CFE Forensic Analysis and Investigation Techniques 3

Question 1

A forensic examiner is asked to analyze a suspect's cloud storage account. Which legal instrument is typically required to compel a US-based cloud provider to disclose a foreign national's data?

Accepted Answer

A warrant under the Stored Communications Act (18 U.S.C. § 2703)

Answer

The Stored Communications Act governs compelled disclosure of stored electronic communications from US-based providers, including data belonging to foreign nationals.

Question 2

During a fraud investigation, an examiner applies Benford's Law to a dataset of expense reimbursements. Which finding would be MOST suspicious?

Accepted Answer

An unusually high frequency of entries beginning with the digit 9

Answer

Benford's Law predicts that digit 1 leads most frequently; an excess of entries starting with 9 suggests fabricated or manipulated figures.

Question 3

When conducting a forensic examination of a Linux system, which command provides the most reliable list of recently executed commands, even after the bash history file has been cleared?

Accepted Answer

Review auditd logs configured to capture execve system calls

Answer

When Linux auditd is configured to log execve system calls, it captures command execution records in a tamper-evident audit log independent of bash history.

Question 4

An examiner is analyzing a financial fraud case where the suspect used shell companies across multiple jurisdictions. Which investigative technique is most effective for tracing the ultimate beneficial owner?

Accepted Answer

Analyzing correspondent banking records and SWIFT message trails

Answer

Correspondent banking records and SWIFT message trails document the movement of funds between institutions and can reveal the true controlling parties behind shell structures.

Question 5

A forensic examiner receives a hard drive that may contain evidence of child exploitation. Before beginning analysis, what is the most critical first step?

Accepted Answer

Create a forensic image and verify it with a cryptographic hash

Answer

Creating a verified forensic image preserves the original evidence in a legally defensible state and ensures that all subsequent analysis is performed on the copy.

(CFE) Certified Forensic Examiner Practice Test

(CFE) Certified Forensic Examiner Practice Test

CFE Forensic Analysis and Investigation Techniques 3