Changed CFE-Investigation Exam Questions

If Ginny's computer is running. Jackson should perform a graceful shutdown by turning it off using the normal shutdown process

If Ginny’s computer is off and Jackson needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interface.

If Ginny's computer is off. Jackson should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

If Ginny's computer is running. Jackson may retrieve data from the computer directly via its normal interface if the evidence that he needs exists only in the form of volatile data

Digital evidence is more volatile than tangible evidence because digital evidence is subject to claims of spoliation, whereas tangible evidence is not.

Digital evidence is more volatile than tangible evidence because the rules of admissibility for digital evidence are stricter than such rules for tangible evidence.

If the integrity of digital evidence is violated, it can often be restored through a digital cleansing process

The failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding

"The company's internal controls were wholly inadequate to prevent this type of violation and should be remediated at the earliest possible time."

"The evidence shows that expenses in excess of $5 million were omitted from the company's financial statements "

"Based on statements the suspect made to me. it is my assessment that the suspect has a dishonest disposition."

"From my examination, it appears that the company's financial statements were not presented in accordance with generally accepted accounting principles "

Terminate the suspected employee.

Delay taking any action.

Investigate during nonbusiness hours.

Disclose the investigation to all employees