit transactions?

Options:

A.  

A victim of fraud wants to facilitate the recovery of criminal proceeds.

B.  

An employer wants to know if an employee is falsifying regulatory reports

C.  

An attorney wants to evaluate an expert's financial report

D.  

An entity needs to find hidden relationships in big data that otherwise would not be discovered.

Discussion 0
Questions 18

Allison, a Certified Fraud Examiner (CFE). is investigating a potential procurement fraud scheme. While interviewing a subject, she asks. "Why did you choose to do business with that vendor?" This can BEST be described as a(n):

Options:

A.  

Open question

B.  

Complex question

C.  

Leading question

D.  

Closed question

Discussion 0
Questions 19

Which of the following can be obtained from a wire transfer record?

Options:

A.  

The amount of the transfer in question

B.  

The type of money order used to make the transfer

C.  

The location of the customs port of entry for the transfer

D.  

The recipient's government identification number

Discussion 0
Questions 20

Which of the following is NOT true about observing the reactions of interview subjects?

Options:

A.  

The interpretation of an interview subject's reactions requires specific skills on the part of the interviewer.

B.  

The observation of a subjects body language is often just as important as the observation of the words used by the subject.

C.  

Emotive words should be used early in the interview to observe the respondents emotional reaction.

D.  

To effectively observe reactions, an interviewer should move from less sensitive to more sensitive questions as the interview progresses.

Discussion 0
Questions 21

Which of the following statements concerning a well-written fraud examination report is MOST ACCURATE?

Options:

A.  

The report should convey all Information provided by witnesses

B.  

Only relevant facts that support the fraud allegation should be included in the report

C.  

The report writer should avoid technical jargon where possible

D.  

Signed copies of the fraud examiner's interview notes should be used to report interview details

Discussion 0
Questions 22

Which of the following statements about fraud response plans is FALSE?

Options:

A.  

A fraud response plan outlines the actions an organization will take when suspicions of fraud have arisen.

B.  

A fraud response plan should create an environment to minimize risk and maximize the potential for success

C.  

A fraud response plan must be simple to understand and administer

D.  

A fraud response plan should specify how every fraud examination should be conducted regardless of the type of fraud

Discussion 0
Questions 23

Gunn, a Certified Fraud Examiner (CFE). was hired to trace Kelly's financial transactions. During his investigation. Gunn obtains records of electronic payments that Kelly made during the past three years. Which of the following are these records MOST LIKELY to reveal?

Options:

A.  

If Kelly has been skimming funds

B.  

The cities and countries in which Kelly conducts business

C.  

The division and distribution of Kelly's assets

D.  

The market value of any real property Kelly owns

Discussion 0
Questions 24

Nathaniel, a Certified Fraud Examiner (CFE). is investigating an alleged inventory theft scheme. While interviewing a subject, he asks, "When were you promoted to manager of the department?" This can BEST be described as a(n):

Options:

A.  

Leading question

B.  

Open question

C.  

Complex question

D.  

Closed question

Discussion 0
Questions 25

Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of Lucas, a construction company executive, for alleged bribery of foreign officials Nobles obtains a court order authorizing him to seize Lucas's personal computer for forensic examination. Which of the following is the MOST ACCURATE statement?

Options:

A.  

If Lucas's computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data

B.  

If Lucas's computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interlace.

C.  

If Lucas's computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

D.  

If Lucas's computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process

Discussion 0
Questions 26

Shannon, a Certified Fraud Examiner (CFE), is conducting a fraud examination for Sand Corp. Shannon is going to perform a textual analysis on unstructured data, such as emails and instant messages. Why would Shannon perform such an analysis?

Options:

A.  

The analysis will determine whether someone is lying or telling the truth based on clues within the data.

B.  

The analysis will uncover an admission of fraud in an email or other communication that can be presented in court.

C.  

The analysis will produce a visual representation of the data collected to track the movement of money.

D.  

The analysis will categorize data to reveal patterns, sentiments, and relationships that are indicative of fraud.

Discussion 0
Questions 27

Louis, a Certified Fraud Examiner (CFE). is investigating a potential internal fraud case originating from a whistteblower tip about embezzlement. He discovers that the organization purportedly affected by the embezzlement recorded the tip in a memorandum. Which type of evidence would the memorandum be considered?

Options:

A.  

Testimonial evidence

B.  

Incriminating evidence

C.  

Documentary evidence

D.  

Verbal evidence

Discussion 0
Questions 28

After completing all necessary investigative steps. Erica, a Certified Fraud Examiner (CFE), is reasonably sure that Justine, her primary suspect, committed the fraud in question. Before scheduling an admission-seeking interview with Justine, what else should Erica be reasonably sure of?

Options:

A.  

That Justine will confess to the accusation when prompted

B.  

That Justine's employer will take disciplinary action against Justine if she confesses

C.  

That the interview's time, place, and content can De controlled

D.  

That no other person was involved in the fraud n question

Discussion 0
Questions 29

Which of the following is TRUE of a follow-up/recommendations section in a written fraud examination report?

Options:

A.  

A follow-up recommendations section is a required part of every written fraud examination report

B.  

A follow-up/recommendations section calculates the amount of fraud-related loss sustained by the organization

C.  

A follow-up/recommendations section should state remedial measures for the organization to undertake

D.  

All of the above

Discussion 0
Questions 30

A fraud examiner is based m the United States, a non-European Union (EU) country, and is collecting personal information from their company's human resources (HR) files about an employee based in Spain, an EU country Based on these facts, the fraud examiner would need to comply with the EU's General Data Protection Regulation (GDPR) when conducting their internal investigation.

Options:

A.  

True

B.  

False

Discussion 0
Questions 31

Which of the following is the MOST ACCURATE statement concerning the volatility of digital evidence?

Options:

A.  

Digital evidence is more volatile than tangible evidence because digital evidence is subject to claims of spoliation, whereas tangible evidence is not.

B.  

Digital evidence is more volatile than tangible evidence because the rules of admissibility for digital evidence are stricter than such rules for tangible evidence.

C.  

If the integrity of digital evidence is violated, it can often be restored through a digital cleansing process

D.  

The failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding

Discussion 0
Questions 32

Steve, a Certified Fraud Examiner (CFE). was interviewing Michelle, a fraud suspect. Dunng the first part of the interview. Michelle was attentive. However, when he asked her more direct questions about the fraud, she suddenly seemed unconcerned, alternately chewing on her pen cap and picking at a loose piece of fabric on the arm of her chair. From this conduct. Steve is likely to conclude that Michelle

Options:

A.  

Is feeling bored by the interview process

B.  

Is being deceptive

C.  

Does not know the answers to Steve's questions

D.  

Is telling the truth

Discussion 0
Questions 33

Baker, a Certified Fraud Examiner (CFE). is assigned to the internal audit department of the ABC Company. He is getting ready to conduct an interview with another company employee who might be involved in a fraud. In general, what title should Baker use in his introduction to the employee?

Options:

A.  

Baker should omit a title altogether

B.  

Investigator

C.  

Auditor

D.  

Certified Fraud Examiner

Discussion 0
Questions 34

Which of the following is a common method that fraudsters use to hide their ill-gotten gains?

Options:

A.  

Purchasing a used vehicle

B.  

Creating a will to allocate assets at death

C.  

Placing assets in probate

D.  

Transferring assets into foreign trusts

Discussion 0
Questions 35

During an interview with Alice, a suspect in an embezzlement case, the interviewer observes several signs of stress in Alice's behavior, such as shifting around in her chair, exhibiting shallow breathing, and occasionally stuttering during her replies. The interviewer should conclude that these symptoms are caused by deception.

Options:

A.  

True

B.  

False

Discussion 0
Questions 36

Fraud examination reports should be written with which of the following audiences in mind?

Options:

A.  

The media

B.  

Opposing legal counsel

C.  

Investors and owners

D.  

All of the above

Discussion 0
Questions 37

Which of the following statements regarding the data analytics approach known as predictive analytics is MOST ACCURATE?

Options:

A.  

In predictive analytics, layered artificial neural networks are used to accommodate more data and more sophisticated algorithms to identify complex patterns.

B.  

Predictive analytics involves configuring a program that imitates and integrates the actions of a human to execute certain business processes, which increases efficiency and automates repetitive manual tasks.

C.  

Predictive analytics involves the use of historical data, analyses, statistics, and machine learning components to build a model that depicts important trends and creates a quantitative projection about future outcomes.

D.  

In predictive analytics, computer systems are used to perform human tasks, such as visual perception and decision-making.

Discussion 0
Questions 38

Tonya, a suspect in a kickback scheme, is being interviewed by Carlos, a fraud examiner. As the interview progresses. Carlos notices that Tonya is exhibiting signs of stress, such as repeatedly touching her face, crossing and uncrossing her legs, and darting her eyes around the room Carlos should conclude that Tonya's behavior is the result of deception

Options:

A.  

True

B.  

False

Discussion 0
Questions 39

Which of the following statements would be IMPROPER if included in the fraud examination report of a Certified Fraud Examiner (CFE» who is also qualified as an accounting expert?

Options:

A.  

"The company's internal controls were wholly inadequate to prevent this type of violation and should be remediated at the earliest possible time."

B.  

"The evidence shows that expenses in excess of $5 million were omitted from the company's financial statements "

C.  

"Based on statements the suspect made to me. it is my assessment that the suspect has a dishonest disposition."

D.  

"From my examination, it appears that the company's financial statements were not presented in accordance with generally accepted accounting principles "

Discussion 0
Questions 40

When reporting the results of a fraud examination, it is BEST to include copies (not originals) of important documents in the formal report.

Options:

A.  

True

B.  

False

Discussion 0
Questions 41

Thea is conducting a fraud examination for a company and suspects one of the company's vendors (a one-person operation) of fraudulent billing. Thea wants to obtain a copy of the suspect individual's credit report and personal data from a third-party information broker. If Thea works in a jurisdiction that regulates the distribution of personal credit information, she cannot obtain the suspect's personal credit data under any circumstances.

Options:

A.  

True

B.  

False

Discussion 0
Questions 42

Caroline, a fraud examiner, is conducting an admission-seeking interview with John, an employee suspected of stealing cash. Which of the following is the MOST effective phrasing for Caroline to use when posing an admission-seeking question to John?

Options:

A.  

"Why did you take the money?"

B.  

"What do you know about the stolen money?"

C.  

"Do you know who took the money''"

D.  

"Did you steal the money?"

Discussion 0
Questions 43

Which of the following is NOT a recommended strategy when conducting admission-seeking interviews?

Options:

A.  

Conduct admission-seeking interviews only when time is not a factor.

B.  

Ensure that accusations are made under conditions of privacy to avoid potential liability

C.  

Minimize empathy while emphasizing the perception of moral wrongdoing

D.  

Present a morally acceptable reason for the subject's behavior

Discussion 0
Questions 44

Butler, a Certified Fraud Examiner (CFE), needs to obtain a copy of a statement that the chief executive officer (CEO) of Accord Investments, a venture capital firm, posted on the firm's website sometime last year. Unfortunately, the quote has been removed from the website. Which of the following resources would be the BEST choice for Butler to consult to find an earlier version of the web page that he needs?

Options:

A.  

The invisible archives

B.  

The free web

C.  

The internet archives

D.  

