ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 37

Question 360

An investigator knows only the recipient's bank statement description and a masked sender account. Which response most directly enables the examiner to identify the owner of an incoming payment?

  1. Use valid consent or an applicable legal process with counsel
  2. Confirm a permissible purpose and applicable consent or statutory authority
  3. Trace transaction dates, counterparties, and reference fields in authenticated statements
  4. Describe location uncertainty instead of claiming an exact address
  5. Use authenticated bank records and investigate timing or scope differences
  6. Seek lawful supporting payment records and sending-bank information

Explanation

Correct Answer

F:

Narrative fields may be truncated or misleading. Formal transaction records can link the originator subject to disclosure rules.

Incorrect Answers

A:

Financial confidentiality limits ordinary access; it protects the separate goal to obtain protected bank statements from a third party. A company allegation does not confer independent compulsory powers on an examiner; it serves another purpose, not the immediate need to identify the owner of an incoming payment.

B:

Credit reports are not general public records; its purpose in an investigation is to secure information from a credit bureau lawfully. Access restrictions vary by jurisdiction and unauthorized retrieval can be unlawful; it does not address the specific requirement to identify the owner of an incoming payment.

C:

Bank records can evidence money movement, not necessarily underlying intent; that is why it can help to understand what bank statements can establish. Source documents are needed to explain the transactions; it does not settle how to identify the owner of an incoming payment in this situation.

D:

Cell-site information generally has coverage and accuracy limitations; this addresses a different question: how to avoid overstating geolocation precision. It may narrow an area but not place a person in a specific room; it would not by itself meet the stated need to identify the owner of an incoming payment.

E:

A direct bank source provides stronger provenance than an editable summary; it supports the separate objective to reconcile a bank confirmation with an account spreadsheet. Reconciliation should account for pending items and statement dates; the priority under these facts is to identify the owner of an incoming payment.

Question 361

An examiner wants a contractor's mobile call records from a telecommunications provider. Which next step best helps the team to obtain a private subscriber's call-detail records?

  1. Corroborate actual device use and account control
  2. Seek appropriate consent or legal authorization
  3. Coordinate a lawful preservation request promptly
  4. Treat the log as evidence of contact, not conversation content

Explanation

Correct Answer

B:

Telecom data are generally protected by law and contractual duties. Investigative curiosity alone does not justify disclosure.

Incorrect Answers

A:

Registration may not identify the person sending a particular message; this concerns the distinct task of deciding how to assess subscriber-name evidence in a phone inquiry. Device artifacts and independent testimony help attribution; it would not by itself meet the stated need to obtain a private subscriber's call-detail records.

C:

Retention periods can eliminate records before formal production; that is why it can help to verify preservation needs for rapidly changing telecom data. Preservation and access are separate steps, each requiring proper authority; the priority under these facts is to obtain a private subscriber's call-detail records.

D:

Call records may establish timing and numbers but rarely the substance of speech; it supports the separate objective to interpret call metadata accurately. A corrupt agreement requires additional proof; the record instead calls for an action that would obtain a private subscriber's call-detail records.

Question 362

A telephone log shows an employee called a vendor minutes before a contract award. What action should the investigation team take to interpret call metadata accurately?

  1. Corroborate actual device use and account control
  2. Seek appropriate consent or legal authorization
  3. Describe location uncertainty instead of claiming an exact address
  4. Treat the log as evidence of contact, not conversation content

Explanation

Correct Answer

D:

Call records may establish timing and numbers but rarely the substance of speech. A corrupt agreement requires additional proof.

Incorrect Answers

A:

Registration may not identify the person sending a particular message; that principle applies when the team needs to assess subscriber-name evidence in a phone inquiry. Device artifacts and independent testimony help attribution; it is not a substitute for a step that would interpret call metadata accurately.

B:

Telecom data are generally protected by law and contractual duties; that is the consideration when a team tries to obtain a private subscriber's call-detail records. Investigative curiosity alone does not justify disclosure; that would leave unresolved the present need to interpret call metadata accurately.

C:

Cell-site information generally has coverage and accuracy limitations; it supports the separate objective to avoid overstating geolocation precision. It may narrow an area but not place a person in a specific room; the investigative step being tested here is how to interpret call metadata accurately.

Question 363

A mobile number used for suspect messages is registered to a relative. Which investigative method is best suited to assess subscriber-name evidence in a phone inquiry?

  1. Corroborate actual device use and account control
  2. Coordinate a lawful preservation request promptly
  3. Treat the log as evidence of contact, not conversation content
  4. Pursue appropriate consent or legal authorization

Explanation

Correct Answer

A:

Registration may not identify the person sending a particular message. Device artifacts and independent testimony help attribution.

Incorrect Answers

B:

Retention periods can eliminate records before formal production; it belongs to a different stage of work: trying to verify preservation needs for rapidly changing telecom data. Preservation and access are separate steps, each requiring proper authority; it does not settle how to assess subscriber-name evidence in a phone inquiry in this situation.

C:

Call records may establish timing and numbers but rarely the substance of speech; that is the consideration when a team tries to interpret call metadata accurately. A corrupt agreement requires additional proof; it serves another purpose, not the immediate need to assess subscriber-name evidence in a phone inquiry.

D:

Telecom data are generally protected by law and contractual duties; this is a sensible safeguard where the issue is to obtain a private subscriber's call-detail records. Investigative curiosity alone does not justify disclosure; it serves another purpose, not the immediate need to assess subscriber-name evidence in a phone inquiry.

Question 364

A phone tower record places a device somewhere within a broad service area. What should the examiner select to avoid overstating geolocation precision?

  1. Describe location uncertainty instead of claiming an exact address
  2. Treat the log as evidence of contact, not conversation content
  3. Corroborate actual device use and account control
  4. Seek appropriate consent or legal authorization
  5. Coordinate a lawful preservation request promptly

Explanation

Correct Answer

A:

Cell-site information generally has coverage and accuracy limitations. It may narrow an area but not place a person in a specific room.

Incorrect Answers

B:

Call records may establish timing and numbers but rarely the substance of speech; this is a sensible safeguard where the issue is to interpret call metadata accurately. A corrupt agreement requires additional proof; it would not by itself meet the stated need to avoid overstating geolocation precision.

C:

Registration may not identify the person sending a particular message; this is primarily relevant when the objective is to assess subscriber-name evidence in a phone inquiry. Device artifacts and independent testimony help attribution; it does not settle how to avoid overstating geolocation precision in this situation.

D:

Telecom data are generally protected by law and contractual duties; it describes an action suited to obtain a private subscriber's call-detail records. Investigative curiosity alone does not justify disclosure; it would not by itself meet the stated need to avoid overstating geolocation precision.

E:

Retention periods can eliminate records before formal production; this responds to a different operational need to verify preservation needs for rapidly changing telecom data. Preservation and access are separate steps, each requiring proper authority; it is not a substitute for a step that would avoid overstating geolocation precision.

Question 365

A provider's logs may be retained only for a short operational period. What should be done to verify preservation needs for rapidly changing telecom data?

  1. Corroborate actual device use and account control
  2. Coordinate a lawful preservation request promptly
  3. Seek appropriate consent or legal authorization
  4. Describe location uncertainty instead of claiming an exact address

Explanation

Correct Answer

B:

Retention periods can eliminate records before formal production. Preservation and access are separate steps, each requiring proper authority.

Incorrect Answers

A:

Registration may not identify the person sending a particular message; it can be useful for efforts to assess subscriber-name evidence in a phone inquiry. Device artifacts and independent testimony help attribution; the required investigative decision is to verify preservation needs for rapidly changing telecom data.

C:

Telecom data are generally protected by law and contractual duties; its purpose in an investigation is to obtain a private subscriber's call-detail records. Investigative curiosity alone does not justify disclosure; the priority under these facts is to verify preservation needs for rapidly changing telecom data.

D:

Cell-site information generally has coverage and accuracy limitations; that is the consideration when a team tries to avoid overstating geolocation precision. It may narrow an area but not place a person in a specific room; the priority under these facts is to verify preservation needs for rapidly changing telecom data.

Question 366

A procurement officer listed work at a supplier during a period of suspicious approvals. Which response most directly enables the examiner to verify an applicant's claimed employment history?

  1. Use a lawful, minimal verification of the relevant attendance fact
  2. Use authorized employer verification and reliable employment documents
  3. Verify qualification through the issuer or an authorized verification service
  4. Review authenticated role descriptions and historical system permissions

Explanation

Correct Answer

B:

Employment dates may support a relationship hypothesis. Privacy and reference restrictions still affect what may be obtained.

Incorrect Answers

A:

Sensitive health information requires heightened care; its purpose in an investigation is to avoid gathering irrelevant personnel health details. Collecting an entire file may be unnecessary and disproportionate; the required investigative decision is to verify an applicant's claimed employment history.

C:

A university's public information may be limited; it protects the separate goal to check professional credentials without disclosing sensitive records. Ask the issuer or approved service to confirm the award and date, without requesting unnecessary student records; this case asks for a means to verify an applicant's claimed employment history instead.

D:

Job titles and written duties can diverge from actual privileges; it protects the separate goal to compare past job duties with current access claims. Historical access evidence is needed for the disputed period; the facts presented call first for a way to verify an applicant's claimed employment history.

Question 367

A financial controller claims a degree required for a regulated assignment. Which action addresses the primary investigative need to check professional credentials without disclosing sensitive records?

  1. Review authenticated role descriptions and historical system permissions
  2. Treat profile content as a lead for independent verification
  3. Use authorized employer verification and reliable employment documents
  4. Verify qualification through the issuer or an authorized verification service

Explanation

Correct Answer

D:

A university's public information may be limited. Proper consent or authorized channels preserve legitimacy. Ask the issuer or approved service to confirm the award and date, without requesting unnecessary student records.

Incorrect Answers

A:

Job titles and written duties can diverge from actual privileges; this concerns the distinct task of deciding how to compare past job duties with current access claims. Historical access evidence is needed for the disputed period; the priority under these facts is to check professional credentials without disclosing sensitive records.

B:

Self-authored pages can be outdated or inaccurate; that is the consideration when a team tries to recognize limits of a public professional profile. A discrepancy warrants questions rather than a finding of misrepresentation; the immediate evidentiary task here is to check professional credentials without disclosing sensitive records.

C:

Employment dates may support a relationship hypothesis; this is a sensible safeguard where the issue is to verify an applicant's claimed employment history. Privacy and reference restrictions still affect what may be obtained; it does not address the specific requirement to check professional credentials without disclosing sensitive records.

Question 368

A witness says an employee could never edit master supplier records. Which option best supports the objective to compare past job duties with current access claims?

  1. Verify qualification through the issuer or an authorized verification service
  2. Treat profile content as a lead for independent verification
  3. Use authorized employer verification and reliable employment documents
  4. Use a lawful, minimal verification of the relevant attendance fact
  5. Review authenticated role descriptions and historical system permissions

Explanation

Correct Answer

E:

Job titles and written duties can diverge from actual privileges. Historical access evidence is needed for the disputed period.

Incorrect Answers

A:

A university's public information may be limited; this concerns the distinct task of deciding how to check professional credentials without disclosing sensitive records. Ask the issuer or approved service to confirm the award and date, without requesting unnecessary student records; the current question is about how to compare past job duties with current access claims.

B:

Self-authored pages can be outdated or inaccurate; this is a sensible safeguard where the issue is to recognize limits of a public professional profile. A discrepancy warrants questions rather than a finding of misrepresentation; that would leave unresolved the present need to compare past job duties with current access claims.

C:

Employment dates may support a relationship hypothesis; it describes an action suited to verify an applicant's claimed employment history. Privacy and reference restrictions still affect what may be obtained; the investigative step being tested here is how to compare past job duties with current access claims.

D:

Sensitive health information requires heightened care; this distinction matters when investigators must avoid gathering irrelevant personnel health details. Collecting an entire file may be unnecessary and disproportionate; the current question is about how to compare past job duties with current access claims.

Question 369

An investigator requests an entire medical file to confirm a single absence date. Which technique best fits the need to avoid gathering irrelevant personnel health details?

  1. Treat profile content as a lead for independent verification
  2. Review authenticated role descriptions and historical system permissions
  3. Use a lawful, minimal verification of the relevant attendance fact
  4. Use authorized employer verification and reliable employment documents

Explanation

Correct Answer

C:

Sensitive health information requires heightened care. Collecting an entire file may be unnecessary and disproportionate.

Incorrect Answers

A:

Self-authored pages can be outdated or inaccurate; it describes an action suited to recognize limits of a public professional profile. A discrepancy warrants questions rather than a finding of misrepresentation; the required investigative decision is to avoid gathering irrelevant personnel health details.

B:

Job titles and written duties can diverge from actual privileges; that principle applies when the team needs to compare past job duties with current access claims. Historical access evidence is needed for the disputed period; the immediate evidentiary task here is to avoid gathering irrelevant personnel health details.

D:

Employment dates may support a relationship hypothesis; its purpose in an investigation is to verify an applicant's claimed employment history. Privacy and reference restrictions still affect what may be obtained; the current question is about how to avoid gathering irrelevant personnel health details.

Question 370

A subject's online résumé lists a different employer from an HR database. What is the strongest investigative approach to recognize limits of a public professional profile?

  1. Review authenticated role descriptions and historical system permissions
  2. Verify qualification through the issuer or an authorized verification service
  3. Treat profile content as a lead for independent verification
  4. Employ authorized employer verification and reliable employment documents

Explanation

Correct Answer

C:

Self-authored pages can be outdated or inaccurate. A discrepancy warrants questions rather than a finding of misrepresentation.

Incorrect Answers

A:

Job titles and written duties can diverge from actual privileges; this is primarily relevant when the objective is to compare past job duties with current access claims. Historical access evidence is needed for the disputed period; the immediate evidentiary task here is to recognize limits of a public professional profile.

B:

A university's public information may be limited; that principle applies when the team needs to check professional credentials without disclosing sensitive records. Ask the issuer or approved service to confirm the award and date, without requesting unnecessary student records; it does not settle how to recognize limits of a public professional profile in this situation.

D:

Employment dates may support a relationship hypothesis; this distinction matters when investigators must verify an applicant's claimed employment history. Privacy and reference restrictions still affect what may be obtained; the investigative step being tested here is how to recognize limits of a public professional profile.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests