ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 30

Question 290

A surveillance team changes locations after unexpectedly encountering a protected area. What is the strongest investigative approach to document operational changes during surveillance?

  1. Make prompt dated observations distinguishing fact from inference
  2. Record the reason, authorization, and revised limits
  3. Record collection conditions and each subsequent transfer
  4. Mark the lead uncorroborated pending independent verification

Explanation

Correct Answer

B:

An auditable change log shows whether the operation stayed within approved boundaries. Silent changes can obscure unlawful or irrelevant collection.

Incorrect Answers

A:

Timely notes reduce memory drift and preserve sequence; that principle applies when the team needs to preserve contemporaneous undercover notes. The record should identify when and where each observation was made; it does not address the specific requirement to document operational changes during surveillance.

C:

Provenance ties an exhibit to the event and supports authenticity; it protects the separate goal to log movement and custody of undercover exhibits. Unrecorded handling allows avoidable disputes over substitution; that would leave unresolved the present need to document operational changes during surveillance.

D:

Confidential intelligence can guide inquiry without constituting established fact; it can be useful for efforts to distinguish intelligence leads from verified proof. Source credibility and objective corroboration remain separate questions; the required investigative decision is to document operational changes during surveillance.

Question 291

A confidential source claims a clerk accepts bribes but heard it from a competitor. What should be done to check a proposed informant's basis of knowledge?

  1. Explain realistic confidentiality and legal disclosure limits
  2. Ask what was firsthand and obtain independent corroboration
  3. Document incentive arrangements and potential credibility effects
  4. Set lawful collection limits and reject illegal access

Explanation

Correct Answer

B:

A source's proximity to events affects reliability. Competitive motives can increase the need to test information, not automatically invalidate it.

Incorrect Answers

A:

An investigator can control internal access but cannot necessarily block judicial disclosure; it protects the separate goal to protect a source's identity without making impossible guarantees. Accurate expectations protect the source and case; that would leave unresolved the present need to check a proposed informant's basis of knowledge.

C:

Payments or personal benefits may influence reporting; this is a sensible safeguard where the issue is to record source motivations and possible incentives. Disclosure and oversight help assess whether information is independently trustworthy; the examiner still needs to check a proposed informant's basis of knowledge.

D:

A covert source does not gain investigative powers through cooperation; it can be useful for efforts to avoid allowing a source to commit unauthorized acts. Unlawful methods may harm victims and compromise evidence; the record instead calls for an action that would check a proposed informant's basis of knowledge.

Question 292

An informant expects a financial reward for information about a bidder. Which action would most reliably help the team to record source motivations and possible incentives?

  1. Ask what was firsthand and obtain independent corroboration
  2. Document incentive arrangements and potential credibility effects
  3. Use independent records and lawfully obtained evidence to test the lead
  4. Set lawful collection limits and reject illegal access
  5. Explain realistic confidentiality and legal disclosure limits

Explanation

Correct Answer

B:

Payments or personal benefits may influence reporting. Disclosure and oversight help assess whether information is independently trustworthy.

Incorrect Answers

A:

A source's proximity to events affects reliability; it can be useful for efforts to check a proposed informant's basis of knowledge. Competitive motives can increase the need to test information, not automatically invalidate it; the current question is about how to record source motivations and possible incentives.

C:

Anonymous tips may be valuable starting points; that is the consideration when a team tries to verify an anonymous informant's claims about a hidden ledger. Claims should be corroborated before being presented as factual findings; it serves another purpose, not the immediate need to record source motivations and possible incentives.

D:

A covert source does not gain investigative powers through cooperation; this addresses a different question: how to avoid allowing a source to commit unauthorized acts. Unlawful methods may harm victims and compromise evidence; the investigative step being tested here is how to record source motivations and possible incentives.

E:

An investigator can control internal access but cannot necessarily block judicial disclosure; this concerns the distinct task of deciding how to protect a source's identity without making impossible guarantees. Accurate expectations protect the source and case; the priority under these facts is to record source motivations and possible incentives.

Question 293

An employee agrees to cooperate only if the examiner promises their name can never be disclosed. What would be the most defensible approach to protect a source's identity without making impossible guarantees?

  1. Use independent records and lawfully obtained evidence to test the lead
  2. Ask what was firsthand and obtain independent corroboration
  3. Explain realistic confidentiality and legal disclosure limits
  4. Document incentive arrangements and potential credibility effects

Explanation

Correct Answer

C:

An investigator can control internal access but cannot necessarily block judicial disclosure. Accurate expectations protect the source and case.

Incorrect Answers

A:

Anonymous tips may be valuable starting points; this is a sensible safeguard where the issue is to verify an anonymous informant's claims about a hidden ledger. Claims should be corroborated before being presented as factual findings; the investigative step being tested here is how to protect a source's identity without making impossible guarantees.

B:

A source's proximity to events affects reliability; this addresses a different question: how to check a proposed informant's basis of knowledge. Competitive motives can increase the need to test information, not automatically invalidate it; that would leave unresolved the present need to protect a source's identity without making impossible guarantees.

D:

Payments or personal benefits may influence reporting; it describes an action suited to record source motivations and possible incentives. Disclosure and oversight help assess whether information is independently trustworthy; the immediate evidentiary task here is to protect a source's identity without making impossible guarantees.

Question 294

An informant proposes hacking a colleague's private email to gather more proof. Which response is most appropriate to avoid allowing a source to commit unauthorized acts?

  1. Set lawful collection limits and reject illegal access
  2. Ask what was firsthand and obtain independent corroboration
  3. Describe realistic confidentiality and legal disclosure limits
  4. Document incentive arrangements and potential credibility effects

Explanation

Correct Answer

A:

A covert source does not gain investigative powers through cooperation. Unlawful methods may harm victims and compromise evidence.

Incorrect Answers

B:

A source's proximity to events affects reliability; it supports the separate objective to check a proposed informant's basis of knowledge. Competitive motives can increase the need to test information, not automatically invalidate it; it serves another purpose, not the immediate need to avoid allowing a source to commit unauthorized acts.

C:

An investigator can control internal access but cannot necessarily block judicial disclosure; that principle applies when the team needs to protect a source's identity without making impossible guarantees. Accurate expectations protect the source and case; it does not address the specific requirement to avoid allowing a source to commit unauthorized acts.

D:

Payments or personal benefits may influence reporting; its purpose in an investigation is to record source motivations and possible incentives. Disclosure and oversight help assess whether information is independently trustworthy; it does not address the specific requirement to avoid allowing a source to commit unauthorized acts.

Question 295

A source supplies a location for an off-books payment register but no authentic document. Which procedure would best allow investigators to verify an anonymous informant's claims about a hidden ledger?

  1. Set lawful collection limits and reject illegal access
  2. Ask what was firsthand and obtain independent corroboration
  3. Document incentive arrangements and potential credibility effects
  4. Use independent records and lawfully obtained evidence to test the lead

Explanation

Correct Answer

D:

Anonymous tips may be valuable starting points. Claims should be corroborated before being presented as factual findings.

Incorrect Answers

A:

A covert source does not gain investigative powers through cooperation; it supports the separate objective to avoid allowing a source to commit unauthorized acts. Unlawful methods may harm victims and compromise evidence; the priority under these facts is to verify an anonymous informant's claims about a hidden ledger.

B:

A source's proximity to events affects reliability; that is the consideration when a team tries to check a proposed informant's basis of knowledge. Competitive motives can increase the need to test information, not automatically invalidate it; the record instead calls for an action that would verify an anonymous informant's claims about a hidden ledger.

C:

Payments or personal benefits may influence reporting; this distinction matters when investigators must record source motivations and possible incentives. Disclosure and oversight help assess whether information is independently trustworthy; it would not by itself meet the stated need to verify an anonymous informant's claims about a hidden ledger.

Question 296

A source supplies dates that directly conflict with independently authenticated branch closures. What is the strongest investigative approach to identify deliberate source fabrication?

  1. Capture metadata and corroborate against authorized source systems
  2. Check access opportunities and corroborating records
  3. Reassess credibility and document material inconsistencies
  4. Trace each claim to its originating information
  5. Record a firsthand witness interview, not just a source summary

Explanation

Correct Answer

C:

Contradictions can indicate error or deception. Independent testing is necessary before relying on a high-risk informant.

Incorrect Answers

A:

Editable files can be fabricated or altered; that is the consideration when a team tries to validate a source-provided digital file. Hashing after receipt protects later integrity but does not establish original authenticity; it does not settle how to identify deliberate source fabrication in this situation.

B:

A source's claim of privileged knowledge requires factual support; it supports the separate objective to assess whether a source had access to claimed information. Implausible access may point to hearsay or invention; it does not settle how to identify deliberate source fabrication in this situation.

D:

Multiple repetitions of one origin are not independent support; it can be useful for efforts to prevent circular corroboration. Source mapping prevents mistaken confidence from apparent consensus; this case asks for a means to identify deliberate source fabrication instead.

E:

Firsthand testimony has different provenance from secondhand intelligence; that is why it can help to distinguish a witness from an investigative source. The method of acquisition and confidentiality protections should be documented; the immediate evidentiary task here is to identify deliberate source fabrication.

Question 297

A delivery driver personally observed goods leaving a warehouse without paperwork. Which step is most appropriate to distinguish a witness from an investigative source?

  1. Record a firsthand witness interview, not just a source summary
  2. Check access opportunities and corroborating records
  3. Reassess credibility and document material inconsistencies
  4. Capture metadata and corroborate against authorized source systems

Explanation

Correct Answer

A:

Firsthand testimony has different provenance from secondhand intelligence. The method of acquisition and confidentiality protections should be documented.

Incorrect Answers

B:

A source's claim of privileged knowledge requires factual support; that is the consideration when a team tries to assess whether a source had access to claimed information. Implausible access may point to hearsay or invention; that would leave unresolved the present need to distinguish a witness from an investigative source.

