CERTIFIED FORENSIC FRAUD EXAMINER (CFFE)
MODULE TWO
PLANNING AND CONDUCTING FORMAL INVESTIGATIONS
THURSDAY: 8 December 2022. Morning Paper. Time Allowed: 3 hours.
Answer ALL questions indicating the letter (A, B, C or D) that represents the correct answer. This paper is made up of one hundred (100) Multiple Choice Questions. Each question is allocated one (1) mark.
1. The ability to conduct an effective interview for investigation purposes is paramount. The introduction phase of an interview during information or admission seeking interview is very important. Which of the following statement is NOT true?
A. The introduction phase sets the tone of the interview which can be positive or negative
B. The investigator should establish the theme of the interview during the introduction phase
C. During the introduction phase of an admission seeking interview of a suspect, the investigator should ask accusatory questions
D. None of the above
2. Which of the following statements concerning court records is NOT accurate?
A. There are multiple databases that contain a comprehensive database of court documents from all court cases in every country
B. In most countries, court records are public records
C. In most jurisdictions court records are best obtained from the court in where the case was heard or filed
D. None of the above
3. Professional interviews for purposes of investigations are useful in eliciting information as well as obtaining admissions from suspects. Which of the following is NOT true about professional interviewing?
A. Professional interviewing is a structured conversation with answer and question session
B. The interviewer must observe the elements of conversation to enable the conversation to go on for a good length of time
C. The interviewer must observe verbal and non-verbal, sign of deception from the interviewee so that he/she an indicate the interviewees veracity in the interview record
D. The interviewer must be informal when dealing with the interviewee
4. Which of the following is a method of tracing illicit funds comparing major expenditure with the suspect’s known legitimate income?
A. Expenditures method
B. Bank deposit analysis method
C. Net worth analysis method
D. Asset method
5. Which of the following is NOT a recommended method of interviewing?
A. The interviewer should prepare questions to take to the interviewee to make sure they do not forget important points
B. The interviewer should not record the interviewee without their consent
C. The interviewer should display interest maintaining eye contact
D. None of the above
6. Which of the following is an important element of a conversation that is essential in conducting interviews to ensure that the interviewee appreciates that the interviewer needs his/her help?
A. Persuasion
B. Ritualistic
C. Expression
D. Information exchange
7. Which of the following is NOT a recommended method of identifying a confidential source?
A. The fraud examiner should identify the source his or her full name
B. The fraud examiner should not identify the source using his or her initials
C. The fraud examiner should use symbols to denote the source’s identity
D. None of the above
8. Which of the following statements is TRUE about seizing computers for investigation?
A. When a forensic investigator is seizing a running computer for examination, he can retrieve data from the computer directly via its normal interface if the evidence needed is volatile
B. When a forensic investigator is seizing a running computer, he should do a graceful shut down
C. When a forensic investigator is seizing a computer that is shut down, they should open and review files needed
D. All the above
9. When a suspect is confronted with circumstantial evidence of excess funds that the suspect cannot account for from legitimate known sources of funds, which of the following is NOT a defense that the suspect is likely to present?
A. The suspect claims that the extra funds are from inheritance from his father
B. The suspect claims that the extra funds are from an insurance compensation
C. The suspect claims that the extra funds are from facilitation fees
D. The suspect claims that the extra funds are from his savings over a period of time
10. Which of the following statements is NOT correct in regard to an intelligent suspect’s interview?
A. The intelligence level of an interview subject rarely has no effect on an investigator’s ability to accurately observe behavioural clues during an interview.
B. Intelligence suspects will show stress when being deceptive
C. The intelligence level of an interview subject rarely has effect on an investigator’s ability to accurately observe behavioural clues during an interview.
D. None of the above
11. Circumstantial proof that would yield the best results when the suspect is using his illicit funds to accumulate wealth and acquire assets, thus causing his net worth to increase is referred to as:
A. The expenditures method
B. The income method
C. Net worth analysis method
D. None of the above
12. The CEO of Kalamu Ltd. company is alleged to have committed financial statement fraud. During an admission- seeking interview with Mr. Chris the investigator, he states: “I know the employee’s job security depends on the company’s good performance. I am sure you did this to help the employees retain their jobs, isn’t that right?” This interviewing technique is known as:
A. Depersonalisation
B. Sympathetic understanding
C. Benchmark admission
D. None of the above
13. Which of the following should NOT be done when preparing an organisation for a formal fraud investigation?
A. Inform the managers of the employees who will be involved in the investigation
B. Inform the organisation’s legal counsel when the investigation is about to commence
C. Inform management that the investigation is about to begin
D. Inform the whole organisation to make sure you get cooperation from everyone whose assistance may be required
14. Which of the following is NOT correct with regard to limitation of conducting a public database search online?
A. Information from online databases are always accurate, current and up to date
B. Online public records searches are limited in the area they cover, often requiring fraud examiners to search multiple jurisdictions
C. Online coverage of public records varies widely from jurisdiction to jurisdiction
D. All of the above
15. Daniel, a Certified Forensic Fraud Examiner, is conducting an admission-seeking interview of Joyce, a fraud suspect. Daniel asks Joyce: “Did you take the organisation’s money for leisure, or you had an emergency? Which of the following BEST describes this type of question Daniel?
A. Benchmark admission question
B. Alternative question
C. Double negative question
D. Complex question
16. Which of the following statements about Financial Intelligence Units (FIUs) is NOT true?
A. FIUs are national centers established to fight national financial crimes
B. Financial institutions file reports detailing suspicious or unusual financial activity with FIUs
C. FIUs are established to improve global cooperation and promote mutual exchange of financial intelligence information
D. None of the above
17. Which of the following statements is NOT true in regarding data mining?
A. Data mining is an effective way for fraud examiners to develop fraud targets for further investigation
B. Data mining is the art of searching large volumes of data for patterns
C. Data mining can be used to streamline raw data into understandable patterns
D. All of the above
18. Which of the following is NOT true with regard to volatility of digital evidence?
A. Digital evidence is more volatile than tangible evidence because data can be altered or destroyed more easily than tangible information
B. Once the integrity of digital evidence has been violated through alteration or destruction, it can usually be restored
C. The failure to preserve the integrity of digital evidence could result in evidence being inadmissible in a court proceeding
D. None of the above
19. Which of the following is a data analysis tool that is effective in identifying indirect relationships and relationships with several degrees of separation?
A. Link diagram
B. Benford Law
C. Textual analysis
D. None of the above
20. Peter is conducting an admission-seeking interview on Alex. After diffusing alibis, Alex becomes withdrawn. Which of the following should Peter do?
A. Calibrate the suspect
B. Ask an alternative question
C. Ask hypothetical questions
D. None of the above
21. During the analysis phase in digital forensic investigations, which of the following is the fraud examiner’s primary concern?
A. To protect disclosure of the evidence
B. To protect the integrity of the evidence
C. To protect the confidentiality of the evidence
D. All the above
22. Fraud Professionals when conducting interviews, should know what question to ask. Which of the following is a good example of an accusatory question?
A. “You took the company’s money without permission, why did you do that?”
B. “When are you planning to return the money?”
C. “Didn’t you know that what you were doing is not right?
D. “Is it that you just wanted extra money, or you had an emergency then?”
23. Fraud professionals when conducting interviews should be able to ask the right questions at the right time and to the right interviewee. There are questions that an interviewer should avoid, like double negative questions. Which of the following is a good example of a double negative question?
A. You advanced yourself the company’s money, why did you do that?”
B. “When are you planning to return the money?”
C. “Didn’t you know that what you were doing is not right?
D. “Is it that you just wanted extra money, or you had an emergency then?”
24. When reporting the results of fraud examination matters, a Certified Forensic Fraud Examiner may NOT issue an opinion on which of the following?
A. Whether the entity’s financial statements conform to the International Financial Reporting Standards
B. The effectiveness of the entity’s internal controls
C. The effectiveness of the entity’s operations
D. The suspect’s guilt
25. Which of the following is NOT a purpose of conducting textual analytics as one of the fraud investigation techniques?
A. To identify warning signs of rogue employee behaviour
B. To reveal patterns, sentiments, and relationships indicative of fraud
C. To measure the ethics and integrity of employees
D. All of the above
26. Jared is a forensic fraud examiner. He is conducting investigations on suspected corruption the procurement manager. As part of the investigation, he is developing a financial profile of the suspect. Among other things, he wants to see if the suspect has made any significant real estate purchases since the corruption scheme began. Information on real estate transactions such as deeds, grants, transfers, and mortgages is usually found in:
A. The local court clerk or judicial records agency
B. The jurisdiction’s organisational filing agency
C. The ministry of health
D. None of the above
27. During the introductory phase of an interview, the interviewer is expected to establish rapport. Which of the following
BEST describe establishing rapport?
A. Establishing a common ground
B. Establishing the purpose of the interview
C. Providing introduction
D. None of the above
28. Which of the following documents is NOT typically included with the account-opening documents for a corporation’s business account?
A. A letter from the registrar of companies
B. Copies of corporate resolutions of the board of directors naming the person who may authorise payments on the account
C. Copies of corporate resolutions of the board of directors authorising the opening of the account
D. All of the above
29. Which of the following is NOT true about fraud examination/investigation?
A. Every fraud examination/investigation should begin with the assumption that the case will end in litigation.
B. Fraud examination/investigation is the methodology of resolving fraud allegations from inception to disposition
C. The major objective of a fraud examination/investigation is to collect information that can be used in a court of law
D. None of the above
30. Mr. Kaloki is a public officer. He is accused of skimming money in the course of his duty. During an admission- seeking interview with Mr. Kaloki, the investigator states: “This is a big corporation with a lot of money. The money you took is immaterial and would not affect the financial stability of the organisation. Is that right?” This interviewing technique is known as:
A. Rationalisation
B. Extrinsic rewards
C. Altruistic appeals
D. None of the above
31. Which of the following is NOT a proper legal defense for entrapment against a fraud examiner who is a law enforcement officer?
A. The suspect made exculpatory statements
B. The fraud examiner had a suspicion of illegal conduct
C. The fraud examiner acted with adequate predication
D. There is proof of the suspect’s modus operandi
32. Which of the following types of records is/are NOT available from local governments?
A. Building inspector records
B. Health and fire department records
C. Court records
D. All of the above
33. Aurelia is a Certified Forensic Fraud Examiner. She is conducting an admission-seeking interview of a fraud suspect. Her rationalisation theme is that the suspect is being treated unfairly. The suspect does not accept this theory. What should Aurelia do?
A. Insist on the theory
B. Terminate the interview
C. Ask an alternative question
D. None of the above
34. Which of the following refers to the inhibitor to communication in which the respondent is unable to generalise a concrete experience?
A. Inferential confusion
B. Deduction confusion
C. Induction confusion
D. None of the above
35. Which of the following is NOT correct in regard to the acquisition process used in examinations involving digital evidence?
A. Imaging the hard drive help to maintain the integrity of the evidence
B. Printing the evidence record has no effect on the admissibility of evidence
C. Acquiring the digital evidence from the suspect
D. All the above
36. Paula, a Certified Forensic Fraud Examiner, has obtained an oral admission from John, a fraud suspect. Paula reduced the confession into a short, concise written statement for Jacky to sign. After Jacky signed the statement, he
remembered a significant detail that should have been included. Which of the following is a proper way of recording the omitted information?
A. Omit the information
B. Destroy the old statement
C. Prepare a new statement
D. None of the above
37. Which of the following is a common method fraudsters use to conceal illegally acquired assets?
A. Placing assets in probate
B. Selling the assets
C. Purchasing a used vehicle
D. None of the above
38. Zawadi is a Certified Forensic Fraud Examiner conducting an on an investigation at Amua Ltd. During an interview with Stacy, an employee at the Amua Ltd., Fanana confesses to Zawadi that she has been receiving rewards from the vendors. Which of the following pieces of information does Zawadi need NOT to obtain from Fanana?
A. The approximate date Fanana started receiving money from vendors
B. An estimate of the amount of money received so far
C. Information about the involvement of other employees of Amua Ltd.
D. She did not know that what she was doing was wrong
39. Which of the following is an example of a data analysis function that can be performed to detect fraud through examination of the assets account?
A. Sort asset values asset type or monetary amount
B. Summarise cash disbursements bank account
C. Identify debits to expense accounts outside the set default accounts
D. All the above
40. Which of the following conditions is NOT an appropriate time to ask admission-seeking questions?
A. When the interviewer believes there is a reasonable probability that the subject is responsible for the act in question
B. When all investigative steps and sources have not been exhausted
C. When the time, place and subject matter discussed can be controlled the interviewer
D. None of the above
41. In most jurisdictions, which of the following statements about bankruptcy court records is NOT correct?
A. The party filing for bankruptcy and the creditors may access the bankruptcy record
B. A bankruptcy file typically contains the bankruptcy petition or filing document
C. Bankruptcy documents are usually located in any jurisdiction where the debts occurred
D. None of the above
42. Which of the following is NOT a characteristics of a well-written fraud examination report?
A. Professional jargon
B. Impartiality
C. Accuracy
D. None of the above
43. Which of the following is something that might NOT be revealed analysing a subject’s electronic payment records?
A. The cities and countries in which the subject conducts business
B. Electronic transfer deposits made the subject
C. Assets effectively controlled or held the subject
D. All of the above
44. Link analysis is particularly useful when investigating which type of fraud scheme?
A. Asset misappropriation
B. Money laundering
C. Cash skimming
D. Cash Theft
45. When developing a suspect’s financial profile, an investigator should consider funds generated from loans. Which of the following loan amounts should the investigator use to establish the amount received?
A. Loan disbursement amount
B. Loan principal amount
C. Loan principal and interest amount
D. None of the above
46. Which of the following steps is NOT included in the planning phase of the data analysis process?
A. Building a profile of potential frauds
B. Articulating examination objectives
C. Verifying data
D. All of the above
47. Once a suspect has confessed in an interview, it is important to get copies of as much physical evidence as possible. For example, bank records are important. Which of the following is a recommended method for obtaining bank records after a confession?
A. Obtain an oral authorisation for the release of the bank records
B. Request the subject to bring the bank records to the investigator’s office
C. Request to meet the subject the next day at his bank
D. None of the above
48. In most jurisdictions, searches of all of the following sources of information can be useful in developing background information for pre-employment purposes EXCEPT:
A. Criminal court records searches
B. Bankruptcy records searches
C. Civil court records searches
D. None of the above
49. Isaac, a Certified Forensic Fraud Examiner, is conducting an admission-seeking interview. Which of the following is a good strategy of obtaining an admission?
A. Avoid asking accusatory questions in the presence of outsiders
B. Maximise sympathy and avoid condemnation
C. Conduct the interview in a firm manner without showing compassion
D. All the above
50. Keeping track of the amount of paper generated is one of the biggest challenges in fraud cases. Which of the following is generally NOT a recommended practice when organising evidence?
A. Segregate documents witness
B. File all papers chronologically
C. Make a document file
D. Establish a database early into the investigation
51. Generally, if a fraud examiner wants to submit a fraud case for prosecution, at what point should he send the case to government authorities?
A. After all witnesses have been interviewed
B. Immediately after obtaining an oral confession from the suspect
C. After the fraud examiner has finished collecting documentary evidence
D. None of the above
52. If a fraud examiner when conducting a forensic document examination notices some very faint indented writings, which of the following would NOT be the fraud examiner’s BEST course of action in analysing these indented writings?
A. Performing the pencil scratching method
B. Performing the pencil shading method
C. Use fraud examiner to conduct the analysis
D. None of the above
53. When a Certified Forensic Fraud Examiner is interviewing a suspect and in the course of the interview, the suspect becomes uncomfortable with the sensitive nature of the questions. Which of the following BEST describe what the investigator should do under the circumstances?
A. Ask double negative questions
B. Stop asking sensitive questions completely
C. Ask an alternative question only
D. None of the above
54. A bank credit department generally maintains which of the following types of loan records?
A. The credit or loan file
B. The master appropriation file
C. The accounting journal
D. The cash record
55. Which of the following is ACCURATE in regard to closed questions?”
A. They are worded in a way that makes it difficult for the respondent to answer “yes” or “no.
B. They are worded in a way that, the respondent can only answer “yes” or “no.
C. They are worded in a way that makes it difficult for the respondent to answer “yes”
D. They are worded in a way that makes it difficult for the respondent to answer “no”
56. The terms “induction” and “deduction” are most often associated with which inhibitor to communication?
A. Chronological confusion
B. Physiological confusion
C. Trauma
D. None of the above
57. In interviews, introductory questions are designed to meet which of the following objectives?
A. To establish the truth
B. To establish the credibility of the witness
C. To get commitment for assistance
D. All of the above
58. Which of the following data analysis functions is most useful in testing for hidden journal entries?
A. Aging data
B. Identifying duplicates
C. Join function
D. None of the above
59. Ali Baba’s calls Baba’s bank, claiming to be Baba, with the intention of stealing Dorothy’s identity. Ali tells the bank representative that he needs to make sure the bank has the correct government identification number on his account because he had noticed an error on his statement. The bank representative refuses to give the number. Which of the following is an example of the attempted offence Ali?
A. Corruption
B. Embezzlement
C. Bank fraud
D. None of the above
60. When planning for an interview, which of the following steps should the interviewer NOT take?
A. Contemplate what the interview is intended to accomplish and state an objective
B. Ensure that the interview is held in a venue where the subject will not be comfortable
C. Prepare a brief list of key points to discuss during the interview
D. All of the above
61. Which of the following is NOT correct in regard to Meta Data?
A. Metadata information can help determine who wrote a document
B. Metadata information can help determine when a document was created
C. Metadata is a computer-generated file which can be a good source of evidence
D. Metadata is a user created file which can be a good source of evidence
62. Which of the following is ACCURATE in regard to mutual legal assistance (MLA)?
A. A formal request the government of a country seeking information from a defendant residing in another country
B. A process which countries request and provide assistance in civil law enforcement matters
C. A letter wherea criminal defendant requests that the government releases exculpatory information
D. None of the above
63. Which of the following is a method of using software to extract usable information from unstructured data?
A. Extracting an exact copy of the data
B. Data analytics
C. Benford Law
D. None of the above
64. Which of the following witnesses should be interviewed second last?
A. Neutral witnesses
B. An accomplice witness
C. Corroborative witness
D. None of the above
65. Which of the following is NOT correct in regard to closing questions in interview situations?
A. The purpose of closing questions is to maintain goodwill
B. The purpose of closing questions is to reconfirm facts
C. Closing questions can be, open, closed or leading questions
D. None of the above
66. Which of the following is NOT a recommended procedure for protecting a fraud investigation’s case information?
A. Store all confidential documents in locked file cabinets or rooms accessible only to those who have a business need-to-know
B. Avoid talking about the investigation in public or in any place where other employees could hear the communications
C. Using email or other electronic means to transmit confidential case information
D. All of the above
67. Which of the following is an indirect method of proving illicit income circumstantially showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or legitimate sources of income?
A. Income method
B. Expenditure method
C. Assets method
D. None of the above
68. All of the following are signs of deceptive behavior in an interview subject EXCEPT:
A. The subject plays with an object during direct questioning
B. The subject appears casual and unconcerned
C. The subject does not maintain eye contact
D. None of the above
69. Which of the following is ACCURATE in regard to predication in relation to investigations?
A. The means which individuals conceal their fraudulent activities
B. The basis of conducting an investigation based on rumour that fraud has occurred
C. The basis of conducting an investigation based on sufficient suspicion that fraud has occurred
D. All the above
70. It is general knowledge that when fraud suspects decide to confess, they tend to do one of the following as a way of releasing inner tension of their guilt and dishonest actions.
A. Provide lesser estimate of the amount of funds defrauded
B. Provide accurate number of incidences
C. Provide exact number of other individuals involved
D. None of the above
71. During an admission-seeking interview, Terry accuses a suspect of committing fraud. The suspect begins to deny the accusation. Which of the following methods should Terry NOT do to interrupt the denials?
A. Reason with the suspect
B. Discuss the inconsistent statements made the suspect
C. Try discuss with the suspect
D. All the above
72. An experienced digital forensic expert is aware of where to look for evidence in the computer. Computer created files are good sources of digital evidence. Which of the following is NOT one of those computer-generated files?
A. Application logs
B. Events logs
C. Emails and user generated files
D. None of the above
73. Which of the following is NOT true with regard to fraud examination reports?
A. The conclusion part of the report should include the recommendations on actions to be taken based on the evidence collected
B. The recommendation part of the report should make recommendation on the controls that need to be put in place to avoid future occurrences
C. The scope part of the investigation report should be based on the specific allegations and the period of the investigation
D. All the above
74. Which of the following is NOT one of the things a fraud examiner should consider before starting to conduct a computer investigation?
A. Whether there is a need to notify law enforcement
B. Running through the data to look for evidence
C. If there is need to engage an outside digital forensic expert
D. None of the above
75. Which of the following is NOT true in regard to volatility of digital evidence?
A. Integrity of digital evidence if violated through manipulation or destruction can be restored
B. Digital evidence is more volatile than tangible evidence because data can be easily altered
C. Failure to preserve the integrity of the digital evidence could result to evidence being inadmissible
D. All the above
76. In admission-seeking interviews, when an innocent person is directly accused, they react differently to the initial accusation than a culpable person. Which of the following is NOT a reaction expected from a culpable person?
A. Weak denials
B. Strong denials
C. Silence
D. None of the above
77. When an examiner is using textual analysis to look for words indicative of fraud, which of the following words would be indicative of pressure to commit fraud
A. Deadline
B. Deserve
C. Write off
D. All the above
78. Benford Law can only work with natural numbers to look for patterns indicative of fraud. Which of the following is an example of natural number?
A. Telephone numbers
B. Vendors invoice numbers
C. Sales invoice numbers
D. None of the above
79. In textual analytics, which of the following word is indicative of rationalisation to commit fraud
A. Override
B. Write off
C. Entitled
D. Quota
80. Lawrence, a nonunion suspect, arrived at a scheduled admission-seeking interview with his manager and insisted that the manager be allowed to sit in. Should this interview be allowed to continue?
A. No, because the presence of a third party would undermine the possibility of obtaining a confession.
B. No, because the manager’s presence would be unlawful.
C. No, because the manger is not a lawyer
D. Yes, because a third-party witness to a confession is valuable in court
81. Which of the following is a type of informational interview questions?
A. Narrative questions
B. Alternative questions
C. Double negative questions
D. None of the above
82. Which of the following is an appropriate moral excuse to include in a signed confession?
A. “I don’t mean to do it.”
B. “I didn’t do it.”
C. “I didn’t mean to cause any harm.”
D. “I didn’t know it was illegal.”
83. Which of the following is NOT true in regard to digital forensic investigations?
A. During the analysis phase in digital forensic investigations, the fraud examiner should look for inculpatory evidence.
B. During the analysis phase in digital forensic investigations, the fraud examiner should look for exculpatory evidence.
C. During the analysis phase in digital forensic investigations, the fraud examiner should look for inculpatory evidence only
D. During the analysis phase in digital forensic investigations, the fraud examiner’s primary concern is to protect the integrity of the digital evidence.
84. Which of the following is NOT a characteristic of a financial vehicle that a fraudster would be looking for to conceal assets?
A. Accessibility
B. Security
C. Liquidity
D. Transparency
85. When tracing financial transactions, the method that involves using the subject’s books and records to analyse the relationship between the subject’s receipt and subsequent disposition of funds or assets is called?
A. The direct method
B. The asset method
C. The bank records method
D. The indirect method
86. Which of the following BEST describes letter rogatory?
A. A letter in which a judge in one country orders the government in another country to release a defendant from jail
B. A formal request the government of a country seeking information from a defendant residing in another country
C. A formal request the courts of one country seeking judicial assistance from the courts of another country
D. A letter wherea criminal defendant requests that the government releases exculpatory information
87. Which of the following is a NOT a type of informational interview questions?
A. Leading questions
B. Closed questions
C. Alternative question
D. Closing Questions
88. Jared, a Certified Forensic Fraud Examiner, is conducting an admission-seeking interview of Wanabe, a fraud suspect. Jared asked Wanabe: “Did you just want extra money, or did you do this because you had an emergency?” Which of the following BEST describe this type of question?
A. Open question
B. Narrative question
C. Double negative question
D. None of the above
89. In taking a verbal confession, which of the following items of information should the interviewer NOT obtain?
A. The accused’s motive for the offence
B. Estimates of the number of instances, dates and amounts involved
C. That the accused did not know that the conduct was wrong
D. All of the above
90. Which of the following is NOT a challenge of cloud forensics not faced in traditional forensic practices?
A. Lack of frameworks and specialist tools
B. Accessibility of information
C. Lack of data control
D. All of the above
91. D is conducting a fraud examination of S, an employee at his organisation, a government entity. D has strong reason to believe that S has incriminating evidence on a personal smart phone that he brings to work. Which of the following statements is most ACCURATE?
A. In most countries, D may search the phone if his organisation has a search policy and employees are aware that personal smart phones are subject to search.
B. D may conduct search of S’s smart phone because S’s privacy rights do not attach to the contents of smart phones.
C. S has an international right to privacy for information on his personal smart phone, and D must obtain a search warrant to search the device.
D. Employees have no expectation of privacy for information on personal devices they bring to work, so D may search the phone
92. Which of the following is NOT true in regard to the types of information that computer forensics experts typically can recover from computer systems?
A. Computer forensics specialists can recover time and date information about files
B. Computer forensics specialists can recover deleted documents that have been overwritten
C. Computer forensics specialists can recover information about websites visited
D. All of the above
93. A fraud examiner is conducting textual analytics on a journal entry data and runs a keyword search using the terms deadline, quota, and trouble. These words are indicative of which of the following fraud risk?
A. Pressure
B. Capability
C. Opportunity
D. Rationalisation
94. Which of the following is NOT an example of a data analysis function that can be performed to detect fraud through an examination of the general ledger?
A. Create sales and purchases comparison reports
B. Analyse and confirm specific ledger accounts for legitimate transaction activity
C. Calculate financial ratios
D. All of the above
95. Which of the following is a core data analysis function that CANNOT be performed with most data analysis software applications?
A. Sorting
B. Joining files
C. Duplicate searches
D. None of the above
96. Which of the following BEST describes the limitation of Benford Law?
A. Benford Law can only be applied to data sets listed in currency amounts.
B. Benford Law applies best to data sets with three-digit numbers.
C. Benford Law cannot be applied to data sets with non-natural numbers, such as cheque or invoice numbers.
D. Benford Law only works on data sets with assigned numbers, such as bank account or telephone numbers.
97. Brown owns a real estate company. He notices paint expenses have increased substantially from the previous year, which is not expected because the company had much less business this year and they painted fewer houses. Which of the following data analysis functions would be most useful in helping Brown determine if cost of paint is proportionate to the houses painted?
A. Link analysis
B. Data Analysis
C. Correlation analysis
D. None of the above
98. Text-based data is typically what type of data:
A. Structured data
B. Unstructured data
C. Documentary data
D. Natural data
99. Which of the following steps is included in the preparation phase of the data analysis process?
A. Determining examination objectives
B. Develop a profile of potential frauds
C. Determining whether predication exists
D. Cleansing and normalising data
100. Which of the following is NOT a recommended approach of dealing with a hostile or argumentative respondent during an interview?
A. Make it difficult for the interviewee to say “no”
B. Attempt to reason with the interviewee
C. Disarm the interviewee agreeing with his/her points where possible
D. Avoid reacting to the interviewee’s hostile behaviour
………………………………………………………………………