ACFE CFE - Law (Certified Fraud Examiner - Law) Practice Test 29

Question 280

A forensic copy is authenticated using a certification by a qualified person describing a reliable digital process. Which U.S. rule may be relevant?

  1. Competent translation foundation
  2. Digital authorship authentication
  3. Certified domestic business record
  4. Certified electronic-process authentication

Explanation

Correct Answer

D:

Rules 902(13) and (14) provide certification mechanisms for certain electronic records or copied data, subject to notice and other rules.

Incorrect Answers

A:

A reliable translation and qualifications of the translator help the court assess disputed foreign-language content without confusing interpretation with authentication; certified electronic-process authentication is the issue raised by the described conduct.

B:

Proving that a post came from a claimed person can require corroborating account, device, testimony or distinctive-content evidence beyond appearance alone; the inquiry instead concerns Certified electronic-process authentication, with its own elements.

C:

Rule 902(11) permits self-authentication of certain qualifying records through certification and notice, although hearsay and reliability still require analysis; the relevant step in this scenario is Certified electronic-process authentication.

Question 281

A witness identifies a photograph by testifying they took it and it fairly represents what they saw. What foundation is illustrated?

  1. Recording integrity
  2. System-generated record reliability
  3. Witness-with-knowledge authentication
  4. Distinctive-characteristics authentication

Explanation

Correct Answer

C:

A witness who knows the depicted scene may provide a foundation that the image accurately represents the relevant subject.

Incorrect Answers

A:

The proponent should address continuity, acquisition history and any edits to show the offered recording represents the relevant conversation accurately; those prerequisites should not be confused with Witness-with-knowledge authentication.

B:

Machine-produced output may require proof of how the system functions and why it reliably generated the asserted data, even if it is not hearsay; witness-with-knowledge authentication addresses the distinct legal requirement stated in the facts.

D:

Rule 901 permits identity to be supported by the item's content, internal patterns and surrounding circumstances considered together; witness-with-knowledge authentication raises a different threshold from this alternative.

Question 282

An email's content, reply history and unique identifiers identify its likely sender. What authentication method is illustrated?

  1. Witness-with-knowledge authentication
  2. Recording integrity
  3. System-generated record reliability
  4. Distinctive-characteristics authentication

Explanation

Correct Answer

D:

Rule 901 permits identity to be supported by the item's content, internal patterns and surrounding circumstances considered together.

Incorrect Answers

A:

A witness who knows the depicted scene may provide a foundation that the image accurately represents the relevant subject; the circumstances point to Distinctive-characteristics authentication rather than that separate test.

B:

The proponent should address continuity, acquisition history and any edits to show the offered recording represents the relevant conversation accurately; distinctive-characteristics authentication is the issue raised by the described conduct.

C:

Machine-produced output may require proof of how the system functions and why it reliably generated the asserted data, even if it is not hearsay; the inquiry instead concerns Distinctive-characteristics authentication, with its own elements.

Question 283

A bank's automated system generates transaction logs without human intervention. Which evidentiary foundation may be necessary?

  1. Recording integrity
  2. System-generated record reliability
  3. Distinctive-characteristics authentication
  4. Witness-with-knowledge authentication
  5. Volatility of live data

Explanation

Correct Answer

B:

Machine-produced output may require proof of how the system functions and why it reliably generated the asserted data, even if it is not hearsay.

Incorrect Answers

A:

The proponent should address continuity, acquisition history and any edits to show the offered recording represents the relevant conversation accurately; here the operative distinction is System-generated record reliability.

C:

Rule 901 permits identity to be supported by the item's content, internal patterns and surrounding circumstances considered together; those prerequisites should not be confused with System-generated record reliability.

D:

A witness who knows the depicted scene may provide a foundation that the image accurately represents the relevant subject; system-generated record reliability addresses the distinct legal requirement stated in the facts.

E:

Memory, sessions and short-lived credentials may disappear on shutdown or delay, so legally authorized triage must assess order of collection; system-generated record reliability raises a different threshold from this alternative.

Question 284

A party disputes whether an audio recording was spliced after it was collected. Which validation concern is central?

  1. Witness-with-knowledge authentication
  2. Distinctive-characteristics authentication
  3. System-generated record reliability
  4. Recording integrity

Explanation

Correct Answer

D:

The proponent should address continuity, acquisition history and any edits to show the offered recording represents the relevant conversation accurately.

Incorrect Answers

A:

A witness who knows the depicted scene may provide a foundation that the image accurately represents the relevant subject; that concept must be distinguished from Recording integrity here.

B:

Rule 901 permits identity to be supported by the item's content, internal patterns and surrounding circumstances considered together; the circumstances point to Recording integrity rather than that separate test.

C:

Machine-produced output may require proof of how the system functions and why it reliably generated the asserted data, even if it is not hearsay; recording integrity is the issue raised by the described conduct.

Question 285

During a dawn search of a running trading workstation, the response team faces three time-sensitive issues. (1) It postpones capturing an unlocked encrypted session until power loss destroys memory-only credentials; which evidentiary property was overlooked? (2) Analysts plan to test recovery utilities against the seized original SSD rather than a verified duplicate; which preservation practice should replace that plan? (3) A hosted messaging provider will purge a relevant audit trail in 48 hours before compulsory process can be served; which immediate legal step helps prevent loss? Choose THREE.

  1. Forensic acquisition
  2. Forensic working copy
  3. Volatility of live data
  4. Seizure and scene recording
  5. Scope of cloud evidence
  6. Preservation request or legal hold

Explanation

Correct Answers

B:

Analysis on a verified copy limits avoidable change to original media and supports reproducibility of findings; it specifically answers numbered situation 2.

C:

Memory, sessions and short-lived credentials may disappear on shutdown or delay, so legally authorized triage must assess order of collection; it specifically answers numbered situation 1.

F:

Timely authorized preservation can reduce loss of relevant data while the proper lawful production process is pursued; it specifically answers numbered situation 3.

Incorrect Answers

A:

Acquisition creates a controlled evidentiary copy under a documented process before substantive interpretation of data; the separate questions call for volatility of live data, forensic working copy and preservation request or legal hold, while no prompt asks for this additional rule.

D:

Accurate scene notes describe device condition, location and collection authority, supporting later interpretations of artifacts; the separate questions call for volatility of live data, forensic working copy and preservation request or legal hold, while no prompt asks for this additional rule.

E:

Screen captures may omit access logs, versions, metadata and other provider-held material, so the source and scope must be identified; the separate questions call for volatility of live data, forensic working copy and preservation request or legal hold, while no prompt asks for this additional rule.

Question 286

Before examining a seized solid-state drive, an examiner attaches a hardware device that prevents forensic software from modifying stored content. Which technical control is being used?

  1. A recovery utility that writes repaired file-system entries to the source
  2. A forensic write blocker
  3. A password-reset utility
  4. A cloud synchronization client

Explanation

Correct Answer

B:

A write blocker restricts write operations during acquisition, helping preserve the source while the examiner documents and verifies the collection process.

Incorrect Answers

A:

Repair operations may change metadata or overwrite recoverable material on the seized drive; a write blocker prevents such modification during evidentiary acquisition.

C:

Password-reset tools can change authentication data and do not themselves establish nonmodification of source evidence.

D:

A synchronization client may generate additional writes and version changes, rather than protecting the seized source.

Question 287

A U.S. government investigator knows a service provider may delete subscriber records but has not yet obtained disclosure authority. A qualifying government preservation request is sent under the Stored Communications Act. What is its immediate legal function?

  1. A private litigant's informal demand to inspect the provider's servers
  2. A search warrant that compels content disclosure immediately
  3. Temporarily require preservation of specified records while lawful disclosure process is pursued
  4. A permanent government acquisition of subscribers' account rights

Explanation

Correct Answer

C:

Under 18 U.S.C. ยง 2703(f), qualifying governmental preservation requests require a provider to preserve relevant records temporarily; separate legal authority governs compelled disclosure.

Incorrect Answers

A:

Private demands do not activate the government-specific mandatory hold in section 2703(f); separate civil process and provider duties must be evaluated for private litigants.

B:

Disclosure warrants and legal process address access to content, but preservation under section 2703(f) holds existing records while the government seeks appropriate disclosure authority.

D:

Section 2703(f) preserves specified records for a statutory period and possible renewal; it does not transfer the service account or ownership of the subscriber's underlying data.

Question 288

A company believes a cloud screenshot proves all available user history was preserved. What limitation matters?

  1. Scope of cloud evidence
  2. Volatility of live data
  3. Forensic working copy
  4. Preservation request or legal hold
  5. Seizure and scene recording

Explanation

Correct Answer

A:

Screen captures may omit access logs, versions, metadata and other provider-held material, so the source and scope must be identified.

Incorrect Answers

B:

Memory, sessions and short-lived credentials may disappear on shutdown or delay, so legally authorized triage must assess order of collection; scope of cloud evidence addresses the distinct legal requirement stated in the facts.

C:

Analysis on a verified copy limits avoidable change to original media and supports reproducibility of findings; scope of cloud evidence raises a different threshold from this alternative.

D:

Timely authorized preservation can reduce loss of relevant data while the proper lawful production process is pursued; that concept must be distinguished from Scope of cloud evidence here.

E:

Accurate scene notes describe device condition, location and collection authority, supporting later interpretations of artifacts; the circumstances point to Scope of cloud evidence rather than that separate test.

Question 289

A laptop is seized but no record identifies its power state, user or location. What initial forensic phase was documented poorly?

  1. Forensic analysis
  2. Forensic reporting
  3. Forensic acquisition
  4. Seizure and scene recording

Explanation

Correct Answer

D:

Accurate scene notes describe device condition, location and collection authority, supporting later interpretations of artifacts.

Incorrect Answers

A:

Analysis examines recovered content and system artifacts to test hypotheses while preserving the provenance of extracted findings; seizure and scene recording is the issue raised by the described conduct.

B:

Reporting converts technical findings into a transparent account of methods, observations, limitations and supporting artifacts; the inquiry instead concerns Seizure and scene recording, with its own elements.

C:

Acquisition creates a controlled evidentiary copy under a documented process before substantive interpretation of data; the relevant step in this scenario is Seizure and scene recording.

Question 290

An examiner makes a bit-for-bit image using validated tools and logs the hash. Which investigation phase is this?

  1. Forensic acquisition
  2. Seizure and scene recording
  3. Forensic reporting
  4. Forensic analysis

Explanation

Correct Answer

A:

Acquisition creates a controlled evidentiary copy under a documented process before substantive interpretation of data.

Incorrect Answers

B:

Accurate scene notes describe device condition, location and collection authority, supporting later interpretations of artifacts; those prerequisites should not be confused with Forensic acquisition.

C:

Reporting converts technical findings into a transparent account of methods, observations, limitations and supporting artifacts; forensic acquisition addresses the distinct legal requirement stated in the facts.

D:

Analysis examines recovered content and system artifacts to test hypotheses while preserving the provenance of extracted findings; forensic acquisition raises a different threshold from this alternative.

Certified Fraud Examiner - Law (CFE - Law) Practice Tests