Mixed Deck — All CFE Topics Flashcards

Which legal principle ensures that digital evidence must not be altered?

Answer: Integrity

Integrity in digital forensics refers to the principle that digital evidence must remain complete and unaltered from the moment of collection throughout the entire investigation and legal process. Maintaining integrity ensures that the evidence presented in court is authentic and reliable, preventing any claims of tampering or manipulation. This is often achieved through hashing and strict chain of custody.

What ethical consideration is most relevant to ethical obligations & professional conduct in CFE practice?

Answer: Maintaining confidentiality and acting in the best interest of stakeholders

Maintaining confidentiality and acting in the best interest of stakeholders is the cornerstone ethical consideration for ethical obligations & professional conduct in professional practice.

A forensic examiner is analyzing Slack workspace data exported by a corporate administrator. Which limitation must be disclosed when presenting this evidence?

Answer: Administrator-exported data may exclude direct messages in free workspaces

Slack's free-tier export does not include direct messages, meaning key communications may be absent from the evidence set.

A forensic examiner discovers that two departments within the same organization have conflicting accounts of an incident. The best first step is to:

Answer: Conduct separate interviews to understand each perspective before drawing conclusions

Separate interviews allow each party to speak freely and help the examiner understand the root of the conflict without bias.

How does continuing education relate to legal frameworks & regulatory standards for CFE certified professionals?

Answer: It ensures professionals stay current with evolving standards and best practices

Continuing education ensures CFE professionals stay current with evolving standards, technologies, and best practices in legal frameworks & regulatory standards, maintaining competency throughout their careers.

A CFE is investigating a Ponzi scheme where the operator commingled investor funds with personal accounts. Which forensic accounting method is most appropriate to determine each victim's net loss?

Answer: Net winner/net loser analysis using a tracing-of-funds approach

Net winner/net loser analysis traces each investor's deposits and withdrawals to determine whether they received more or less than they contributed, establishing individual losses.

During a virtual fraud investigation involving cryptocurrency transactions, a CFE needs to trace funds across multiple wallets. Which tool type is MOST appropriate for this analysis?

Answer: Blockchain analytics platforms that map transaction flows and cluster related wallets

Blockchain analytics platforms use clustering algorithms and transaction graph analysis to trace fund flows and identify wallet owners.

A suspect claims they only participated in fraud because 'everyone at the company did it.' A CFE should recognize this as:

Answer: Social comparison rationalization

Social comparison rationalization uses perceived peer behavior to justify one's own misconduct, a common neutralization technique.

In an investigation involving insider trading, a forensic examiner reviews email metadata. Which metadata field is most useful for proving that an email was sent before a specific market event?

Answer: The 'Date' header with server-stamped Received timestamps

The 'Date' header combined with Received timestamps added by mail servers provides a verifiable chronological record that is difficult to falsify across multiple servers.

A CFE who consistently uses avoidance as a conflict management strategy risks:

Answer: Allowing unresolved issues to escalate into larger problems

Persistent avoidance allows conflicts to grow unchecked, often leading to more serious disputes or investigation failures.

During triage of a security incident, a CFE must prioritize which systems to examine first. Which factor should carry the MOST weight in this decision?

Answer: The criticality of the system to business operations and its role in the incident

Systems that are critical to operations and most likely to contain relevant evidence or be vectors for ongoing attack should be prioritized during triage.

Which communication structure is most effective for keeping a large collaborative forensic team aligned without creating information bottlenecks?

Answer: Hub-and-spoke model with a coordination lead and direct sub-team channels

A hub-and-spoke model balances oversight with efficiency, preventing bottlenecks while maintaining coordination.

During a group fraud investigation, a CFE must decide the ORDER in which to interview witnesses. What is generally the BEST sequence?

Answer: Interview peripheral witnesses first, then key witnesses, and suspects last

Interviewing peripheral witnesses first builds factual context and corroborating detail before confronting key witnesses or suspects who may be more guarded.

Which of the following is NOT a required element of competent professional conduct for a CFE?

Answer: Holding a law degree in addition to CFE credentials

A law degree is not required for CFE competence; competence is defined by knowledge, skills, and diligence, not specific academic credentials beyond CFE requirements.

An incident response report must include a 'scope of work' section. What is the PRIMARY purpose of this section?

Answer: To define the boundaries of the investigation, including systems examined and time periods covered

The scope of work clearly defines what was examined and what was excluded, ensuring readers understand the limitations and coverage of the forensic investigation.

In the context of the fraud triangle, an employee who has embezzled funds and justifies it by believing their employer owes them back wages is demonstrating which element?

Answer: Rationalization

Rationalization is the mental justification a fraudster uses to convince themselves their conduct is acceptable, such as believing unpaid wages entitle them to take funds.

Which type of visual representation is MOST appropriate for illustrating the relationship between the frequency of small fraudulent transactions and their cumulative financial impact?

Answer: Pareto chart

A Pareto chart combines a bar chart (frequency) with a cumulative line chart (impact), making it ideal for showing that a small number of transaction types account for the majority of fraud losses.

What ethical consideration is most relevant to legal frameworks & regulatory standards in CFE practice?

Answer: Maintaining confidentiality and acting in the best interest of stakeholders

Maintaining confidentiality and acting in the best interest of stakeholders is the cornerstone ethical consideration for legal frameworks & regulatory standards in professional practice.

When implementing legal frameworks & regulatory standards practices, what should a CFE professional prioritize first?

Answer: Compliance with established standards and protocols

Compliance with established standards and protocols must be the first priority, as it ensures safety, quality, and legal adherence in professional practice.

During a mobile device acquisition, what is the significance of placing the device in airplane mode?

Answer: It prevents remote wipe commands from reaching the device

Airplane mode cuts all wireless connections, preventing remote wipe commands or data changes from reaching the device over cellular or Wi-Fi.