ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 23

Question 220

The subject is told to confess theft or be assumed to have committed a more serious crime. Which investigative method is best suited to keep an interviewer from framing a false choice?

  1. Explain that charging and discipline decisions are outside the examiner's authority
  2. Recognize the concern while testing the payment evidence
  3. Use neutral questions rather than inventing excuses or minimizing legal consequences
  4. Avoid forced-choice threats and seek a factual narrative
  5. Test actual system activity separately from the expressed resentment

Explanation

Correct Answer

D:

An artificial dilemma can pressure agreement without genuine knowledge. Truthful, open questioning produces more defensible information.

Incorrect Answers

A:

Unauthorized promises may be misleading and coercive; it can be useful for efforts to avoid promising that admission guarantees leniency. Admissions should be voluntary and not induced by guarantees the interviewer cannot deliver; the record instead calls for an action that would keep an interviewer from framing a false choice.

B:

Respectful communication can sustain dialogue; it belongs to a different stage of work: trying to recognize when empathy is appropriate without endorsing conduct. Financial pressure is background context, not proof that a particular transfer was fraudulent; the investigative step being tested here is how to keep an interviewer from framing a false choice.

C:

False reassurance may influence an admission's reliability; this responds to a different operational need to avoid supplying a fabricated justification for wrongdoing. Investigators should not promise that wrongdoing is normal or consequence-free; the immediate evidentiary task here is to keep an interviewer from framing a false choice.

E:

A motive may suggest a line of inquiry but does not prove execution; this is a sensible safeguard where the issue is to separate motive statements from evidence of the act. Access logs and authenticated data are required for attribution; it does not settle how to keep an interviewer from framing a false choice in this situation.

Question 221

An employee says they were at a customer site during a disputed cash pickup. Which procedure would best allow investigators to check a subject's claim of being elsewhere?

  1. Check timezone configuration and clock synchronization
  2. Verify appointments, access logs, and independent witnesses
  3. Examine device, session, and authentication artifacts
  4. Review assigned permissions and privilege history for the date

Explanation

Correct Answer

B:

A plausible alibi should be tested with reliable external data. Absence from a site may be relevant but not conclusive without timing accuracy.

Incorrect Answers

A:

Clock errors can create a false contradiction; this distinction matters when investigators must reconcile inconsistent time sources. A timeline should use normalized times and document uncertainty; it serves another purpose, not the immediate need to check a subject's claim of being elsewhere.

C:

An account identifier alone may not uniquely identify the operator; it supports the separate objective to distinguish account ownership from use. Corroborating technical facts and access practices are needed; the priority under these facts is to check a subject's claim of being elsewhere.

D:

Present permissions indicate capability but do not show who exercised it; this responds to a different operational need to assess whether system access was possible. Historical grants and activity logs can test the claimed inability; the examiner still needs to check a subject's claim of being elsewhere.

Question 222

An administrator denies being able to change supplier banking instructions. How should the examiner proceed to assess whether system access was possible?

  1. Examine device, session, and authentication artifacts
  2. Test route, time, and contemporaneous transaction records
  3. Review assigned permissions and privilege history for the date
  4. Verify appointments, access logs, and independent witnesses

Explanation

Correct Answer

C:

Present permissions indicate capability but do not show who exercised it. Historical grants and activity logs can test the claimed inability.

Incorrect Answers

A:

An account identifier alone may not uniquely identify the operator; that is the consideration when a team tries to distinguish account ownership from use. Corroborating technical facts and access practices are needed; it does not address the specific requirement to assess whether system access was possible.

B:

A feasibility check identifies whether the timeline can be true; that is the consideration when a team tries to check whether a claimed travel route was feasible. It should account for data limitations rather than treating a mapping estimate as perfect; the investigative step being tested here is how to assess whether system access was possible.

D:

A plausible alibi should be tested with reliable external data; this responds to a different operational need to check a subject's claim of being elsewhere. Absence from a site may be relevant but not conclusive without timing accuracy; the priority under these facts is to assess whether system access was possible.

Question 223

A suspect's phone location differs from a CCTV timestamp by one hour. Which response most directly enables the examiner to reconcile inconsistent time sources?

  1. Check timezone configuration and clock synchronization
  2. Test route, time, and contemporaneous transaction records
  3. Review assigned permissions and privilege history for the date
  4. Verify appointments, access logs, and independent witnesses

Explanation

Correct Answer

A:

Clock errors can create a false contradiction. A timeline should use normalized times and document uncertainty.

Incorrect Answers

B:

A feasibility check identifies whether the timeline can be true; this is a sensible safeguard where the issue is to check whether a claimed travel route was feasible. It should account for data limitations rather than treating a mapping estimate as perfect; this case asks for a means to reconcile inconsistent time sources instead.

C:

Present permissions indicate capability but do not show who exercised it; it protects the separate goal to assess whether system access was possible. Historical grants and activity logs can test the claimed inability; the current question is about how to reconcile inconsistent time sources.

D:

A plausible alibi should be tested with reliable external data; it protects the separate goal to check a subject's claim of being elsewhere. Absence from a site may be relevant but not conclusive without timing accuracy; it serves another purpose, not the immediate need to reconcile inconsistent time sources.

Question 224

An employee says someone else used their shared terminal login. Which action addresses the primary investigative need to distinguish account ownership from use?

  1. Check timezone configuration and clock synchronization
  2. Test route, time, and contemporaneous transaction records
  3. Examine device, session, and authentication artifacts
  4. Verify appointments, access logs, and independent witnesses
  5. Review assigned permissions and privilege history for the date

Explanation

Correct Answer

C:

An account identifier alone may not uniquely identify the operator. Corroborating technical facts and access practices are needed.

Incorrect Answers

A:

Clock errors can create a false contradiction; that is why it can help to reconcile inconsistent time sources. A timeline should use normalized times and document uncertainty; it does not address the specific requirement to distinguish account ownership from use.

B:

A feasibility check identifies whether the timeline can be true; it describes an action suited to check whether a claimed travel route was feasible. It should account for data limitations rather than treating a mapping estimate as perfect; the record instead calls for an action that would distinguish account ownership from use.

D:

A plausible alibi should be tested with reliable external data; this concerns the distinct task of deciding how to check a subject's claim of being elsewhere. Absence from a site may be relevant but not conclusive without timing accuracy; it does not address the specific requirement to distinguish account ownership from use.

E:

Present permissions indicate capability but do not show who exercised it; this concerns the distinct task of deciding how to assess whether system access was possible. Historical grants and activity logs can test the claimed inability; it does not address the specific requirement to distinguish account ownership from use.

Question 225

A subject says they visited two branch locations ten minutes apart despite long travel distances. Which option best supports the objective to check whether a claimed travel route was feasible?

  1. Check timezone configuration and clock synchronization
  2. Test route, time, and contemporaneous transaction records
  3. Verify appointments, access logs, and independent witnesses
  4. Examine device, session, and authentication artifacts

Explanation

Correct Answer

B:

A feasibility check identifies whether the timeline can be true. It should account for data limitations rather than treating a mapping estimate as perfect.

Incorrect Answers

A:

Clock errors can create a false contradiction; it belongs to a different stage of work: trying to reconcile inconsistent time sources. A timeline should use normalized times and document uncertainty; it does not settle how to check whether a claimed travel route was feasible in this situation.

C:

A plausible alibi should be tested with reliable external data; that principle applies when the team needs to check a subject's claim of being elsewhere. Absence from a site may be relevant but not conclusive without timing accuracy; that would leave unresolved the present need to check whether a claimed travel route was feasible.

D:

An account identifier alone may not uniquely identify the operator; this is a sensible safeguard where the issue is to distinguish account ownership from use. Corroborating technical facts and access practices are needed; that would leave unresolved the present need to check whether a claimed travel route was feasible.

Question 226

An interviewer wants to show the full case chronology before the subject describes any events. Which investigative method is best suited to protect independent recall before revealing the investigation theory?

  1. Focus on independently verifiable facts and follow disclosure rules
  2. Use the source record to clarify the exact event
  3. Discuss one dated conflict before introducing the next
  4. Elicit a free account first and disclose evidence selectively

Explanation

Correct Answer

D:

Independent narration allows genuine comparison. Premature full disclosure may encourage tailoring without adding reliability.

Incorrect Answers

A:

The subject can respond to factual allegations without routine exposure of a confidential source; this is primarily relevant when the objective is to avoid disclosing an informant's identity unnecessarily. Legal duties to disclose must still be respected; that would leave unresolved the present need to protect independent recall before revealing the investigation theory.

B:

An exhibit can refresh memory or expose inconsistency if its provenance is known; this is a sensible safeguard where the issue is to introduce an authenticated exhibit only when relevant. It should not be described as conclusive beyond its content; the record instead calls for an action that would protect independent recall before revealing the investigation theory.

C:

Sequencing prevents the subject from confusing separate records; this is a sensible safeguard where the issue is to address contradictions in a controlled sequence. Each explanation can then be checked independently; it would not by itself meet the stated need to protect independent recall before revealing the investigation theory.

Question 227

The subject cannot place a disputed meeting until shown a dated visitor log. What should the examiner select to introduce an authenticated exhibit only when relevant?

  1. Focus on independently verifiable facts and follow disclosure rules
  2. Obtain a free account first and disclose evidence selectively
  3. Discuss one dated conflict before introducing the next
  4. Use the source record to clarify the exact event

Explanation

Correct Answer

D:

An exhibit can refresh memory or expose inconsistency if its provenance is known. It should not be described as conclusive beyond its content.

Incorrect Answers

A:

The subject can respond to factual allegations without routine exposure of a confidential source; it can be useful for efforts to avoid disclosing an informant's identity unnecessarily. Legal duties to disclose must still be respected; that would leave unresolved the present need to introduce an authenticated exhibit only when relevant.

B:

Independent narration allows genuine comparison; it supports the separate objective to protect independent recall before revealing the investigation theory. Premature full disclosure may encourage tailoring without adding reliability; the priority under these facts is to introduce an authenticated exhibit only when relevant.

C:

Sequencing prevents the subject from confusing separate records; it describes an action suited to address contradictions in a controlled sequence. Each explanation can then be checked independently; that would leave unresolved the present need to introduce an authenticated exhibit only when relevant.

Question 228

A subject demands to know which subordinate mentioned the suspect transaction. What should be done to avoid disclosing an informant's identity unnecessarily?

  1. Discuss one dated conflict before introducing the next
  2. Use the source record to clarify the exact event
  3. Verify source and provenance before relying on the printout
  4. Elicit a free account first and disclose evidence selectively
  5. Focus on independently verifiable facts and follow disclosure rules

Explanation

Correct Answer

E:

The subject can respond to factual allegations without routine exposure of a confidential source. Legal duties to disclose must still be respected.

Incorrect Answers

A:

Sequencing prevents the subject from confusing separate records; its purpose in an investigation is to address contradictions in a controlled sequence. Each explanation can then be checked independently; the immediate evidentiary task here is to avoid disclosing an informant's identity unnecessarily.

B:

An exhibit can refresh memory or expose inconsistency if its provenance is known; it describes an action suited to introduce an authenticated exhibit only when relevant. It should not be described as conclusive beyond its content; the investigative step being tested here is how to avoid disclosing an informant's identity unnecessarily.

C:

A document's persuasive appearance is not enough to establish reliability; it can be useful for efforts to avoid undermining chain of custody with casual exhibits. Authentication should precede using it to challenge a statement; that would leave unresolved the present need to avoid disclosing an informant's identity unnecessarily.

D:

Independent narration allows genuine comparison; that is the consideration when a team tries to protect independent recall before revealing the investigation theory. Premature full disclosure may encourage tailoring without adding reliability; the priority under these facts is to avoid disclosing an informant's identity unnecessarily.

Question 229

A subject's account conflicts with three purchase-order edits occurring on different dates. Which action would most reliably help the team to address contradictions in a controlled sequence?

  1. Verify source and provenance before relying on the printout
  2. Elicit a free account first and disclose evidence selectively
  3. Discuss one dated conflict before introducing the next
  4. Use the source record to clarify the exact event

Explanation

Correct Answer

C:

Sequencing prevents the subject from confusing separate records. Each explanation can then be checked independently.

Incorrect Answers

A:

A document's persuasive appearance is not enough to establish reliability; this addresses a different question: how to avoid undermining chain of custody with casual exhibits. Authentication should precede using it to challenge a statement; the examiner still needs to address contradictions in a controlled sequence.

B:

Independent narration allows genuine comparison; this is a sensible safeguard where the issue is to protect independent recall before revealing the investigation theory. Premature full disclosure may encourage tailoring without adding reliability; this case asks for a means to address contradictions in a controlled sequence instead.

D:

An exhibit can refresh memory or expose inconsistency if its provenance is known; its purpose in an investigation is to introduce an authenticated exhibit only when relevant. It should not be described as conclusive beyond its content; it does not address the specific requirement to address contradictions in a controlled sequence.

Question 230

An interviewer shows an unlabeled printout taken from another analyst's desk. What would be the most defensible approach to avoid undermining chain of custody with casual exhibits?

  1. Elicit a free account first and disclose evidence selectively
  2. Focus on independently verifiable facts and follow disclosure rules
  3. Use the source record to clarify the exact event
  4. Verify source and provenance before relying on the printout

Explanation

Correct Answer

D:

A document's persuasive appearance is not enough to establish reliability. Authentication should precede using it to challenge a statement.

Incorrect Answers

A:

Independent narration allows genuine comparison; it describes an action suited to protect independent recall before revealing the investigation theory. Premature full disclosure may encourage tailoring without adding reliability; that would leave unresolved the present need to avoid undermining chain of custody with casual exhibits.

B:

The subject can respond to factual allegations without routine exposure of a confidential source; this addresses a different question: how to avoid disclosing an informant's identity unnecessarily. Legal duties to disclose must still be respected; the facts presented call first for a way to avoid undermining chain of custody with casual exhibits.

C:

An exhibit can refresh memory or expose inconsistency if its provenance is known; this distinction matters when investigators must introduce an authenticated exhibit only when relevant. It should not be described as conclusive beyond its content; the current question is about how to avoid undermining chain of custody with casual exhibits.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests