CrFA CrFA Digital Forensics & Data Analysis 2 — Questions and Answers
Question 1: In data analytics for fraud detection, stratification of transactions is used to:
- Randomly sample transactions for audit testing
- Group transactions into ranges to identify unusual concentrations (Correct answer)
- Convert foreign currency amounts to USD
- Reconcile subsidiary ledgers to the general ledger
Correct answer: Group transactions into ranges to identify unusual concentrations
Stratification organizes data into layers or bands so the examiner can see where transaction volumes or amounts cluster abnormally.
Question 2: Which hashing algorithm is most commonly used to verify the integrity of a forensic disk image?
- SHA-256 (Correct answer)
- ROT-13
- Base64
- AES-128
Correct answer: SHA-256
SHA-256 produces a unique cryptographic hash of the original data, allowing the examiner to confirm the copy is bit-for-bit identical to the source.
Question 3: A forensic accountant discovers that journal entries were systematically posted at 2:00 a.m. by a generic user account. This finding most likely indicates:
- Normal automated batch processing
- Possible unauthorized or fraudulent entries made to avoid detection (Correct answer)
- A payroll system error
- A standard month-end close procedure
Correct answer: Possible unauthorized or fraudulent entries made to avoid detection
Unusual posting times combined with generic credentials are red flags suggesting entries may have been made deliberately outside business hours to evade oversight.
Question 4: Which technique involves comparing a company's reported financial ratios to industry benchmarks to identify anomalies?
- Horizontal analysis
- Vertical analysis
- Ratio analysis (Correct answer)
- Regression analysis
Correct answer: Ratio analysis
Ratio analysis compares key financial metrics such as gross margin or days payable outstanding against peer companies to highlight deviations that may signal fraud.
Question 5: When recovering deleted files during a forensic investigation, the examiner looks for data in which area of a hard drive?
- Active file allocation table entries
- Unallocated clusters or slack space (Correct answer)
- The master boot record
- Encrypted partitions only
Correct answer: Unallocated clusters or slack space
Deleted files are often recoverable from unallocated clusters and file slack space before those areas are overwritten by new data.
Question 6: In forensic accounting, network log analysis is primarily used to:
- Calculate depreciation on IT assets
- Identify unauthorized data transfers or access to sensitive financial records (Correct answer)
- Prepare consolidated financial statements
- Audit capital expenditure approvals
Correct answer: Identify unauthorized data transfers or access to sensitive financial records
Network logs record connection events and file access, allowing examiners to trace who accessed financial data and whether information was exfiltrated.
CrFA CrFA Digital Forensics & Data Analysis 2
In data analytics for fraud detection, stratification of transactions is used to: