According to the ACFE's 2024 Report to the Nations, 43% of occupational frauds are detected by tips, but a tip is not evidence. The single biggest mistake candidates make on CFE Section 2 is confusing the starting point of an investigation with the legally sufficient evidence needed to conclude it. This section tests your ability to bridge that gap with professional judgment, not just memorized rules.
These free CFE Section 2 practice questions are designed to mirror the real exam's focus on applying the principles of investigation planning, interviewing, evidence handling, and legal procedure. They test your judgment in realistic scenarios, preparing you for the questions you'll face on exam day in 2026.
Key facts
- Official body
- Association of Certified Fraud Examiners (ACFE)
- Exam sections
- 4 (Financial Transactions & Fraud Schemes, Law, Investigation, Fraud Prevention & Deterrence)
- Typical pass rate
- Approximately 65-70% overall for first-time candidates.
- Section 2 focus
- Planning investigations, interviewing witnesses, collecting evidence, and understanding legal systems and expert testimony.
- Recommended study time
- 80-120 hours total across all four sections.
- Key statistic
- The median duration of a fraud scheme before detection is 12 months, making evidence collection and preservation critical (ACFE).
About These Free Section 2: Fraud Investigations and Legal Issues Practice Questions
These questions are not a random sample. They are carefully crafted to reflect the difficulty and style of the real CFE exam, focusing specifically on the Fraud Investigations and Legal Issues section. The ACFE blueprint for this section is less about calculation and more about sequence, procedure, and judgment.
You will find questions covering the full spectrum of the blueprint:
- Planning and Conducting a Fraud Examination: Moving from predication to a formal investigation plan.
- Interviewing: The art and science of gathering information from witnesses, targets, and experts.
- Collecting and Preserving Evidence: The rules that determine if your hard work will matter in court.
- Legal Systems and Procedures: Navigating the differences between criminal and civil law.
- Testifying as an Expert Witness: Presenting your findings with credibility and clarity.
This is your first diagnostic. It's designed to show you where you think like an examiner and where you're still thinking like a student. Don't just answer them. For each one, ask yourself why one answer is correct and, more importantly, why the others are wrong. That's the key to passing.
Studying for CFE? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Ready to see how you stack up? Try VoraPrep's free CFE practice questions for all four sections.
Section 2: Fraud Investigations and Legal Issues Practice Questions
Work through these questions one by one. Read the full explanation, even if you get the answer right. The reasoning is where the real learning happens.
Question 1
An anonymous tip alleges that the controller of a mid-sized company, Jane Smith, is using company funds to pay for personal vacations. Which of the following represents the MOST appropriate next step for a Certified Fraud Examiner?
a) Immediately confront Jane Smith with the allegation. b) Launch a full-scale covert investigation, including surveillance of Smith outside of work. c) Conduct a preliminary assessment to determine if sufficient predication exists for a formal investigation. d) Report the allegation to the company's external auditors.
Answer and Explanation Correct Answer: (c)The correct first step is always to establish predication. Predication is the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe a fraud has occurred, is occurring, or is about to occur. An anonymous tip is a starting point, but it isn't, by itself, sufficient predication for a full investigation. A preliminary assessment might involve discreetly reviewing Smith's expense reports or corporate credit card statements for unusual activity that corroborates the tip.
Why the other answers are wrong:- (a) Immediately confront Jane Smith: This is a classic exam trap. Confronting the target prematurely can cause them to destroy evidence, alter records, or concoct a plausible cover story. An admission-seeking interview is typically one of the last steps in an investigation.
- (b) Launch a full-scale covert investigation: This is premature and potentially illegal. Surveillance outside of work could violate privacy laws, and a "full-scale" investigation is not warranted without proper predication. You must scale the investigation to the available evidence.
- (d) Report the allegation to the external auditors: While auditors are concerned with fraud, their primary role is to opine on the fairness of financial statements. The CFE's role is to investigate the specific allegation. Informing the auditors might be a step later, but it's not the immediate next action for the fraud examiner.
Question 2
During an admission-seeking interview with a suspect, the suspect provides a verbal confession detailing a $50,000 billing scheme. What should the fraud examiner do IMMEDIATELY after obtaining the verbal confession?
a) End the interview and report the confession to management. b) Ask the suspect to repeat the confession so it can be audio-recorded. c) Have the suspect write and sign a statement that includes the details of the confession. d) Ask the suspect for details about how they might return the stolen funds.
Answer and Explanation Correct Answer: (c)The primary goal after obtaining a verbal confession is to memorialize it in a legally sound written statement. A signed written statement is powerful evidence. It prevents the suspect from later recanting their story or claiming their words were misinterpreted. The statement should affirm that it was given voluntarily and without coercion.
Why the other answers are wrong:- (a) End the interview and report to management: This is tempting, but a verbal confession is weak. It's your word against theirs. Without a signed statement, the suspect can easily deny everything later.
- (b) Ask to audio-record the confession: This can be a good step, but it introduces legal complexities regarding consent and two-party vs. one-party consent laws. A signed written statement is often more straightforward and universally accepted as strong evidence. Furthermore, a suspect who just confessed might balk at being recorded, causing them to shut down.
- (d) Ask about returning the funds: While restitution is an important topic, it is secondary to solidifying the confession. Securing the signed statement is the top priority. Discussions of restitution can happen right after the statement is signed.
Question 3
A fraud examiner legally obtains a laptop used by a suspect in a financial fraud case. The examiner makes a bit-for-bit forensic image of the hard drive before performing any analysis. This process is a critical part of:
a) Establishing predication. b) Maintaining the chain of custody. c) Performing a net worth analysis. d) Obtaining an admission-seeking interview.
Answer and Explanation Correct Answer: (b)Creating a forensic image and working from the copy, not the original, is a cornerstone of digital evidence preservation and maintaining the chain of custody. It ensures that the original evidence remains pristine and unaltered. Every access, copy, and analysis of the data is logged, creating a clear and defensible trail (the chain of custody) from the moment of seizure to its presentation in court.
Why the other answers are wrong:- (a) Establishing predication: Predication is the basis for starting an investigation. This action takes place during the investigation, long after predication has been established.
- (c) Performing a net worth analysis: A net worth analysis is a method used to prove illicit income by comparing a person's assets and liabilities over time. While data from the laptop might be used in such an analysis, the act of imaging the drive itself is about evidence preservation, not the analysis technique.
- (d) Obtaining an admission-seeking interview: This is an interviewing technique. The handling of digital evidence is a separate phase of the investigation.
Question 4
In a civil trial regarding a contract fraud scheme, what is the typical burden of proof that the plaintiff must meet?
a) Beyond a reasonable doubt. b) Preponderance of the evidence. c) Probable cause. d) Clear and convincing evidence.
Answer and Explanation Correct Answer: (b)The standard burden of proof in a civil case is a "preponderance of the evidence." This means the plaintiff must prove that it is more likely than not (e.g., 50.1% likely) that their claim is true. It is a much lower standard than that required in a criminal case.
Why the other answers are wrong:- (a) Beyond a reasonable doubt: This is the highest legal standard and is used exclusively in criminal cases. It is the burden of proof the prosecution must meet to convict a defendant. This is the most common distractor on questions comparing civil and criminal law.
- (c) Probable cause: This is the standard required for law enforcement to make an arrest or obtain a search warrant. It's a lower standard than "beyond a reasonable doubt" but is not the burden of proof for winning a civil trial.
- (d) Clear and convincing evidence: This is an intermediate standard of proof, higher than a preponderance of the evidence but lower than beyond a reasonable doubt. It is used in some specific civil cases (like proving a gift was made), but it is not the typical standard for a fraud case.
- Civil Trial: Preponderance of the Evidence
- Criminal Trial: Beyond a Reasonable Doubt
- Arrest/Warrant: Probable Cause
Question 5
Which of the following is the BEST example of demonstrative evidence in a fraud trial?
a) A signed, written confession from the defendant. b) A summary chart showing the flow of illicit funds through multiple bank accounts. c) The original forged check used in the scheme. d) Testimony from a witness who saw the defendant altering records.
Answer and Explanation Correct Answer: (b)Demonstrative evidence is evidence that illustrates or clarifies a concept or testimony for the court. It is not the "real" evidence itself but a representation of it. A summary chart or diagram created by the fraud examiner to explain a complex transaction is a perfect example. It helps the judge and jury understand the case.
Why the other answers are wrong:- (a) A signed, written confession: This is a form of documentary evidence.
- (c) The original forged check: This is "real" evidence, also known as physical evidence. It is the actual object involved in the crime.
- (d) Testimony from a witness: This is testimonial evidence.
Question 6
A fraud examiner is preparing to interview a potentially hostile witness who they believe has knowledge of a kickback scheme but is not a primary suspect. Which type of interview question should the examiner use to begin the interview?
a) "Did you approve the invoices from Vendor X?" b) "Tell me about the process for approving new vendors." c) "Why did you conspire with John Doe to defraud the company?" d) "You knew about the kickbacks, didn't you?"
Answer and Explanation Correct Answer: (b)The best way to begin an informational interview, especially with a potentially reluctant witness, is with broad, open-ended questions. "Tell me about..." invites a narrative response and is non-confrontational. It allows the examiner to build rapport and gather general information before honing in on more specific or sensitive topics.
Why the other answers are wrong:- (a) "Did you approve the invoices from Vendor X?": This is a closed-ended question. It's useful for confirming facts later, but it's too direct for the start of an interview and can put the witness on the defensive.
- (c) "Why did you conspire with John Doe...?": This is an accusatory question, appropriate only for an admission-seeking interview with a primary target after significant evidence has been gathered. Using it here would destroy rapport and likely end the interview.
- (d) "You knew about the kickbacks, didn't you?": This is a leading question. It suggests the answer and signals the examiner's bias, which can compromise the integrity of the witness's statement.
Question 7
An expert witness testifying in a federal court case must have their methodology and conclusions evaluated based on criteria established in which landmark legal case?
a) Miranda v. Arizona b) Brady v. Maryland c) Daubert v. Merrell Dow Pharmaceuticals d) Sarbanes v. Oxley
Answer and Explanation Correct Answer: (c) Daubert v. Merrell Dow Pharmaceuticals established the standard for admitting expert testimony in U.S. federal court. The "Daubert standard" requires the judge to act as a gatekeeper, ensuring that an expert's scientific or technical testimony is both relevant and based on reliable methodology. Key factors include whether the theory can be tested, peer review, known error rates, and general acceptance in the relevant community. Why the other answers are wrong:- (a) Miranda v. Arizona: This case established the requirement for police to inform suspects in custody of their constitutional rights (the "Miranda rights"). It relates to custodial interrogations by law enforcement, not expert testimony.
- (b) Brady v. Maryland: This case requires prosecutors to disclose all exculpatory evidence (evidence favorable to the defendant) to the defense. It is a rule of criminal procedure.
- (d) Sarbanes v. Oxley: This is not a court case; it is the Sarbanes-Oxley Act of 2002, a federal law that established sweeping auditing and financial regulations for public companies.
Question 8
- Assets at start of year: $250,000
- Assets at end of year: $450,000
- Liabilities at start of year: $150,000
- Liabilities at end of year: $100,000
- Known legitimate income: $100,000 (salary)
- Known living expenses: $80,000
Using the net worth method, what is the amount of unknown funds for 2025?
a) $70,000 b) $130,000 c) $230,000 d) $30,000
Answer and Explanation Correct Answer: (c)This question requires you to apply the net worth method formula to calculate unexplained income. Here's the step-by-step breakdown:
Step 1: Calculate the change in net worth.
- Net Worth (Start) = Assets (Start) − Liabilities (Start) = $250,000 − $150,000 = $100,000
- Net Worth (End) = Assets (End) − Liabilities (End) = $450,000 − $100,000 = $350,000
- Increase in Net Worth = Net Worth (End) − Net Worth (Start) = $350,000 − $100,000 = $250,000
Step 2: Calculate total funds needed to account for.
- Total Funds Needed = Increase in Net Worth + Known Living Expenses
- Total Funds Needed = $250,000 + $80,000 = $330,000
Step 3: Calculate the unknown funds.
- Unknown Funds = Total Funds Needed − Known Legitimate Income
- Unknown Funds = $330,000 − $100,000 = $230,000
This $230,000 is the amount Bill must explain from legitimate sources. If he cannot, it becomes powerful circumstantial evidence of illicit income. This is a core technique you must master, and you can learn more in our guide to the CFE Investigation section.
Calculate Your CFE Score & Study Hours by Domain
Adjust your practice scores across official CFE blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Did You Score?
So, how did you do? Count up your correct answers.
- 7-8 Correct: Excellent. You have a strong grasp of the core principles of fraud investigation and legal procedure. You're able to apply the rules to new scenarios, which is exactly what the exam requires. Your next step should be to use an adaptive question bank, like VoraPrep's, to target and eliminate any remaining weak spots.
- 4-6 Correct: You have a decent foundation, but there are critical gaps in your knowledge. You likely missed questions that required you to distinguish between similar concepts (like the burdens of proof) or apply a procedure in the correct sequence (like establishing predication). Re-read the explanations for the questions you missed and focus your next study session on those specific blueprint areas.
- 0-3 Correct: Don't panic. This is valuable information. A low score means you have a foundational knowledge gap. Trying to learn by just answering more questions will be frustrating. Your best move is to go back to the source material. Start with a structured course like VoraPrep, which provides complete textbook-grade lessons to build your understanding from the ground up before you dive into thousands of practice questions.
This isn't just about a score. It's about a mindset. Did you find yourself guessing between two answers? Did you fall for a trap by picking the "obvious" but incorrect choice? Identifying how you get things wrong is more important than the number you got right.
Get More CFE Practice on VoraPrep
A handful of questions can show you the gaps, but a full, adaptive course is what fills them. The CFE exam isn't a memorization test; it's a judgment test. You pass by developing the instincts of a seasoned fraud examiner.
That’s what we focus on at VoraPrep. We help you build that judgment, not just cram facts.
Instead of paying $1,500+ for passive video-lecture bundles that put most candidates to sleep, VoraPrep offers a complete, interactive course built for busy professionals. Our 6-pillar system includes everything you need to pass:
- Complete Textbook-Grade Lessons: Step-by-step interactive lessons that teach you the concepts, not just the trivia.
- Adaptive Practice Banks: Over 2,000 CFE questions with detailed rationales that explain the why behind every answer. Our engine learns your weak areas and serves you more questions on those topics until you master them.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real CFE testing experience, so you feel confident and prepared on exam day.
- FSRS Spaced-Repetition Flashcards: A smart flashcard system that schedules reviews based on memory science to ensure you retain key terms, legal standards, and procedures.
- Personalized Daily Study Plan: Tell us your exam date, and we build a dynamic calendar to guide you through the material efficiently. Our readiness score predictor even forecasts your likely exam score.
- Vory, Your 24/7 Personal Tutor: Stuck on a concept? Ask Vory inside any lesson or question for a step-by-step explanation, available anytime.
Stop wondering if you're ready. Start a free trial and know for sure.