ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 31

Question 300

A part-time guard claims to know the contents of a confidential board meeting. Which investigative method is best suited to assess whether a source had access to claimed information?

  1. Check access opportunities and corroborating records
  2. Capture metadata and corroborate against authorized source systems
  3. Track each claim to its originating information
  4. Reassess credibility and document material inconsistencies
  5. Record a firsthand witness interview, not just a source summary

Explanation

Correct Answer

A:

A source's claim of privileged knowledge requires factual support. Implausible access may point to hearsay or invention.

Incorrect Answers

B:

Editable files can be fabricated or altered; it describes an action suited to validate a source-provided digital file. Hashing after receipt protects later integrity but does not establish original authenticity; this case asks for a means to assess whether a source had access to claimed information instead.

C:

Multiple repetitions of one origin are not independent support; this addresses a different question: how to prevent circular corroboration. Source mapping prevents mistaken confidence from apparent consensus; the examiner still needs to assess whether a source had access to claimed information.

D:

Contradictions can indicate error or deception; that is why it can help to identify deliberate source fabrication. Independent testing is necessary before relying on a high-risk informant; the required investigative decision is to assess whether a source had access to claimed information.

E:

Firsthand testimony has different provenance from secondhand intelligence; it protects the separate goal to distinguish a witness from an investigative source. The method of acquisition and confidentiality protections should be documented; this case asks for a means to assess whether a source had access to claimed information instead.

Question 301

An informant will earn a bonus only if an employee is implicated. Which procedure would best allow investigators to prevent a paid source from manufacturing results?

  1. Avoid outcome-contingent incentives and apply oversight
  2. Initiate a safety response and reassess the operation
  3. Seek legal guidance and preapproved boundaries rather than improvise
  4. Document the relationship and test assertions independently

Explanation

Correct Answer

A:

A reward tied to accusation creates pressure to exaggerate or fabricate. Transparent compensation and independent checks reduce distortion.

Incorrect Answers

B:

Source protection is an ongoing duty; this responds to a different operational need to manage a source threatened by the investigated person. An investigative lead does not justify exposing a person to avoidable harm; this case asks for a means to prevent a paid source from manufacturing results instead.

C:

Participation in misconduct can create liability; that is the consideration when a team tries to avoid uncontrolled participation in illegal activity. Covert objectives require explicit lawful limits and escalation rules; it would not by itself meet the stated need to prevent a paid source from manufacturing results.

D:

Bias may influence the source's account; it describes an action suited to record a source's prior relationship with a suspect. Disclosure and corroboration help reviewers interpret the evidence fairly; it does not settle how to prevent a paid source from manufacturing results in this situation.

Question 302

An informant reports receiving a credible threat after a covert contact. How should the examiner proceed to manage a source threatened by the investigated person?

  1. Seek legal guidance and preapproved boundaries rather than improvise
  2. Initiate a safety response and reassess the operation
  3. Avoid outcome-contingent incentives and apply oversight
  4. Activate the withdrawal and emergency contact plan

Explanation

Correct Answer

B:

Source protection is an ongoing duty. An investigative lead does not justify exposing a person to avoidable harm.

Incorrect Answers

A:

Participation in misconduct can create liability; this is a sensible safeguard where the issue is to avoid uncontrolled participation in illegal activity. Covert objectives require explicit lawful limits and escalation rules; it serves another purpose, not the immediate need to manage a source threatened by the investigated person.

C:

A reward tied to accusation creates pressure to exaggerate or fabricate; that is why it can help to prevent a paid source from manufacturing results. Transparent compensation and independent checks reduce distortion; this case asks for a means to manage a source threatened by the investigated person instead.

D:

Safety takes priority over continuing to collect evidence; it protects the separate goal to plan a safe exit from a compromised covert assignment. Prearranged exit procedures reduce reactive and dangerous decisions; the facts presented call first for a way to manage a source threatened by the investigated person.

Question 303

An undercover operative is asked to authorize a false reimbursement to maintain cover. Which response most directly enables the examiner to avoid uncontrolled participation in illegal activity?

  1. Document the relationship and test assertions independently
  2. Begin a safety response and reassess the operation
  3. Avoid outcome-contingent incentives and apply oversight
  4. Seek legal guidance and preapproved boundaries rather than improvise

Explanation

Correct Answer

D:

Participation in misconduct can create liability. Covert objectives require explicit lawful limits and escalation rules.

Incorrect Answers

A:

Bias may influence the source's account; its purpose in an investigation is to record a source's prior relationship with a suspect. Disclosure and corroboration help reviewers interpret the evidence fairly; it serves another purpose, not the immediate need to avoid uncontrolled participation in illegal activity.

B:

Source protection is an ongoing duty; it protects the separate goal to manage a source threatened by the investigated person. An investigative lead does not justify exposing a person to avoidable harm; this case asks for a means to avoid uncontrolled participation in illegal activity instead.

C:

A reward tied to accusation creates pressure to exaggerate or fabricate; it belongs to a different stage of work: trying to prevent a paid source from manufacturing results. Transparent compensation and independent checks reduce distortion; the immediate evidentiary task here is to avoid uncontrolled participation in illegal activity.

Question 304

A confidential tipster is involved in a hostile commercial dispute with the subject. Which action addresses the primary investigative need to record a source's prior relationship with a suspect?

  1. Initiate a safety response and reassess the operation
  2. Avoid outcome-contingent incentives and apply oversight
  3. Document the relationship and test assertions independently
  4. Seek legal guidance and preapproved boundaries rather than improvise
  5. Activate the withdrawal and emergency contact plan

Explanation

Correct Answer

C:

Bias may influence the source's account. Disclosure and corroboration help reviewers interpret the evidence fairly.

Incorrect Answers

A:

Source protection is an ongoing duty; this concerns the distinct task of deciding how to manage a source threatened by the investigated person. An investigative lead does not justify exposing a person to avoidable harm; it does not settle how to record a source's prior relationship with a suspect in this situation.

B:

A reward tied to accusation creates pressure to exaggerate or fabricate; this responds to a different operational need to prevent a paid source from manufacturing results. Transparent compensation and independent checks reduce distortion; this case asks for a means to record a source's prior relationship with a suspect instead.

D:

Participation in misconduct can create liability; it describes an action suited to avoid uncontrolled participation in illegal activity. Covert objectives require explicit lawful limits and escalation rules; the investigative step being tested here is how to record a source's prior relationship with a suspect.

E:

Safety takes priority over continuing to collect evidence; this concerns the distinct task of deciding how to plan a safe exit from a compromised covert assignment. Prearranged exit procedures reduce reactive and dangerous decisions; the record instead calls for an action that would record a source's prior relationship with a suspect.

Question 305

A covert employee believes their identity has been discovered by a hostile group. Which option best supports the objective to plan a safe exit from a compromised covert assignment?

  1. Activate the withdrawal and emergency contact plan
  2. Document the relationship and test assertions independently
  3. Avoid outcome-contingent incentives and apply oversight
  4. Initiate a safety response and reassess the operation

Explanation

Correct Answer

A:

Safety takes priority over continuing to collect evidence. Prearranged exit procedures reduce reactive and dangerous decisions.

Incorrect Answers

B:

Bias may influence the source's account; this distinction matters when investigators must record a source's prior relationship with a suspect. Disclosure and corroboration help reviewers interpret the evidence fairly; the required investigative decision is to plan a safe exit from a compromised covert assignment.

C:

A reward tied to accusation creates pressure to exaggerate or fabricate; it protects the separate goal to prevent a paid source from manufacturing results. Transparent compensation and independent checks reduce distortion; the immediate evidentiary task here is to plan a safe exit from a compromised covert assignment.

D:

Source protection is an ongoing duty; that principle applies when the team needs to manage a source threatened by the investigated person. An investigative lead does not justify exposing a person to avoidable harm; this case asks for a means to plan a safe exit from a compromised covert assignment instead.

Question 306

A private examiner plans to record a call across two jurisdictions with different consent rules. Which investigative method is best suited to check local law before recording a conversation?

  1. Review policy, proportionality, and applicable privacy law
  2. Limit retention and disclosure to relevant footage where lawful
  3. Document device time, drift, and collection settings
  4. Reject unauthorized access and seek a lawful targeted route
  5. Reject threats and pursue authorized evidence collection
  6. Obtain jurisdiction-specific recording advice and authorization

Explanation

Correct Answer

F:

One-party and all-party consent regimes differ; cross-border rules can be complex. Covert status does not override legal restrictions.

Incorrect Answers

A:

Ownership alone does not settle employee privacy expectations; this responds to a different operational need to avoid assuming workplace ownership eliminates privacy rights. Monitoring must have a lawful and appropriately limited basis; the investigative step being tested here is how to check local law before recording a conversation.

B:

Data minimization reduces unnecessary exposure; it supports the separate objective to minimize unrelated personal data from surveillance. The original may need protected preservation if a legal hold covers the wider recording; it does not address the specific requirement to check local law before recording a conversation.

C:

Timestamp errors can misplace an event; this distinction matters when investigators must record camera clock settings during covert acquisition. Independent clocks and recorded settings support accurate reconstruction; it is not a substitute for a step that would check local law before recording a conversation.

D:

Device ownership and surveillance law matter; it belongs to a different stage of work: trying to use approved monitoring rather than spyware. A fraud allegation does not authorize collecting all personal credentials and messages; it would not by itself meet the stated need to check local law before recording a conversation.

E:

Coercion creates legal and ethical risks and unreliable statements; this is primarily relevant when the objective is to avoid using threats to obtain covert evidence. Covert operations require lawful methods, not intimidation; it would not by itself meet the stated need to check local law before recording a conversation.

Question 307

A company owns a laptop but intends to secretly capture unrelated private communications. What should the examiner select to avoid assuming workplace ownership eliminates privacy rights?

  1. Obtain jurisdiction-specific recording advice and authorization
  2. Document device time, drift, and collection settings
  3. Limit retention and disclosure to relevant footage where lawful
  4. Review policy, proportionality, and applicable privacy law

Explanation

Correct Answer

D:

Ownership alone does not settle employee privacy expectations. Monitoring must have a lawful and appropriately limited basis.

Incorrect Answers

A:

One-party and all-party consent regimes differ; cross-border rules can be complex; this addresses a different question: how to check local law before recording a conversation. Covert status does not override legal restrictions; it would not by itself meet the stated need to avoid assuming workplace ownership eliminates privacy rights.

B:

Timestamp errors can misplace an event; that is why it can help to record camera clock settings during covert acquisition. Independent clocks and recorded settings support accurate reconstruction; the priority under these facts is to avoid assuming workplace ownership eliminates privacy rights.

C:

Data minimization reduces unnecessary exposure; that is the consideration when a team tries to minimize unrelated personal data from surveillance. The original may need protected preservation if a legal hold covers the wider recording; the facts presented call first for a way to avoid assuming workplace ownership eliminates privacy rights.

Question 308

An investigator considers installing an undisclosed keylogger on an employee's personal phone. What should be done to use approved monitoring rather than spyware?

  1. Obtain jurisdiction-specific recording advice and authorization
  2. Review policy, proportionality, and applicable privacy law
  3. Limit retention and disclosure to relevant footage where lawful
  4. Reject unauthorized access and seek a lawful targeted route
  5. Document device time, drift, and collection settings

Explanation

Correct Answer

D:

Device ownership and surveillance law matter. A fraud allegation does not authorize collecting all personal credentials and messages.

Incorrect Answers

A:

One-party and all-party consent regimes differ; cross-border rules can be complex; it supports the separate objective to check local law before recording a conversation. Covert status does not override legal restrictions; it serves another purpose, not the immediate need to use approved monitoring rather than spyware.

B:

Ownership alone does not settle employee privacy expectations; it protects the separate goal to avoid assuming workplace ownership eliminates privacy rights. Monitoring must have a lawful and appropriately limited basis; the current question is about how to use approved monitoring rather than spyware.

C:

Data minimization reduces unnecessary exposure; this is a sensible safeguard where the issue is to minimize unrelated personal data from surveillance. The original may need protected preservation if a legal hold covers the wider recording; it would not by itself meet the stated need to use approved monitoring rather than spyware.

E:

Timestamp errors can misplace an event; it belongs to a different stage of work: trying to record camera clock settings during covert acquisition. Independent clocks and recorded settings support accurate reconstruction; that would leave unresolved the present need to use approved monitoring rather than spyware.

Question 309

Hidden surveillance footage is needed to reconcile a precise exchange time. Which action would most reliably help the team to record camera clock settings during covert acquisition?

  1. Reject unauthorized access and seek a lawful targeted route
  2. Obtain jurisdiction-specific recording advice and authorization
  3. Document device time, drift, and collection settings
  4. Review policy, proportionality, and applicable privacy law

Explanation

Correct Answer

C:

Timestamp errors can misplace an event. Independent clocks and recorded settings support accurate reconstruction.

Incorrect Answers

A:

Device ownership and surveillance law matter; this responds to a different operational need to use approved monitoring rather than spyware. A fraud allegation does not authorize collecting all personal credentials and messages; that would leave unresolved the present need to record camera clock settings during covert acquisition.

B:

One-party and all-party consent regimes differ; cross-border rules can be complex; that is the consideration when a team tries to check local law before recording a conversation. Covert status does not override legal restrictions; the required investigative decision is to record camera clock settings during covert acquisition.

D:

Ownership alone does not settle employee privacy expectations; this concerns the distinct task of deciding how to avoid assuming workplace ownership eliminates privacy rights. Monitoring must have a lawful and appropriately limited basis; it serves another purpose, not the immediate need to record camera clock settings during covert acquisition.

Question 310

A legal warehouse camera captures customers not involved in the allegation. What would be the most defensible approach to minimize unrelated personal data from surveillance?

  1. Review policy, proportionality, and applicable privacy law
  2. Reject unauthorized access and seek a lawful targeted route
  3. Obtain jurisdiction-specific recording advice and authorization
  4. Limit retention and disclosure to relevant footage where lawful

Explanation

Correct Answer

D:

Data minimization reduces unnecessary exposure. The original may need protected preservation if a legal hold covers the wider recording.

Incorrect Answers

A:

Ownership alone does not settle employee privacy expectations; that principle applies when the team needs to avoid assuming workplace ownership eliminates privacy rights. Monitoring must have a lawful and appropriately limited basis; it is not a substitute for a step that would minimize unrelated personal data from surveillance.

B:

Device ownership and surveillance law matter; it protects the separate goal to use approved monitoring rather than spyware. A fraud allegation does not authorize collecting all personal credentials and messages; it would not by itself meet the stated need to minimize unrelated personal data from surveillance.

C:

One-party and all-party consent regimes differ; cross-border rules can be complex; this is a sensible safeguard where the issue is to check local law before recording a conversation. Covert status does not override legal restrictions; the current question is about how to minimize unrelated personal data from surveillance.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests