CFE-Investigation ACFE Certified Fraud Examiner (CFE) - Investigation Free Practice Exam Questions (2025 Updated)

The2014 International Fraud Examiners Manualexplains:

“Often, the most important evidence exists only in the form of volatile data (e.g., RAM)… If the evidence that a formally trained computer investigator needs to collect exists only in the form of volatile data stored in volatile computer memory such as RAM, and the data is expected to disappear when the computer is shut down, he should collect the data live from the suspect computer.”

Also,

“If the computer is off, leave it off… Booting up a system can alter its files… Accordingly, turning a system on could damage and taint any evidence.”

Thus, themost accurate statementisD— live data collection may be performed directly if volatile data is required.

“Introductory questions should be designed to establish rapport… Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Jason’s small talk about sports and compliments is clearly rapport building

During admission-seeking interviews, when suspects persist with denials or alibis, examiners are trained to diffuse them. Accepted techniques include:

Discussing testimony of witnesses,

Displaying physical evidence, and

Downplaying the strength of evidence.

However, manuals caution that discussing a suspect’sprior deceptionsis not an effective or recommended method to diffuse alibis. It risks confrontation and may damage rapport, reducing chances of confession.

Therefore, optionCis the exception.

Nonverbal deception cues include feigned unconcern, slouching, chewing objects, and manipulating clothing. Michelle’s conduct (chewing pen cap, picking at fabric, appearing unconcerned) matches these signs ofdeception.

TheFraud Examiners Manualexplains:

“Benford’s Law applies to data that is not assigned (such as IDs or phone numbers) but that occurs naturally in transactions. For example, payment amounts, invoice values, and expense reimbursements are well suited.”

Thus,payment amountsare best suited for Benford’s Law.

TheFraud Examiners Manualclearly states:

“Accessing information set to private could result in claims under privacy laws. Thus, information on social media sites that is restricted by privacy settings could result in liability for fraud examiners due to violation of users’ privacy rights.”

Therefore,D is correct

TheFraud Examiners Manualadvises avoiding prematurely alerting perpetrators. Recommended methods include:

“Conducting investigations at times when the suspect is not present (such as nonbusiness hours)”.

This avoids tipping off suspects.

When a respondent says “I’m too busy,” it can be diffused by stressing “the interview will be short, the interviewer is already there, the project is important, [and] the interview will not be difficult”.

Thus, stressing brevity is the recommended reaction.

Digital forensics guidance stresses:

If the computer isoff,do not turn it on, because booting will alter files and timestamps.

If the computer isonand volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅Answer: A. If Lucas's computer is running, Nobles may retrieve data… if the evidence exists only in volatile data

TheFraud Examiners Manualclarifies:

“The recommendations section is optional, and there might be instances where the fraud examiner wishes to discuss remedial measures or specific recommendations in a separate document”.

The Prep guide also states: “A written report might include a section for recommendations”.Thus, it isnot requiredin every report.

Both the Manual and CFE Prep guides emphasize that forensic imaging is essential because:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging… allows a fraud examiner to view and analyse… without altering the original data in any way”.

A forensic image is anexact, sector-by-sector copyof the drive. Thus, imaging preserves evidence integrity.

Referring to the informant in the memorandum using the informant's initials

Explanation: Best practice requires that informants be identifiedonly by symbols (e.g., I-1, I-2), not by initials, to protect their identity. Cash payments are acceptable but must be accompanied by areceipt.

Observing signs of wealth (sports car, home remodeling) may raise suspicion, but by itself it doesnot provide sufficient predicationto accuse or notify management of fraud. The proper next step is to conduct discreet inquiries to determine if further evidence exists before escalating.

For publicly traded companies, the best source for information on officers and directors is regulatory securities records. These records typically include “identification of officers and directors, financial statements, significant owners, and accountants and attorneys”.

TheFraud Examiners Manualstates:

“Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction… emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive”.

Thus, statement C isNOT true.

“Credit card records… show card purchasing limits, previous payment history, account balance,when and where the subject has travelled, restaurants frequented, and assets acquired. In short, these records show the movements and habits of the person”.

Therefore,Bis correct.

“The failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding, or, even if admitted, it might not be given much weight because evidence of questionable authenticity does not provide reliable proof.”

Therefore,D is the most accurate statement.

The2014 International Fraud Examiners Manualprovides examples of data analysis for accounts payable:

“Examples of data analysis queries that can be performed to help detect fraud through examination of accounts payable include:

• Audit paid invoices for manual comparison with actual invoices.

•Summarise large invoices by amount, vendor, etc.

• Identify debits to expense accounts outside of set default accounts.

• Reconcile cheque registers to disbursements by vendor invoice.”

While other functions apply to payroll or asset management, themost effective function for accounts payablefraud detection is tosummarize large invoices by amount and vendor.

TheFraud Examiners Manualwarns against phrasing admissions as direct questions using emotive terms:

“The admission-seeking interview begins with a direct accusation… The accusation should be phrased as though the accused’s guilt has already been established. Emotive words such as steal, fraud, and crime should be avoided… Wrong: ‘Did you do this?’”.

Thus, phrasing the question as“Did you steal the money?”is least effective.