ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 32

Question 310

A legal warehouse camera captures customers not involved in the allegation. What would be the most defensible approach to minimize unrelated personal data from surveillance?

  1. Review policy, proportionality, and applicable privacy law
  2. Reject unauthorized access and seek a lawful targeted route
  3. Obtain jurisdiction-specific recording advice and authorization
  4. Limit retention and disclosure to relevant footage where lawful

Explanation

Correct Answer

D:

Data minimization reduces unnecessary exposure. The original may need protected preservation if a legal hold covers the wider recording.

Incorrect Answers

A:

Ownership alone does not settle employee privacy expectations; that principle applies when the team needs to avoid assuming workplace ownership eliminates privacy rights. Monitoring must have a lawful and appropriately limited basis; it is not a substitute for a step that would minimize unrelated personal data from surveillance.

B:

Device ownership and surveillance law matter; it protects the separate goal to use approved monitoring rather than spyware. A fraud allegation does not authorize collecting all personal credentials and messages; it would not by itself meet the stated need to minimize unrelated personal data from surveillance.

C:

One-party and all-party consent regimes differ; cross-border rules can be complex; this is a sensible safeguard where the issue is to check local law before recording a conversation. Covert status does not override legal restrictions; the current question is about how to minimize unrelated personal data from surveillance.

Question 311

An undercover agent proposes aggressive pressure to force a reluctant worker into accepting a bribe. Which option best supports the objective to avoid inducing an offense that otherwise might not occur?

  1. Obtain written authority, legal review, and risk limits
  2. Document the unsolicited conduct and the operative's actual role
  3. Reject threats and pursue authorized evidence collection
  4. Seek legal review and prohibit coercive inducement

Explanation

Correct Answer

D:

Entrapment rules differ by jurisdiction and actor, but manufacturing misconduct threatens legality and credibility. Observation should not become coercive creation of an offense.

Incorrect Answers

A:

A controlled transaction may have contractual and criminal implications; this concerns the distinct task of deciding how to check a planned controlled transaction before execution. Purpose, participants, funding, and documentation must be agreed beforehand; it would not by itself meet the stated need to avoid inducing an offense that otherwise might not occur.

B:

Clear interaction records help assess whether investigators observed or induced behavior; that principle applies when the team needs to distinguish passive observation from active encouragement. The distinction can matter in legal proceedings; it serves another purpose, not the immediate need to avoid inducing an offense that otherwise might not occur.

C:

Coercion creates legal and ethical risks and unreliable statements; it can be useful for efforts to avoid using threats to obtain covert evidence. Covert operations require lawful methods, not intimidation; the immediate evidentiary task here is to avoid inducing an offense that otherwise might not occur.

Question 312

An operative records a naturally occurring solicitation without proposing the payment. Which technique best fits the need to distinguish passive observation from active encouragement?

  1. Reject threats and pursue authorized evidence collection
  2. Preserve complete communication logs and contemporaneous notes
  3. Document the unsolicited conduct and the operative's actual role
  4. Seek legal review and prohibit coercive inducement
  5. Obtain written authority, legal review, and risk limits

Explanation

Correct Answer

C:

Clear interaction records help assess whether investigators observed or induced behavior. The distinction can matter in legal proceedings.

Incorrect Answers

A:

Coercion creates legal and ethical risks and unreliable statements; this addresses a different question: how to avoid using threats to obtain covert evidence. Covert operations require lawful methods, not intimidation; it does not settle how to distinguish passive observation from active encouragement in this situation.

B:

The operative's words may affect assessment of inducement; this is a sensible safeguard where the issue is to record exactly what an undercover operative said. Selective excerpts cannot fairly resolve who initiated the act; it serves another purpose, not the immediate need to distinguish passive observation from active encouragement.

D:

Entrapment rules differ by jurisdiction and actor, but manufacturing misconduct threatens legality and credibility; this distinction matters when investigators must avoid inducing an offense that otherwise might not occur. Observation should not become coercive creation of an offense; it serves another purpose, not the immediate need to distinguish passive observation from active encouragement.

E:

A controlled transaction may have contractual and criminal implications; that principle applies when the team needs to check a planned controlled transaction before execution. Purpose, participants, funding, and documentation must be agreed beforehand; this case asks for a means to distinguish passive observation from active encouragement instead.

Question 313

An informant says they can make a target disclose files by threatening exposure. What is the strongest investigative approach to avoid using threats to obtain covert evidence?

  1. Pursue legal review and prohibit coercive inducement
  2. Reject threats and pursue authorized evidence collection
  3. Obtain written authority, legal review, and risk limits
  4. Document the unsolicited conduct and the operative's actual role

Explanation

Correct Answer

B:

Coercion creates legal and ethical risks and unreliable statements. Covert operations require lawful methods, not intimidation.

Incorrect Answers

A:

Entrapment rules differ by jurisdiction and actor, but manufacturing misconduct threatens legality and credibility; that is why it can help to avoid inducing an offense that otherwise might not occur. Observation should not become coercive creation of an offense; the current question is about how to avoid using threats to obtain covert evidence.

