Free ACFE CFE-Investigation Practice Exam with Questions & Answers | Set: 3

According toCFE Prep – Investigations:

“In most jurisdictions, income tax records are not public records and cannot be accessed for pre-employment purposes”.

Common public sources include court, property, licensing, and utility records.Thus, searching income tax filings isnota common use of public sources.

Complex questions:

“consist of a series of interrelated questions… too complicated to be easily understood, cover more than one subject, or require more than one answer”.

The question asked by Delta (“Were you aware that the signature was forged, and why didn’t you tell anyone earlier?”) covers two issues, making itcomplex.

Both the Manual and CFE Prep guides emphasize thatdeleted files are recoverable until overwritten. Once overwritten, the original data cannot be retrieved:

“Deleted files are recoverable until they are overwritten because data is not erased… until overwritten. So, deleted files that have been overwritten generally arenot recoverable.”

Other file types (deleted shortcuts, hidden files, etc.) can often be recovered, butoverwritten files are lost permanently.

Best practices emphasize separation:

“Interviews should be conducted one-on-one to reduce the possibility of collusion, contamination, or intimidation of witnesses” (Fraud Examiners Manual – Interviewing Guidelines).This ensures independent and uncontaminated statements.

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

Fraud examiners mustnot opine on guilt, innocence, intent, or disposition. Reports should focus onfacts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate toaccounting and internal control assessments, which fall within an accounting expert’s scope. OnlyCis improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

TheFraud Examiners Manualstates:

“Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction… emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive”.

Thus, statement C isNOT true.

TheFraud Examiners Manualexplains that rather than drafting an exhaustive list of questions, the interviewer should:

“formulate a brief outline of key points to discuss during the interview”.

This helps organize thoughts while allowing flexibility.

“To locate people using online records… First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

This aligns with the Prep guide: “Obtaining a past address of the subject should be the first step in trying to locate a subject using online records”.

Thus, B is correct.

Digital forensics guidance stresses:

If the computer isoff,do not turn it on, because booting will alter files and timestamps.

If the computer isonand volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅Answer: A. If Lucas's computer is running, Nobles may retrieve data… if the evidence exists only in volatile data