THURSDAY: 4 August 2022. Morning paper. Time Allowed: 3 hours.
The paper is made up of a hundred (100) multiple choice questions. Answer ALL questions by indicating the letter (A, B, C or D) that represents the correct answer. Each question is allocated one (1) mark.
1. Emily, a Certified Fraud Examiner, is conducting a routine interview of an employee who does not know her. Which of the following BEST describes the professional interviewing practices that Emily should use in conducting the introduction phase of the interview.
A. Ask ritualist questions
B. Introduce herself and avoid titles
C. Establish rapport
D. All the above (1 mark)
2. Which of the following statements concerning court records is most accurate?
A. There are multiple databases that contain a comprehensive database of court documents from all court cases in every country
B. In most countries, court records are not public records and require judicial authorisation to access
C. When searching for records for a particular court case, a fraud examiner need only to search the central/federal court records as they serve as a repository for all cases heard at all court levels
D. In most countries, reliable court records are best obtained from the court in where the case was heard or
filed (1 mark)
3. Which of the following is a social physiological force that facilitates communication and makes the interviewee identify with a higher value beyond immediate self-interest?
A. Extrinsic rewards
B. Catharsis
C. Altruism
D. Recognition (1 mark)
4. Which of the following is a method of tracing illicit funds by comparing bank deposits with the suspect’s known legitimate income?
A. Expenditures method
B. Bank deposit analysis method
C. Net worth analysis method
D. Asset method (1 mark)
5. Which of the following is a recommended mechanic of interviewing?
A. The Interviewer should avoid taking written down questions to the interview
B. The interviewer should not record the interviewee without their consent
C. The interviewer should accord the interviewee privacy
D. All the above (1 mark)
6. Which of the following is an important element of conversation that is essential in conducting interviews but has little significance, such as “Good morning” and “How are you today?”
A. Catharsis
B. Ritualistic
C. Expression
D. Information exchange (1 mark)
7. When a fraud examiner prepares a memorandum reflecting the information furnished by a confidential source, how should the fraud examiner identify the source?
A. The fraud examiner should not write confidential source information in a memorandum
B. The fraud examiner should identify the source by his or her full name
C. The fraud examiner should identify the source using his or her initials
D. The fraud examiner should use symbols to denote the source’s identity (1 mark)
8. Which of the following statements is TRUE about seizing computers for investigation?
A. When a forensic investigator is seizing a running computer for examination, he can retrieve data from the computer directly via its normal interface if the evidence needed is volatile
B. When a forensic investigator is seizing a running computer, he should do a hard shut down
C. When a forensic investigator is seizing a computer that is shut down, they should not open it
D. All the above (1 mark)
9. When a suspect is confronted with circumstantial evidence of excess funds that the suspect cannot account for from legitimate known sources of funds, which of the following is NOT a defence that the suspect is likely to present?
A. The suspect claim that the extra funds are from inheritance from his father
B. The suspect claim that the extra funds are from an insurance compensation
C. The suspect claim that the extra funds are gifts or rewards from the organization’s vendors and contractors
D. The suspect claim that the extra funds are from his savings over a period of time (1 mark)
10. Before removing a computer system from a scene for further analysis, it is important to document the system’s setup with photographs or diagrams.
A) True
B) False (1 mark)
11. The intelligence level of an interview subject rarely has no effect on an investigator’s ability to accurately observe behavioral clues during an interview.
A) True
B) False (1 mark)
12. Circumstantial proof that would yield the best results when the suspect is using his illicit funds to accumulate wealth and acquire assets, thus causing his net worth to increase is referred to as:
A. The asset method
B. The expenditures method
C. The income method
D. Net worth analysis method (1 mark)
13. A CFO at a major company, is alleged to have committed financial statement fraud. During an admission-seeking interview with Fredrick the investigator, he states: “I know the employee’s job security depend on the company’s good performance. I am sure you did this to help the employees retain their jobs, Isn’t that right?” This interviewing technique is known as:
A. Rationalisation
B. Recognition
C. Altruism appeals
D. Benchmark Admission (1 mark)
14. Which one of the following should be done to prepare an organization for a formal fraud investigation?
A. Inform the managers of the employees who will be involved in the investigation
B. Inform the organization’s legal counsel when the investigation is about to commence
C. Inform management that the investigation is about to begin
D. All of the above (1 mark)
15. To preserve the confidentiality of a fraud investigation, management should always implement a blanket policy prohibiting employees from discussing anything related to employee investigations.
A) True
B) False (1 mark)
16. Which of the following is a limitation of conducting a public database search online?
A. Information from online databases must be checked for accuracy and also if the data is current and up to date
B. Online public records searches are limited in the area they cover, often requiring fraud examiners to search multiple jurisdictions
C. Online coverage of public records varies widely from jurisdiction to jurisdiction
D. All of the above (1 mark)
17. James, a Certified Forensic Fraud Examiner, is conducting an admission-seeking interview of Rose, a fraud suspect. James asks Rose: “Did you do take the money for the leisure, or there was a good reason?” Rose replies: “I had a good reason.” Which of the following is the most appropriate response to be made by James?
A. “What good reason would you have to steal?”
B. “That is not a good reason at all”
C. “Tell me the truth, stop lying”
D. “I see you had a good reason to do so” (1 mark)
18. Playing with an object while talking is an example of a displacement behavior for reducing nervousness that a subject might exhibit during an interview.
A) True
B) False (1 mark)
19. ABC Services is a new business, which has just been registered as a corporation in a particular country. ABC’s management wants to expand business outside of the country. Which of the following is most accurate?
A. Being incorporated in one country automatically gives ABC Corp rights to conduct business in most countries
B. ABC can only be incorporated in one country
C. ABC must register the business entity in the foreign jurisdiction in which it wishes to conduct business
D. All the above (1 mark)
20. Which of the following statements is TRUE regarding data mining?
A. Data mining is an effective way for fraud examiners to develop fraud targets for further investigation
B. Data mining is the science of searching large volumes of data for patterns
C. Data mining can be used to streamline raw data into understandable patterns
D. All of the above (1 mark)
21. Which of the following is a measure that can be taken to avoid alerting perpetrators who are under investigation?
A. Only inform those who need to know
B. Investigate during off hours
C. Know what information the suspect can access
D. All of the above (1 mark)
22. Which of the following is a data analysis tool that is effective in identifying indirect relationships and relationships with several degrees of separation?
A. Link diagram
B. Benford Law
C. Link analysis
D. All the above (1 mark)
23. Sospeter is conducting an admission-seeking interview with Gregory. After diffusing alibis, Gregory becomes withdrawn. Which of the following should Sospeter do?
A. Wait until the suspect makes a confession
B. Ask an alternative question
C. Ask a closed question
D. None of the above (1 mark)
24. During the analysis phase in digital forensic investigations, the fraud examiner’s primary concern is to:
A. Protect the availability of the evidence
B. Collect all incriminating evidence
C. Protect the integrity of the evidence
D. Protect the confidentiality of the evidence (1 mark)
25. Forensic Fraud Examiners when conducting interviews should be able to ask the right questions at the right time and to the right interviewee. There are questions that an interviewer should avoid, like double negative questions. Which of the following is a good example of a double negative question?
A. “You advanced yourself the company’s money, why did you do that?”
B. “When are you planning to return the money?”
C. “Didn’t you know that what you were doing is an offense?
D. “Is it that you just wanted extra money, or you had an emergency then?” (1 mark)
26. When reporting the results of fraud examination matters, the Certified Forensic Fraud Examiner (if qualified as an expert on such matters) may issue an opinion on which of the following?
A. Whether the entity’s financial statements conform to the International Financial Reporting Standards
B. The effectiveness of the entity’s internal controls
C. The effectiveness of the entity’s operations
D. All of the above (1 mark)
27. A fraud examiner is commissioned to conduct an organized crime investigation. He believes a particular commercial restaurant is being used as a front business for the suspect’s operation. Which of the following types of records would likely help the fraud examiner discover who owns the building?
A. Building permit records
B. Fire department records
C. Health department records
D. All the above (1 mark)
28. What is the purpose of conducting textual analytics as one of the fraud investigation techniques?
A. To identify warning signs of rogue employee behavior
B. To reveal patterns, sentiments, and relationships indicative of fraud
C. To measure the pressures/ incentives, opportunities, and rationalizations to commit fraud
D. All of the above (1 mark)
29. Robert, a forensic fraud examiner, is investigating a suspected embezzlement by one of XYZ Corporation’s employees. As part of the investigation, he is developing a financial profile of the suspect. Among other things, he wants to see if the suspect has made any significant real estate purchases since the embezzlement scheme began. Information on real estate transactions such as deeds, grants, transfers, and mortgages is usually found in
A. The jurisdiction’s land registry office
B. The local court clerk or judicial records agency
C. The jurisdiction’s organisational filing agency
D. All the above (1 mark)
30. During the introductory phase of the interview, the interviewer is expected to establish the theme of the interview. The interviewer should avoid certain terms. Which of the following is an example of those terms?
A. Fraud Investigation
B. Fraud examination
C. Forensic audit
D. All of the above (1 mark)
31. George, a forensic fraud examiner, has seized a computer’s hard drive as potential evidence in an investigation. He creates a memorandum to record the chain of custody and documents what item was received, when it was received, and from whom it was received. To meet the minimum standard for a chain of custody memorandum, what else would George need to include?
A. Information why the item was collected
B. The value of the item received
C. Where the item is maintained
D. None of the above (1 mark)
32. Which of the following documents is typically included with the account-opening documents for a corporation’s business account?
A. A signature card
B. Copies of corporate resolutions of the board of directors naming the person who may authorize payments on the account
C. Copies of corporate resolutions of the board of directors authorizing the opening of the account
D. All of the above (1 mark)
33. Which of the following is NOT true about fraud examination/investigation?
A. Every fraud examination/investigation should begin with the assumption that the case will end in litigation.
B. Fraud examination/investigation is the methodology of resolving fraud allegations from inception to disposition
C. Fraud examination/investigation is the methodology of resolving fraud issues from inception to disposition
D. The major objective of a fraud examination/investigation is to collect evidence that can be used in a court of law (1 mark)
34. Donald, is a public officer. He is accused of skimming money in the course of his employment. During an admission-seeking interview with Donald, the investigator states: “This is a big corporation with a lot of money. The money you took is immaterial and would not affect the financial stability of the organization Is that right?” This interviewing technique is known as:
A. Rationalisation
B. Extrinsic rewards
C. Depersonalising the victim
D. Altruistic appeals (1 mark)
35. Which of the following is a valid legal defense to allegations of entrapment against a fraud examiner who is a law enforcement officer?
A. The suspect made exculpatory statements
B. The fraud examiner had a suspicion of illegal conduct
C. The fraud examiner acted with adequate predication
D. There is proof of the suspect’s modus operandi
36. Which of the following types of record(s) is/are commonly available from county governments?
A. Building inspector records
B. Health and fire department records
C. Utility company records
D. All of the above (1 mark)
37. Alberto is a Certified Forensic Fraud Examiner. Alberto is conducting an admission-seeking interview of a fraud suspect. Alberto’s rationalisation theme is that the suspect was inadequately compensated for his work. But the suspect does not accept this theory. What should Alberto do at that point
A. Insist on the theory
B. Use another theory
C. Terminate the interview
D. Ask an alternative question (1 mark)
38. Which of the following refers to the inhibitor to communication in which the respondent confuses the order of events?
A. Inferential confusion
B. Unconscious confusion
C. Chronological confusion
D. None of the above (1 mark)
39. Which of the following is CORRECT in regard to the image acquisition process used in examinations involving digital evidence?
A. Imaging the hard drive involves taking an exact copy of the hard drive using forensic tools for purposes of collecting digital evidence which help to maintain the integrity of the evidence
B. Imaging the hard drive involves mining data in stored in the system
C. Acquiring the digital evidence from the suspect
D. All the above (1 mark)
40. A forensic fraud examiner is preparing his full case report at the conclusion of a fraud investigation. When including information regarding the interviews conducted during the examination, the fraud examiner should:
A. Report the details of each witness interview in a separate memorandum
B. Use signed copies of his notes from the interviews as the primary recording document
C. Include all information provided by all the witnesses, regardless of the relevance
D. Include only the facts provided by the witnesses that substantiate the fraud allegation. (1 mark)
41. Dan, a Certified Forensic Fraud Examiner, has obtained an oral admission from Pen, a fraud suspect. Dan reduced the confession into a short, concise written statement for Pen to sign. After Dan signed the statement, he remembered a significant detail that should have been included. How should Dan record this omitted information?
A. Add an addendum to the existing statement
B. Omit the information
C. Destroy the old statement and prepare a new one
D. None of the above (1 mark)
42. Which of the following is a common method fraudsters use to conceal illegally acquired assets?
A. Placing assets in probate
B. Transferring assets into another person’s name
C. Purchasing a used vehicle D. Creating a will to allocate assets at death (1 mark)
43. Jean is a Certified Forensic Fraud Examiner working on an investigation at ABC Ltd. During an interview, Paul, an employee at the company confesses to Jean that she has been embezzling money from the company. Which of the following pieces of information does Jean NOT have to obtain from Paul?
A. The approximate date Paul started embezzling the money
B. An estimate of the amount of money Paul embezzled
C. A statement stating that Paul’s conduct was an accident
D. Information about the involvement of other employees (1 mark)
44. Which of the following is an example of a data analysis function that can be performed to detect fraud through examination of accounts payable?
A. Sort asset values by asset type or monetary amount
B. Summarise cash disbursements by bank account
C. Select samples for asset existence verification
D. Identify debits to expense accounts outside the set default accounts (1 mark)
45. Which of the following pieces of information is NOT usually contained on the signature card of a personal bank account?
A. The thumbprint of the person opening the account
B. The telephone number of the person opening the account
C. The identification number of the person opening the account
D. The address of the person opening the account (1 mark)
46. Which of the following conditions indicates that it is the appropriate time to ask admission-seeking questions?
A. The interviewer believes there is a reasonable probability that the subject is responsible for the act in question
B. All reasonable investigative steps and sources have been exhausted
C. The time, place and subject matter discussed in the interview can be controlled by the interviewer
D. All of the above (1 mark)
47. In most jurisdictions, which of the following statements about bankruptcy court records is CORRECT?
A. Only the party filing for bankruptcy and the creditors may access the bankruptcy record
B. A bankruptcy file typically contains the bankruptcy petition or filing document
C. Bankruptcy documents are usually located in the jurisdiction where the most debt was incurred
D. All of the above (1 mark)
48. Characteristics of a well-written fraud examination report include which of the following characteristics?
A. Clarity
B. Impartiality
C. Accuracy
D. All of the above (1 mark)
49. Which of the following is something that might be revealed by analyzing a subject’s electronic payment records?
A. The cities and countries in which the subject conducts business
B. Assets the subject has purchased
C. Assets effectively controlled or held by the subject
D. All of the above (1 mark)
50. Dennis, a nonunion suspect, arrived at a scheduled admission-seeking interview with his manager and insisted that the manager be allowed to sit in. Should this interview be allowed to continue?
A. Yes, because a third-party witness to a confession is valuable
B. No, because the manager’s presence would not be lawful
C. Yes, because the manager is not an attorney and therefore may not interfere in a legitimate investigatory interview
D. No, because the presence of a third party could have negative impact (1 mark)
51. Link analysis is particularly useful when investigating which type of fraud scheme?
A. Shell company
B. Money laundering
C. Fictitious vendor
D. All of the above (1 mark)
52. When developing a suspect’s financial profile, an investigator should consider funds generated from loans. Which of the following loan amounts should the investigator use to establish the amount received?
A. Loan disbursement amount
B. Loan principal amount
C. Loan principal and interest amount
D. Loan proceeds (1 mark)
53. Which of the following steps is included in the planning phase of the data analysis process?
A. Building a profile of potential frauds
B. Articulating examination objectives
C. Determining whether predication exists
D. All of the above (1 mark)
54. Once a suspect has confessed in an interview, it is important to get copies of as much physical evidence as possible. For example, bank records are important. Which of the following is the recommended method for obtaining bank records after a confession?
A. Obtain a separate written authorization for the release of the bank records
B. Obtain an oral authorization for the release of the bank records
C. Request the subject to bring the bank records to the investigator’s office
D. Request to meet the subject the next day at his bank (1 mark)
55. In most jurisdictions, searches of all of the following sources of information can be useful in developing background information for pre-employment purposes EXCEPT:
A. Criminal court records searches
B. Income tax records
C. Bankruptcy records searches
D. Civil court records searches (1 mark)
56. James, a Certified Forensic Fraud Examiner, is conducting an admission-seeking interview. Which of the following strategies should James follow in his attempt to obtain admission?
A. Avoid potential liability by making the accusation in the presence of outsiders
B. Minimize sympathy and maximize the perception of wrongdoing
C. Conduct the interview in a firm, but also in a compassionate manner
D. Imply that time is of essence to pressure the subject into confessing (1 mark)
57. Keeping track of the amount of paper generated is one of the biggest challenges in fraud cases. Which of the following is generally NOT a recommended practice when organizing evidence?
A. Segregate documents by witness
B. File all papers chronologically
C. Make a document file
D. Establish a database early on (1 mark)
58. Generally, if a fraud examiner wants to submit a fraud case for prosecution, at what point should he send the case to government authorities?
A. After all witnesses have been interviewed
B. Immediately after obtaining an oral confession from the suspect
C. After the fraud examiner has finished collecting documentary evidence
D. After the investigation has been completed (1 mark)
59. An organization can lower employees’ expectation of privacy in their workspaces by issuing written privacy policies communicating the organization’s policy to search such spaces, it is not necessary for such policies to address personal electronic devices are not subject to searches because they private
A) True
B) False (1 mark)
60. Which one of the following information can be obtained from public real estate records in most jurisdiction?
A. A property’s historical sales price
B. The addresses of a property’s buyer and seller
C. Who financed the purchase of the property
D. All the above (1 mark)
61. Which of the following methods can be used to obtain documentary evidence?
A. Subpoena B. Written consent
C. Oral consent
D. All of the above (1 mark)
62. While examining a document, a fraud examiner notices some very faint indented writings that might aid the examination if revealed. Which of the following would be the fraud examiner’s BEST course of action in analysing these indented writings?
A. Performing the pencil scratching method
B. Performing the pencil shading method
C. Employing an expert to use an electrostatic detection apparatus
D. Applying a few drops of liquid and observing the liquid’s flow in the indentations (1 mark)
63. Undercover covert operations use disguise and deceit to obtain evidence directly from people involved in the offence, whereas surveillance operations use the skill of observation to gather information about individuals’ activity.
A) True
B) False (1 mark)
64. When reporting the results of a fraud examination, the Certified Forensic Fraud Examiner generally should include his opinion regarding the credibility of the witnesses.
A) True
B) False (1 mark)
65. During the analysis phase in digital forensic investigations, it is best to use just one forensic tool for identifying, extracting, and collecting digital evidence.
A) True
B) False (1 mark)
66. When a Certified Forensic Fraud Examiner is interviewing a suspect and in the course of the interview, the suspect becomes uneasy with the sensitive nature of the questions, it is recommended that the investigator do one of the following
A. Ask a non-sensitive question but later return to the sensitive questions
B. Ask an alternative question only
C. Keep away the sensitive questions
D. Ask Rationalization questions (1 mark)
67. A bank credit department generally maintains which of the following types of basic loan records?
A. The credit or loan file
B. The master appropriation file
C. The accounting journal
D. The cash record (1 mark)
68. Fraud examiners should take which of the following steps when securing a computer to enhance the machine analysis?
A. Examine and document the machine’s surroundings
B. Implement a system to manage the evidence
C. Inspect the machine for traps
D. All of the above (1 mark)
69. In data analysis, date fields are generally not a problem when importing and exporting data because standard formats are always used.
A) True
B) False (1 mark)
70. Closed questions are worded in a way that makes it difficult for the respondent to answer “yes” or “no.”
A) True
B) False (1 mark)
71. The terms “induction” and “deduction” are most often associated with which inhibitor to communication?
A. Chronological confusion
B. Inferential confusion
C. Trauma
D. None of the above (1 mark)
72. As a general rule, the more intelligent the witness, the less reliable his verbal and nonverbal clues of deception will be.
A) True
B) False (1 mark)
73. In interviews, introductory questions are designed to meet which of the following objectives?
A. To establish rapport
B. To establish the interview theme
C. To provide the introduction
D. All of the above (1 mark)
74. A forensic fraud examiner is conducting an investigation involving ABC Company, a multi-national, publicly traded company, and wants to obtain regulatory securities records regarding the company. Which of the following best describes where the fraud examiner should check to find these records?
A. Both domestic and foreign securities exchanges, including those in jurisdictions where the company has minimal business presence
B. Only the securities exchange in the jurisdiction where the company does most of its business
C. Only domestic securities exchanges located in the jurisdiction where the company is incorporated
D. Only domestic securities exchanges and exchanges in jurisdictions where the corporation has a substantial business presence (1 mark)
75. Which of the following data analysis functions is most useful in testing for hidden journal entries?
A. Aging data
B. Identifying duplicates
C. Gap testing
D. Statistical sampling (1 mark)
76. Edward calls Peter’s bank, claiming to be Peter, with the intention of stealing Peter’s identity. Edward tells the bank representative that he needs to make sure the bank has the correct government identification number on his account because he had noticed an error on his statement. The bank representative refuses to give the number. Which of the following is an example of the attempted offence by Edward?
A. Pretexting with a financial institution
B. False misrepresentation
C. Embezzlement
D. Bank fraud (1 mark)
77. When planning for an interview, which of the following steps should be taken?
A. Contemplate what the interview is intended to accomplish and state an objective
B. Ensure that the interview is held in a venue where the subject will feel comfortable
C. Prepare a brief list of key points to discuss during the interview
D. All of the above (1 mark)
78. If you are seizing a computer for forensic analysis, the investigator should seize copiers and any other devices connected to it.
A) True
B) False (1 mark)
79. Which of the following is TRUE about using computer-created metadata in forensic investigations?
A. Metadata information can help determine who wrote a document
B. Metadata information can help determine when a document was created
C. Metadata information can help determine who received a document
D. All of the above (1 mark)
80. What is mutual legal assistance (MLA)?
A. A formal request by the government of a country seeking information from a defendant residing in another country
B. A process by which countries request and provide assistance in criminal law enforcement matters
C. A letter whereby a criminal defendant requests that the government releases exculpatory information
D. A formal request by the courts of one country seeking judicial assistance from the courts of another country (1 mark)
81. Which of the following is a method of using software to extract usable information from unstructured data?
A. Extracting an exact copy of the data
B. Textual analytics
C. Benford‘s Law
D. None of the above (1 mark)
82. Which of the following witnesses should be interviewed by surprise?
A. Neutral witnesses
B. Volatile witnesses
C. Friendly witnesses
D. None of the above (1 mark)
83. Which of the following is a purpose of closing questions in interview situations?
A. To maintain goodwill
B. To reconfirm facts
C. To obtain additional facts
D. All of the above (1 mark)
84. In the course of establishing rapport, it is important that an interviewer observes a subject’s reaction to normal conversation to establish a baseline against which answers to more sensitive questions can be compared.
A) True
B) False (1 mark)
85. The records of a wire transfer identify the amount of the wire, where it was sent, and the date it was sent, but they do not identify who sent the wire.
A) True
B) False (1 mark)
86. Which of the following is a recommended procedure for protecting a fraud investigation’s case information?
A. Store all confidential documents in locked file cabinets or rooms accessible only to those who have a business need-to-know
B. Avoid talking about the investigation in public or in any place where other employees could hear the communications
C. Avoid using email or other electronic means to transmit confidential case information
D. All of the above (1 mark)
87. Which of the following is an indirect method of proving illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or legitimate sources of income?
A. Net-worth (or comparative net-worth) method of analysis
B. Expenditure method
C. Assets method
D. All the above (1 mark)
88. All of the following are signs of deceptive behavior in an interview subject EXCEPT:
A. The subject plays with an object during direct questioning
B. The subject appears casual and unconcerned
C. The subject frequently uses quiet hand gesture when talking
D. The subject sits casually (1 mark)
89. Which of the following best describes predication?
A. The means by which individuals justify/rationalize their unethical actions
B. The Planning phase of the investigative process
C. The totality of circumstance that would make a well trained and experienced professional believe that fraud has occurred, and that would be the basis of conducting an investigation
D. The evidence collection phase (1 mark)
90. It is general knowledge that when fraud suspects decide to confess, they tend to do one of the following as a way of releasing inner tension of their guilt and dishonest actions.
A. Provide an accurate amount of funds defrauded
B. Provide accurate number of incidences
C. Provide exact number of other individuals involved
D. None of the above (1 mark)
91. During an admission-seeking interview, Sylvia has just accused a suspect of committing a crime. The suspect begins to deny the accusation. Which of the following methods should Sylvia NOT apply to interrupt the denials?
A. Try to reason with the suspect
B. Reason with the suspect
C. Discuss other witnesses without naming them
D. All the above (1 mark)
92. Incriminating files that have been deleted and overwritten from a target computer might be possible to recover by forensic experts by use of forensic tools.
A) True
B) False (1 mark)
93. An experienced digital forensic expert is aware of where to looking for evidence in the computer. Computer created files are good sources of digital evidence. Which of the following is one of those computer-generated files?
A. Meta data
B. Events logs
C. System logs
D. All the above (1 mark)
94. Which of the following is TRUE in regard to fraud examination reports?
A. The conclusion part of the report should include the summary of the findings
B. The recommendation part of the report should make recommendation on the controls that need to be put in place to avoid future occurrences
C. The scope part of the investigation report should be based on the specific allegations and the period of the investigation
D. All the above (1 mark)
95. Which of the following should a fraud examiner consider before starting to conduct a computer investigation?
A. Whether there is a need to notify law enforcement
B. What to look for and where
C. If there is need to engage an outside digital forensic expert
D. All the above (1 mark)
96. Which of the following is TRUE in regard to volatility of digital evidence?
A. Once the integrity of digital evidence has been violated through manipulation or destruction it cannot be restored
B. Digital evidence is more volatile than tangible evidence because data can be easily altered
C. Failure to preserve the integrity of the digital evidence could result to evidence being inadmissible
D. All the above (1 mark)
97. In admission-seeking interviews, when an innocent person is directly accused, they react differently to the initial accusation than a culpable person. Which of the following reactions is expected from a culpable person?
A. Weak denials
B. Strong denials
C. Silence
D. None of the above (1 mark)
98. When an examiner is using textual analysis to look for words indicative of fraud, which of the following words would be indicative of pressure to commit fraud
A. Deadline
B. Trouble
C. Quota
D. All the above (1 mark)
99. Benford law can only work with natural numbers to look for patterns indicative of fraud. Which of the following is an example of a natural number?
A. Employees numbers
B. Telephone numbers
C. Vendors invoice numbers
D. Sales invoice numbers (1 mark)
100. Under textual analytics, which of the following words is indicative of rationalization to commit fraud?
A. Override
B. Write off
C. Deserve
D. Quota (1 mark)
