ACFE CFE - Law (Certified Fraud Examiner - Law) Practice Test 30

Question 290

An examiner makes a bit-for-bit image using validated tools and logs the hash. Which investigation phase is this?

  1. Forensic acquisition
  2. Seizure and scene recording
  3. Forensic reporting
  4. Forensic analysis

Explanation

Correct Answer

A:

Acquisition creates a controlled evidentiary copy under a documented process before substantive interpretation of data.

Incorrect Answers

B:

Accurate scene notes describe device condition, location and collection authority, supporting later interpretations of artifacts; those prerequisites should not be confused with Forensic acquisition.

C:

Reporting converts technical findings into a transparent account of methods, observations, limitations and supporting artifacts; forensic acquisition addresses the distinct legal requirement stated in the facts.

D:

Analysis examines recovered content and system artifacts to test hypotheses while preserving the provenance of extracted findings; forensic acquisition raises a different threshold from this alternative.

Question 291

A forensic specialist interprets deleted files and timeline metadata from a verified image. Which phase is in progress?

  1. Seizure and scene recording
  2. Forensic reporting
  3. Forensic acquisition
  4. Forensic analysis

Explanation

Correct Answer

D:

Analysis examines recovered content and system artifacts to test hypotheses while preserving the provenance of extracted findings.

Incorrect Answers

A:

Accurate scene notes describe device condition, location and collection authority, supporting later interpretations of artifacts; the circumstances point to Forensic analysis rather than that separate test.

B:

Reporting converts technical findings into a transparent account of methods, observations, limitations and supporting artifacts; forensic analysis is the issue raised by the described conduct.

C:

Acquisition creates a controlled evidentiary copy under a documented process before substantive interpretation of data; the inquiry instead concerns Forensic analysis, with its own elements.

Question 292

An examiner writes a reproducible method, limitations and exhibit list for court. Which stage is being completed?

  1. Seizure and scene recording
  2. Forensic acquisition
  3. Forensic analysis
  4. Forensic reporting

Explanation

Correct Answer

D:

Reporting converts technical findings into a transparent account of methods, observations, limitations and supporting artifacts.

Incorrect Answers

A:

Accurate scene notes describe device condition, location and collection authority, supporting later interpretations of artifacts; here the operative distinction is Forensic reporting.

B:

Acquisition creates a controlled evidentiary copy under a documented process before substantive interpretation of data; those prerequisites should not be confused with Forensic reporting.

C:

Analysis examines recovered content and system artifacts to test hypotheses while preserving the provenance of extracted findings; forensic reporting addresses the distinct legal requirement stated in the facts.

Question 293

A party receives a preservation notice covering relevant emails and deletes them routinely without adapting retention. Which risk arises?

  1. ESI spoliation sanctions
  2. Proportional and scoped production
  3. FRCP 37(e)
  4. Defensible search methodology

Explanation

Correct Answer

A:

Failure to take reasonable steps to preserve relevant electronically stored information can trigger remedies under applicable discovery rules when their conditions are satisfied.

Incorrect Answers

B:

Civil discovery limits demand attention to relevance, proportionality, privileges and privacy rather than indiscriminate transfer of whole personal accounts; that concept must be distinguished from ESI spoliation sanctions here.

C:

Rule 37(e) addresses loss of electronically stored information that should have been preserved and cannot be restored or replaced, with different remedy thresholds; the circumstances point to ESI spoliation sanctions rather than that separate test.

D:

Documenting relevant repositories, scope, search methods and exceptions helps support reasonable, transparent electronic discovery; eSI spoliation sanctions is the issue raised by the described conduct.

Question 294

A company discovers that mobile messages were erased despite anticipated litigation and there is no replacement evidence. Which U.S. rule may apply?

  1. ESI spoliation sanctions
  2. Defensible search methodology
  3. FRCP 37(e)
  4. Proportional and scoped production

Explanation

Correct Answer

C:

Rule 37(e) addresses loss of electronically stored information that should have been preserved and cannot be restored or replaced, with different remedy thresholds.

Incorrect Answers

A:

Failure to take reasonable steps to preserve relevant electronically stored information can trigger remedies under applicable discovery rules when their conditions are satisfied; the relevant step in this scenario is FRCP 37(e).

B:

Documenting relevant repositories, scope, search methods and exceptions helps support reasonable, transparent electronic discovery; here the operative distinction is FRCP 37(e).

D:

Civil discovery limits demand attention to relevance, proportionality, privileges and privacy rather than indiscriminate transfer of whole personal accounts; those prerequisites should not be confused with FRCP 37(e).

Question 295

An investigator separates litigation-relevant files from unrelated personal correspondence during discovery. Which legal control is illustrated?

  1. Proportional and scoped production
  2. ESI spoliation sanctions
  3. FRCP 37(e)
  4. Defensible search methodology

Explanation

Correct Answer

A:

Civil discovery limits demand attention to relevance, proportionality, privileges and privacy rather than indiscriminate transfer of whole personal accounts.

Incorrect Answers

B:

Failure to take reasonable steps to preserve relevant electronically stored information can trigger remedies under applicable discovery rules when their conditions are satisfied; proportional and scoped production raises a different threshold from this alternative.

C:

Rule 37(e) addresses loss of electronically stored information that should have been preserved and cannot be restored or replaced, with different remedy thresholds; that concept must be distinguished from Proportional and scoped production here.

D:

Documenting relevant repositories, scope, search methods and exceptions helps support reasonable, transparent electronic discovery; the circumstances point to Proportional and scoped production rather than that separate test.

Question 296

A data owner has preserved documents but refuses to describe the systems searched or collection exclusions. Which discovery risk remains?

  1. Defensible search methodology
  2. FRCP 37(e)
  3. ESI spoliation sanctions
  4. Proportional and scoped production

Explanation

Correct Answer

A:

Documenting relevant repositories, scope, search methods and exceptions helps support reasonable, transparent electronic discovery.

Incorrect Answers

B:

Rule 37(e) addresses loss of electronically stored information that should have been preserved and cannot be restored or replaced, with different remedy thresholds; the inquiry instead concerns Defensible search methodology, with its own elements.

C:

Failure to take reasonable steps to preserve relevant electronically stored information can trigger remedies under applicable discovery rules when their conditions are satisfied; the relevant step in this scenario is Defensible search methodology.

D:

Civil discovery limits demand attention to relevance, proportionality, privileges and privacy rather than indiscriminate transfer of whole personal accounts; here the operative distinction is Defensible search methodology.

Question 297

A prosecutor asks a witness to describe the last thing the witness personally saw. Which testimony constraint is addressed?

  1. Hearsay within hearsay
  2. Lay opinion under Rule 701
  3. Personal-knowledge foundation
  4. Rule 703 expert bases
  5. Expert opinion under Rule 702

Explanation

Correct Answer

C:

Rule 602 ordinarily requires evidence supporting a witness's personal knowledge of matters described, not mere repetition of speculation.

Incorrect Answers

A:

Each layer of out-of-court assertion offered for its truth must independently satisfy a permitted exclusion or exception; personal-knowledge foundation addresses the distinct legal requirement stated in the facts.

B:

A nonexpert opinion must be rationally based on perception, helpful and not founded on specialized expertise within Rule 702; personal-knowledge foundation raises a different threshold from this alternative.

D:

Experts may rely on otherwise inadmissible material when it is of a type reasonably relied upon in the field, with limits on revealing it to jurors; that concept must be distinguished from Personal-knowledge foundation here.

E:

Expert testimony must reflect qualification, sufficient facts, reliable methodology and reliable application so it assists the factfinder; the circumstances point to Personal-knowledge foundation rather than that separate test.

Question 298

An analyst expresses specialized causal opinions on a complex accounting technique. Which evidentiary regime governs?

  1. Hearsay within hearsay
  2. Lay opinion under Rule 701
  3. Personal-knowledge foundation
  4. Expert opinion under Rule 702

Explanation

Correct Answer

D:

Expert testimony must reflect qualification, sufficient facts, reliable methodology and reliable application so it assists the factfinder.

Incorrect Answers

A:

Each layer of out-of-court assertion offered for its truth must independently satisfy a permitted exclusion or exception; expert opinion under Rule 702 is the issue raised by the described conduct.

B:

A nonexpert opinion must be rationally based on perception, helpful and not founded on specialized expertise within Rule 702; the inquiry instead concerns Expert opinion under Rule 702, with its own elements.

C:

Rule 602 ordinarily requires evidence supporting a witness's personal knowledge of matters described, not mere repetition of speculation; the relevant step in this scenario is Expert opinion under Rule 702.

Question 299

A witness estimates ordinary speed from direct observation without technical modeling. Which category may fit?

  1. Lay opinion under Rule 701
  2. Rule 703 expert bases
  3. Personal-knowledge foundation
  4. Expert disclosure of bases
  5. Hearsay within hearsay
  6. Expert opinion under Rule 702

Explanation

Correct Answer

A:

A nonexpert opinion must be rationally based on perception, helpful and not founded on specialized expertise within Rule 702.

Incorrect Answers

B:

Experts may rely on otherwise inadmissible material when it is of a type reasonably relied upon in the field, with limits on revealing it to jurors; those prerequisites should not be confused with Lay opinion under Rule 701.

C:

Rule 602 ordinarily requires evidence supporting a witness's personal knowledge of matters described, not mere repetition of speculation; lay opinion under Rule 701 addresses the distinct legal requirement stated in the facts.

D:

Applicable procedural rules call for expert information and opinions to be disclosed in time and scope, subject to retained and nonretained expert distinctions; lay opinion under Rule 701 raises a different threshold from this alternative.

E:

Each layer of out-of-court assertion offered for its truth must independently satisfy a permitted exclusion or exception; that concept must be distinguished from Lay opinion under Rule 701 here.

F:

Expert testimony must reflect qualification, sufficient facts, reliable methodology and reliable application so it assists the factfinder; the circumstances point to Lay opinion under Rule 701 rather than that separate test.

Question 300

A witness offers testimony about a statement made in a record that itself quotes another person. Which caution arises?

  1. Personal-knowledge foundation
  2. Hearsay within hearsay
  3. Lay opinion under Rule 701
  4. Expert opinion under Rule 702

Explanation

Correct Answer

B:

Each layer of out-of-court assertion offered for its truth must independently satisfy a permitted exclusion or exception.

Incorrect Answers

A:

Rule 602 ordinarily requires evidence supporting a witness's personal knowledge of matters described, not mere repetition of speculation; the circumstances point to Hearsay within hearsay rather than that separate test.

C:

A nonexpert opinion must be rationally based on perception, helpful and not founded on specialized expertise within Rule 702; hearsay within hearsay is the issue raised by the described conduct.

D:

Expert testimony must reflect qualification, sufficient facts, reliable methodology and reliable application so it assists the factfinder; the inquiry instead concerns Hearsay within hearsay, with its own elements.

Certified Fraud Examiner - Law (CFE - Law) Practice Tests