The deep web

Discussion 0
Questions 45

A law enforcement officer receives a reliable tip from an informant that a government employee is soliciting bribes in exchange for awarding contracts to the employee's agency. To investigate, the officer poses as a potential contractor and contacts the suspect employee about the possibility of getting a contract with the agency. During the conversation, the suspect demands a cash payment for the officer to be considered for upcoming contracts. If the suspect claims entrapment at trial, then which of the following is MOST LIKELY to occur?

Options:

A.  

The suspect's claim will succeed because the investigator used deceit

B.  

The suspect's claim will succeed because the investigator lacked probable cause

C.  

The suspect's claim will fail because the investigator had adequate predication

D.  

The suspect's claim will fail because the investigator is a law enforcement agent

Discussion 0
Questions 46

Management at First Choice Inc. suspects that Nathan, its chief financial officer (CFO), has been embezzling funds. It hires Reina. a Certified Fraud Examiner (CFE), to investigate the matter When conducting the fraud examination. Reina should proceed as though;

Options:

A.  

After Nathan is terminated, the case will end

B.  

The case will end in litigation.

C.  

Nathan is guilty

D.  

The matter will be resolved completely internally.

Discussion 0
Questions 47

Sam needs to obtain the most accurate court records possible in a particular jurisdiction concerning a fraud suspect. The BEST place for Sam to look is a global database that compiles court cases from various jurisdictions

Options:

A.  

True

B.  

False

Discussion 0
Questions 48

Which of the following can be obtained from a wire transfer record?

Options:

A.  

The name of the receiving institution's registered agent

B.  

The recipient's government identification number

C.  

The name of the sender or originator

D.  

The sending institution's accreditation type

Discussion 0
Questions 49

Baker, a Certified Fraud Examiner (CFE). is getting prepared to conduct a lengthy and complex interview. To prepare himself. Baker should:

Options:

A.  

Writs down a detailed list of questions in advance

B.  

Avoid bringing any notes with him to the interview

C.  

Write down key points to go over with the respondent

D.  

Take only the documents he wishes to go over

Discussion 0
Questions 50

Which of the following data is the MOST DIFFICULT to recover during a digital forensic examination?

Options:

A.  

Time and date information about files

B.  

Websites visited

C.  

Files that have been overwritten

D.  

Communications sent via instant messenger

Discussion 0
Questions 51

An investigator is preparing to administer what is likely to be an intense and extended interview with a fraud suspect. To organize their thoughts prior to the interview, the fraud examiner should:

Options:

A.  

Provide the suspect with a list of questions to ensure detailed responses-

B.  

Make a list of key points to go over with the respondent.

C.  

Develop a list of questions ranked in order of importance.

D.  

Memorize a detailed list of questions, but avoid taking a written list to the interview

Discussion 0
Questions 52

Which of the following is the MOST ACCURATE statement regarding a fraud examiner’s ability to trace cryptocurrency transactions?

Options:

A.  

Information about cryptocurrency ownership can sometimes be revealed by analyzing a subject’s bank statements.

B.  

Each blockchain transaction contains direct identifying information that can be used to find cryptocurrency users.

C.  

Most jurisdictions do not require digital wallet providers to record any personal information about cryptocurrency users.

D.  

Most cryptocurrencies rely on private blockchains, which require court orders to obtain transaction information.

Discussion 0
Questions 53

Which of the following is one of the purposes of closing questions in a routine interview?

Options:

A.  

To close the interview positively and maintain goodwill

B.  

To assess whether the subject is ready to confess

C.  

To confirm the credibility of the witness being interviewed

D.  

To reduce testimony to a signed, written statement

Discussion 0
Questions 54

Why is it necessary to image a seized computer's hard drive for forensic analysis?

Options:

A.  

To prohibit access to the suspect computer's hard drive by individuals not professionally trained in forensic analysis

B.  

To allow for the analysis of data from a suspect computer without altering or damaging the original data in any way

C.  

To create pictures of the suspect computer system and its wires and cables

D.  

To enable the retrieval of data from the suspect computer directly via its operating system

Discussion 0