VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

Anti-Fraud Controls Certificate Program Free Sample Questions

Description

Covers internal controls for data security, fraud prevention controls built on the COSO framework, and evaluating and testing anti-fraud controls through assessment and reporting methods.

12 free sample questions108 in the full practice test

Try simulator

AFC-CERT Sample Questions

  1. Question 1

    Intermediate

    Internal Controls for Data Security · Current Data Threats

    A multinational corporation is migrating its customer relationship management (CRM) system to a SaaS cloud provider. The Chief Risk Officer is concerned about data security responsibilities. Under the shared responsibility model for SaaS, which of the following security controls remains the primary responsibility of the customer organization?

    Answer and explanation

    Correct answer: B

    In a SaaS model, the cloud provider manages the infrastructure, physical security, network controls, and application patching. The customer retains responsibility for data classification, identity and access management (IAM), and endpoint device protection. Controlling who accesses the data and how they are authenticated is a critical customer responsibility.

  2. Question 2

    Intermediate

    Internal Controls for Data Security · Current Data Threats

    A financial institution is implementing a Bring Your Own Device (BYOD) policy. To mitigate the risk of corporate data leakage on personal devices without violating employee privacy, which technical control is most appropriate?

    Answer and explanation

    Correct answer: C

    Containerization (often deployed via MAM) isolates corporate data and applications from personal data on the same device. This allows the organization to control, encrypt, and selectively wipe only the corporate container without accessing or erasing the employee's personal photos, contacts, or applications, balancing security with privacy.

  3. Question 3

    Beginner

    Internal Controls for Data Security · Introduction to Internal Data Controls

    While auditing logical access controls, an auditor discovers that a senior database administrator (DBA) has the ability to both modify the database schema and delete audit logs. This violation of the principle of least privilege poses a significant risk of:

    Answer and explanation

    Correct answer: C

    The ability to delete audit logs allows a perpetrator to cover their tracks. If a DBA can manipulate data (schema or content) and also delete the records of those actions (logs), they have the perfect opportunity to commit fraud and conceal it. This is a classic segregation of duties conflict.

  4. Question 4

    Beginner

    Internal Controls for Data Security · Current Data Threats

    An organization detects a spear-phishing campaign targeting its accounts payable department. The emails appear to come from the CFO and request urgent wire transfers. This attack vector leverages information likely gathered from:

    Answer and explanation

    Correct answer: B

    Attackers often use professional social media sites (OSINT) to identify organizational hierarchies, reporting lines (who reports to the CFO), and specific roles (AP clerks). This allows them to craft highly targeted spear-phishing emails (Business Email Compromise) that appear authentic.

  5. Question 5

    AdvancedMultiple answers

    Internal Controls for Data Security · Data Security Risks

    Which of the following are primary components of a comprehensive Data Loss Prevention (DLP) strategy? (Select TWO)

    Answer and explanation

    Correct answers: B, C

    DLP agents on endpoints (laptops/desktops) monitor and block unauthorized data transfers (e.g., to USB drives or personal email), which is a critical enforcement mechanism.

    You cannot protect what you cannot find or define. Discovering where sensitive data resides and classifying it (e.g., Confidential, Public) is the foundational step of DLP.

  6. Question 6

    Beginner

    Internal Controls for Data Security · Introduction to Internal Data Controls

    True or False: In a high-security data center, biometric access controls (such as fingerprint or retina scanners) are considered a 'what you have' authentication factor.

    Answer and explanation

    Correct answer: B

    Biometrics are classified as 'what you are' (inherent characteristics). 'What you have' refers to physical tokens like smart cards or keys. 'What you know' refers to passwords or PINs.

Register free for 6 more questions

Or unlock all 108 AFC-CERT questions with explanations, timed mode and flashcards.

Related practice tests

All ACFE practice exams