C:

A controlled transaction may have contractual and criminal implications; this is primarily relevant when the objective is to check a planned controlled transaction before execution. Purpose, participants, funding, and documentation must be agreed beforehand; the facts presented call first for a way to avoid using threats to obtain covert evidence.

D:

Clear interaction records help assess whether investigators observed or induced behavior; this is primarily relevant when the objective is to distinguish passive observation from active encouragement. The distinction can matter in legal proceedings; the current question is about how to avoid using threats to obtain covert evidence.

Question 314

The team considers a test purchase from a suspect vendor using company funds. Which step is most appropriate to check a planned controlled transaction before execution?

  1. Obtain written authority, legal review, and risk limits
  2. Decline threats and pursue authorized evidence collection
  3. Pursue legal review and prohibit coercive inducement
  4. Document the unsolicited conduct and the operative's actual role

Explanation

Correct Answer

A:

A controlled transaction may have contractual and criminal implications. Purpose, participants, funding, and documentation must be agreed beforehand.

Incorrect Answers

B:

Coercion creates legal and ethical risks and unreliable statements; it supports the separate objective to avoid using threats to obtain covert evidence. Covert operations require lawful methods, not intimidation; it does not settle how to check a planned controlled transaction before execution in this situation.

C:

Entrapment rules differ by jurisdiction and actor, but manufacturing misconduct threatens legality and credibility; it belongs to a different stage of work: trying to avoid inducing an offense that otherwise might not occur. Observation should not become coercive creation of an offense; this case asks for a means to check a planned controlled transaction before execution instead.

D:

Clear interaction records help assess whether investigators observed or induced behavior; it can be useful for efforts to distinguish passive observation from active encouragement. The distinction can matter in legal proceedings; the immediate evidentiary task here is to check a planned controlled transaction before execution.

Question 315

A target later claims the operative suggested the entire fraudulent scheme. Which next step best helps the team to record exactly what an undercover operative said?

  1. Obtain written authority, legal review, and risk limits
  2. Reject threats and pursue authorized evidence collection
  3. Preserve complete communication logs and contemporaneous notes
  4. Seek legal review and prohibit coercive inducement

Explanation

Correct Answer

C:

The operative's words may affect assessment of inducement. Selective excerpts cannot fairly resolve who initiated the act.

Incorrect Answers

A:

A controlled transaction may have contractual and criminal implications; it can be useful for efforts to check a planned controlled transaction before execution. Purpose, participants, funding, and documentation must be agreed beforehand; this case asks for a means to record exactly what an undercover operative said instead.

B:

Coercion creates legal and ethical risks and unreliable statements; that is the consideration when a team tries to avoid using threats to obtain covert evidence. Covert operations require lawful methods, not intimidation; the priority under these facts is to record exactly what an undercover operative said.

D:

Entrapment rules differ by jurisdiction and actor, but manufacturing misconduct threatens legality and credibility; this responds to a different operational need to avoid inducing an offense that otherwise might not occur. Observation should not become coercive creation of an offense; the required investigative decision is to record exactly what an undercover operative said.

Question 316

A suspect vendor publicly advertises an unusual kickback arrangement in a forum thread. What would be the most defensible approach to preserve a public forum posting before deletion?

  1. Reject credential misuse and obtain lawful access
  2. Remove unnecessary identifiers and apply approved security controls
  3. Capture the page, URL, timestamp, and relevant context lawfully
  4. Restrict collection to relevant lawful sources and time periods
  5. Preserve message metadata and corroborate account attribution

Explanation

Correct Answer

C:

Online material can disappear or change. Source attribution and capture details help later assess authenticity.

Incorrect Answers

A:

Private digital spaces are not open-source intelligence merely because they are online; that principle applies when the team needs to avoid unauthorized access to a private group. Access authority and privacy remain essential; this case asks for a means to preserve a public forum posting before deletion instead.

B:

Operational security limits exposure of agents and sources; it belongs to a different stage of work: trying to protect an agent's digital operational security. Poor account setup can compromise an assignment before evidence is gathered; it would not by itself meet the stated need to preserve a public forum posting before deletion.

D:

Covert social-media work must remain proportionate; this addresses a different question: how to avoid excessive passive monitoring of unrelated accounts. Broad indiscriminate collection can add privacy risk without meaningful probative value; it would not by itself meet the stated need to preserve a public forum posting before deletion.

E:

A displayed username may be spoofed or shared; it can be useful for efforts to validate an undercover social-media profile's evidence. Technical and external evidence should link the message to an actual actor; the investigative step being tested here is how to preserve a public forum posting before deletion.

Question 317

An examiner wants to use a stolen password to join a closed messaging channel. Which response is most appropriate to avoid unauthorized access to a private group?

  1. Capture the page, URL, timestamp, and relevant context lawfully
  2. Restrict collection to relevant lawful sources and time periods
  3. Preserve message metadata and corroborate account attribution
  4. Reject credential misuse and obtain lawful access

Explanation

Correct Answer

D:

Private digital spaces are not open-source intelligence merely because they are online. Access authority and privacy remain essential.

Incorrect Answers

A:

Online material can disappear or change; this concerns the distinct task of deciding how to preserve a public forum posting before deletion. Source attribution and capture details help later assess authenticity; it does not address the specific requirement to avoid unauthorized access to a private group.

B:

Covert social-media work must remain proportionate; it supports the separate objective to avoid excessive passive monitoring of unrelated accounts. Broad indiscriminate collection can add privacy risk without meaningful probative value; it does not address the specific requirement to avoid unauthorized access to a private group.

C:

A displayed username may be spoofed or shared; this addresses a different question: how to validate an undercover social-media profile's evidence. Technical and external evidence should link the message to an actual actor; it does not address the specific requirement to avoid unauthorized access to a private group.

Question 318

An undercover operative receives a private message from an account attributed to a suspect. The operative's research profile also exposes a personal telephone number. Which TWO immediate measures protect the operative's identity and the evidentiary value of the message? Choose TWO.

  1. Restrict collection to relevant lawful sources and time periods
  2. Remove the personal telephone identifier and harden the approved covert research profile before further contact
  3. Preserve message metadata and corroborate account attribution
  4. Preserve only a cropped message screenshot without account, date, or platform metadata
  5. Decline credential misuse and obtain lawful access

Explanation

Correct Answers

B:

The operative's personal phone number creates a direct disclosure risk that the approved covert identity and account configuration must address. Those protective settings must be in place before further contact invites a suspect to trace the operative's real identity.

C:

A displayed username may be spoofed or shared. Technical and external evidence should link the message to an actual actor.

Incorrect Answers

A:

Covert social-media work must remain proportionate; that is the consideration when a team tries to avoid excessive passive monitoring of unrelated accounts. Broad indiscriminate collection can add privacy risk without meaningful probative value; this case asks for a means to validate an undercover social-media profile's evidence instead.

D:

A crop omits details needed to authenticate and contextualize the communication. The collection should retain timestamps, identifiers, and reliable attribution through authorized methods.

E:

Private digital spaces are not open-source intelligence merely because they are online; this is primarily relevant when the objective is to avoid unauthorized access to a private group. Access authority and privacy remain essential; the record instead calls for an action that would validate an undercover social-media profile's evidence.

Question 319

An undercover account is configured to display the investigator's personal phone number. How should the examiner proceed to protect an agent's digital operational security?

  1. Restrict collection to relevant lawful sources and time periods
  2. Reject credential misuse and obtain lawful access
  3. Remove unnecessary identifiers and apply approved security controls
  4. Capture the page, URL, timestamp, and relevant context lawfully

Explanation

Correct Answer

C:

Operational security limits exposure of agents and sources. Poor account setup can compromise an assignment before evidence is gathered.

Incorrect Answers

A:

Covert social-media work must remain proportionate; this is a sensible safeguard where the issue is to avoid excessive passive monitoring of unrelated accounts. Broad indiscriminate collection can add privacy risk without meaningful probative value; it does not address the specific requirement to protect an agent's digital operational security.

B:

Private digital spaces are not open-source intelligence merely because they are online; it can be useful for efforts to avoid unauthorized access to a private group. Access authority and privacy remain essential; the facts presented call first for a way to protect an agent's digital operational security.

D:

Online material can disappear or change; this is primarily relevant when the objective is to preserve a public forum posting before deletion. Source attribution and capture details help later assess authenticity; this case asks for a means to protect an agent's digital operational security instead.

Question 320

Investigators collect years of private posts from coworkers of a named suspect. Which response most directly enables the examiner to avoid excessive passive monitoring of unrelated accounts?

  1. Remove unnecessary identifiers and apply approved security controls
  2. Preserve message metadata and corroborate account attribution
  3. Restrict collection to relevant lawful sources and time periods
  4. Capture the page, URL, timestamp, and relevant context lawfully
  5. Refuse credential misuse and obtain lawful access

Explanation

Correct Answer

C:

Covert social-media work must remain proportionate. Broad indiscriminate collection can add privacy risk without meaningful probative value.

Incorrect Answers

A:

Operational security limits exposure of agents and sources; this responds to a different operational need to protect an agent's digital operational security. Poor account setup can compromise an assignment before evidence is gathered; it does not address the specific requirement to avoid excessive passive monitoring of unrelated accounts.

B:

A displayed username may be spoofed or shared; it supports the separate objective to validate an undercover social-media profile's evidence. Technical and external evidence should link the message to an actual actor; that would leave unresolved the present need to avoid excessive passive monitoring of unrelated accounts.

D:

Online material can disappear or change; it can be useful for efforts to preserve a public forum posting before deletion. Source attribution and capture details help later assess authenticity; the investigative step being tested here is how to avoid excessive passive monitoring of unrelated accounts.

E:

Private digital spaces are not open-source intelligence merely because they are online; this addresses a different question: how to avoid unauthorized access to a private group. Access authority and privacy remain essential; it does not address the specific requirement to avoid excessive passive monitoring of unrelated accounts.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests