Important ACFE CFE-Investigation Exam Questions

Answer: B

Explanation:

Both the Manual and CFE Prep guides emphasize that forensic imaging is essential because:

''Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging... allows a fraud examiner to view and analyse... without altering the original data in any way''.

A forensic image is an exact, sector-by-sector copy of the drive. Thus, imaging preserves evidence integrity.

Answer: D

Explanation:

''Alibis generally can be diffused by displaying physical evidence... evidence should be displayed one piece at a time, in reverse order of importance''16:2014 International Fraud Examiners Manual.pdfL11-L14.

The Prep Guide warns: ''The proper technique is not to lay it all out at once'' .

Thus, showing everything at once is the least effective.

Answer: A

Explanation:

From the 2014 International Fraud Examiners Manual, under the section related to tracing financial transactions, specifically tracing the disposition of loan proceeds, the following objectives of tracing activities are explicitly outlined:

''Tracing the disposition of loan proceeds can help fraud examiners:

Determine whether loan proceeds were deposited into hidden or unknown accounts

Determine whether loan proceeds were used to pay off other loans

Identify the involvement of previously unknown individuals (potential witnesses)

Determine whether payments were made from hidden accounts

Identify undisclosed related-party transactions''

There is no mention that tracing loan proceeds can uncover previous civil offenses committed by the subject. Civil offenses refer to non-criminal violations (e.g., breach of contract, torts), which tracing of financial transactions like loan proceeds is not directly designed to uncover.

This is not a recognized purpose of tracing as taught in the CFE Investigation section. The core objectives revolve around uncovering hidden assets, hidden accounts, payments, and potential witnesses --- not prior legal infractions.

Therefore, the correct answer is A, as it is the only option that is NOT true according to official CFE investigation materials.

Answer: C

Explanation:

The Fraud Examiners Manual states:

''Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction... emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive''.

Thus, statement C is NOT true.

Answer: A

Explanation:

Both the Manual and CFE Prep guides emphasize that deleted files are recoverable until overwritten. Once overwritten, the original data cannot be retrieved:

''Deleted files are recoverable until they are overwritten because data is not erased... until overwritten. So, deleted files that have been overwritten generally are not recoverable.''

Other file types (deleted shortcuts, hidden files, etc.) can often be recovered, but overwritten files are lost permanently.