C:

Contradictions can indicate error or deception; it describes an action suited to identify deliberate source fabrication. Independent testing is necessary before relying on a high-risk informant; the immediate evidentiary task here is to distinguish a witness from an investigative source.

D:

Editable files can be fabricated or altered; this is a sensible safeguard where the issue is to validate a source-provided digital file. Hashing after receipt protects later integrity but does not establish original authenticity; the required investigative decision is to distinguish a witness from an investigative source.

Question 298

Two confidential sources repeat an allegation originally posted by one anonymous account. One supplies an editable digital file, and both claim firsthand knowledge of approvals despite uncertain system access. Which THREE checks independently test the allegation's origin, the file's authenticity, and the sources' claimed access? Choose THREE.

  1. Authenticate the editable approval file’s origin and compare its contents with authorized source-system records
  2. Trace each claim to its originating information
  3. Avoid outcome-contingent incentives and apply oversight
  4. Reassess credibility and document material inconsistencies
  5. Establish whether either confidential source had firsthand access to the claimed approval records
  6. Record a firsthand witness interview, not just a source summary

Explanation

Correct Answers

A:

The editable attachment should be checked against permitted original procurement-system records, not merely hashed after receipt. File properties and independent transaction records must support an alleged origin before the attachment is treated as authentic.

B:

Multiple repetitions of one origin are not independent support. Source mapping prevents mistaken confidence from apparent consensus.

E:

The claimed firsthand knowledge is credible only to the degree that the informants actually had access to the specified approvals. Someone lacking access to the stated records may be repeating an unverified source rather than describing personal observation.

Incorrect Answers

C:

A reward tied to accusation creates pressure to exaggerate or fabricate; this distinction matters when investigators must prevent a paid source from manufacturing results. Transparent compensation and independent checks reduce distortion; this case asks for a means to prevent circular corroboration instead.

D:

Contradictions can indicate error or deception; its purpose in an investigation is to identify deliberate source fabrication. Independent testing is necessary before relying on a high-risk informant; the required investigative decision is to prevent circular corroboration.

F:

Firsthand testimony has different provenance from secondhand intelligence; it belongs to a different stage of work: trying to distinguish a witness from an investigative source. The method of acquisition and confidentiality protections should be documented; it serves another purpose, not the immediate need to prevent circular corroboration.

Question 299

An informant emails an alleged internal price list as an editable spreadsheet. What action should the investigation team take to validate a source-provided digital file?

  1. Verify access opportunities and corroborating records
  2. Reassess credibility and document material inconsistencies
  3. Record a firsthand witness interview, not just a source summary
  4. Capture metadata and corroborate against authorized source systems

Explanation

Correct Answer

D:

Editable files can be fabricated or altered. Hashing after receipt protects later integrity but does not establish original authenticity.

Incorrect Answers

A:

A source's claim of privileged knowledge requires factual support; this is a sensible safeguard where the issue is to assess whether a source had access to claimed information. Implausible access may point to hearsay or invention; the immediate evidentiary task here is to validate a source-provided digital file.

B:

Contradictions can indicate error or deception; this distinction matters when investigators must identify deliberate source fabrication. Independent testing is necessary before relying on a high-risk informant; the required investigative decision is to validate a source-provided digital file.

C:

Firsthand testimony has different provenance from secondhand intelligence; this responds to a different operational need to distinguish a witness from an investigative source. The method of acquisition and confidentiality protections should be documented; the facts presented call first for a way to validate a source-provided digital file.

Question 300

A part-time guard claims to know the contents of a confidential board meeting. Which investigative method is best suited to assess whether a source had access to claimed information?

  1. Check access opportunities and corroborating records
  2. Capture metadata and corroborate against authorized source systems
  3. Track each claim to its originating information
  4. Reassess credibility and document material inconsistencies
  5. Record a firsthand witness interview, not just a source summary

Explanation

Correct Answer

A:

A source's claim of privileged knowledge requires factual support. Implausible access may point to hearsay or invention.

Incorrect Answers

B:

Editable files can be fabricated or altered; it describes an action suited to validate a source-provided digital file. Hashing after receipt protects later integrity but does not establish original authenticity; this case asks for a means to assess whether a source had access to claimed information instead.

C:

Multiple repetitions of one origin are not independent support; this addresses a different question: how to prevent circular corroboration. Source mapping prevents mistaken confidence from apparent consensus; the examiner still needs to assess whether a source had access to claimed information.

D:

Contradictions can indicate error or deception; that is why it can help to identify deliberate source fabrication. Independent testing is necessary before relying on a high-risk informant; the required investigative decision is to assess whether a source had access to claimed information.

E:

Firsthand testimony has different provenance from secondhand intelligence; it protects the separate goal to distinguish a witness from an investigative source. The method of acquisition and confidentiality protections should be documented; this case asks for a means to assess whether a source had access to claimed information instead.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests