Free Practice Questions for ACFE CFE-Fraud-Investigations-and-Legal-Issues Exam

Digital forensics guidance stresses:

If the computer is off, do not turn it on, because booting will alter files and timestamps.

If the computer is on and volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅ Answer: A. If Lucas ' s computer is running, Nobles may retrieve data… if the evidence exists only in volatile data

The correct answer is B. False. The CFE Manual clearly distinguishes tax evasion from tax avoidance. It explains that tax evasion refers to fraudulent or illegal actions taken to avoid reporting or paying taxes. By contrast, tax avoidance is a legal means of lowering one’s tax bill through legitimate deductions, credits, and shelters. Therefore, if Mary is using lawful deductions and credits to reduce her taxes, she is not committing tax evasion; she is engaging in tax avoidance.

The Manual emphasizes that the major difference between the two concepts is legality and intent. Tax evasion involves wrongful conduct, false reporting, concealment, or intentional misrepresentation. Tax avoidance, on the other hand, involves using lawful provisions of tax rules to reduce liability. The Manual also notes that a person accused of tax crimes may defend themselves by arguing that they were engaged in avoidance, not evasion, when they used legitimate deductions, credits, or shelters.

Because the question specifically says Mary used legal means and legitimate deductions and credits, her conduct falls squarely within the concept of tax avoidance, not evasion. Therefore, the statement is false, and B is the correct answer.

The Fraud Examiners Manual lists specific queries for accounts payable analysis, including:

“Review recurring monthly expenses and compare to posted/paid invoices.”.

While comparing book vs. tax depreciation applies to asset management (not A/P), and identifying paycheck anomalies applies to payroll (not A/P), the most effective A/P-specific test is the recurring expense comparison. Hence, C is correct.

Best practice for signed statements:

Fraud examiners should prepare the statement, keep it concise, and ensure voluntariness and intent are clear.

While not legally required, it is recommended that two individuals witness the signing.✅ Answer: C. Have two individuals witness the signing of the document when possible

The Financial Action Task Force (FATF) Recommendations, as cited in the Fraud Examiners Manual, require enhanced due diligence in correspondent banking relationships. Specifically, banks must “avoid correspondent banking with shell banks” and ensure the foreign institution is properly licensed and regulated.

This means financial institutions must confirm that the foreign correspondent bank holds the necessary licenses or certifications to operate legitimately.

Other options (branch addresses, tax statements, or client loan profiles) are not mandated under FATF’s correspondent banking due diligence requirements. The most critical factor is verifying the correspondent institution’s legal authorization (licenses/certifications) to prevent money laundering and terrorist financing.

Within CFE investigation guidance on data analysis, predictive approaches are framed as using analytical techniques (including statistical processes and machine learning) to identify patterns and outliers that can indicate fraud risk and, importantly, help detect a fraudulent situation earlier than traditional methods. Predictive analytics is not limited to one specific technology such as layered neural networks (A); neural networks can be one possible technique, but predictive analytics is broader than that. Option B describes robotic process automation (RPA)—software that imitates human actions to automate routine tasks—rather than predictive analytics. Option D describes artificial intelligence in a general sense (systems performing “human tasks” like perception and decision-making), which is also broader and not specific to predictive modeling. The most accurate description is therefore C: predictive analytics uses historical data along with statistical analysis and machine learning methods to build models that reflect patterns/trends and generate projections about likely future outcomes (e.g., predicting which transactions, vendors, employees, or accounts are higher-risk).

Guidance on reports:

“A fraud examination report should be accurate, clear, and impartial. The fraud examiner should avoid technical jargon where possible and write in plain language so that readers without specialized knowledge can understand”.

Reports should only include relevant, factual findings—not every detail or opinion.

So, the most accurate statement is that jargon should be avoided.

The correct answer is A. In common law systems, authentication is the process of showing that an item of evidence is what the proponent claims it is. Federal Rule of Evidence 901 states that to satisfy the authentication requirement, the party offering the evidence must produce enough proof to support a finding that the item is what that party claims. This is the core purpose of authentication.

Option B is incorrect because records, including many digital records, can often be authenticated through testimony or certification from a person with knowledge, such as a custodian of records, depending on the applicable rule and context. Option C is wrong because authentication is not something that must be “reviewed and voted on” by a jury as a prerequisite; it is an evidentiary foundation issue generally handled by the court. Option D is also incorrect because even properly authenticated evidence must still be relevant to be admissible. Authentication and relevance are separate requirements, and satisfying one does not eliminate the need for the other. For CFE purposes, the essential idea is that authentication establishes genuineness and identity, so A is the correct answer.

The 2014 International Fraud Examiners Manual and CFE Prep - Investigations explicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer is C.

The CFE Prep – Investigations notes:

“Court records are best obtained from the jurisdiction in which they were filed… The most accurate records are maintained by the court of original jurisdiction, not global or aggregated databases.”

Thus, the best place for Sam is the local court of jurisdiction, not a global database.