CFE-Fraud-Investigations-and-Legal-Issues Exam Questions & Answers

If a computer is running, it might be appropriate for a trained digital forensic examiner to conduct live evidence collection when the needed evidence exists only as volatile data. Volatile data, such as information in RAM, active network connections, running processes, or encryption keys, can disappear when the system is powered down. However, live collection should be performed carefully because interacting with the system can alter evidence. Option A is wrong because a computer that is off generally should be left off. Option C is too broad because a graceful shutdown can alter files and destroy volatile evidence. Option D is also incorrect because turning on an off computer can change evidence. Therefore, option B is the most accurate statement.

According to the Fraud Examiners Manual:

''Credit card records are important in tracing assets... information on credit card charges might provide leads to identifying hidden assets. For example, if a fraud examiner notices that the subject used his credit card to purchase items at a marina, the fraud examiner should investigate further to determine if the subject owns a boat''.

Therefore, A is correct.

Lay testimony, also called factual testimony, is based on what the witness personally saw, heard, did, or otherwise experienced. A lay witness helps the fact finder understand facts by providing firsthand observations, not specialized opinions. Expert witnesses, by contrast, may provide opinions based on specialized education, training, skill, or experience. Option A describes expert testimony. Option C is improper because witnesses generally should not express opinions on the defendant's guilt or innocence. Option D also goes beyond the usual role of a lay witness because determining validity or evidentiary weight is generally the role of the court or fact finder, unless expert testimony is properly admitted. Therefore, Bob's primary purpose is to provide factual observations.

This is a double-negative question because it contains two forms of negation: ''Didn't'' and ''wasn't.'' Double-negative questions are poor interview questions because they confuse the respondent and can suggest an answer opposite to the intended meaning. Fraud examiners should avoid them because they reduce clarity and can make the resulting answer unreliable or difficult to interpret. Option A is not the best description because the issue is not the order of the words, but the presence of two negatives. Option B is incorrect because the question does not merely control the answer; it creates confusion. Option D is less precise because a complex question usually combines multiple issues, while this question is specifically defective due to double negation.

Nonverbal deception cues include feigned unconcern, slouching, chewing objects, and manipulating clothing. Michelle's conduct (chewing pen cap, picking at fabric, appearing unconcerned) matches these signs of deception.