(Multiple choice)
1. A vulnerability chart:
a. Forces investigators to explicitly consider all aspects of a fraud.
b. Shows the history of fraud in a company.
c. Identifies weaknesses in every aspect of a company's internal control.
d. Gives a detailed record of all the movements and activities of the suspect.

2. Fixed-point, or stationary, observations can be conducted by:
a. Certified fraud examiners.
b. Company personnel.
c. Private investigators.
d. Anyone.

3. Surveillance logs should include all of the following except:
a. Time the observation began and ended.
b. Cost of the surveillance equipment used.
c. Movements and activities of the suspect.
d. Distance the observation was from the scene.

4. Wiretapping, a form of electronic surveillance, can be used by:
a. Internal auditors.
b. Company controllers.
c. CPAs.
d. All of the above.
e. None of the above.

5. Which theft investigative method is most limited in value during employee fraud investigations because of concerns regarding employees' privacy at work?
a. Electronic surveillance.
b. Invigilation.
c. Forensic accounting.
d. Interviewing and interrogation.

6. Who should be consulted before any form of surveillance takes place?
a. Public investors and the company's board of directors.
b. State attorney general.
c. Legal counsel and human resources.
d. All company executives.

7. When seizing computers, a calculation (also called a hash) that ensures you have an exact clone and have not changed data is called a(n):
a. NIST number.
b. ODBC connection.
c. Internet packet calculation.
d. CRC checksum number.

8. A snapshot of active memory should be done:
a. Before seizure of the computer.
b. After seizure of the computer but before turning off the computer.
c. After turning off the computer but before calculation of the checksum number.
d. After calculation of the checksum number but before searching.