What is the passing score for the Certified Fraud Examiner - Fraud Prevention and Deterrence Exam?

To pass the Fraud Prevention and Deterrence section of the ACFE Certified Fraud Examiner (CFE) exam, candidates must achieve a minimum score of 75%.

How many questions are on the Certified Fraud Examiner - Fraud Prevention and Deterrence Exam?

The Fraud Prevention and Deterrence section of the CFE exam consists of 100 questions, which candidates must complete within a 2-hour time limit.

How much does the Certified Fraud Examiner exam cost?

The standard exam application fee for the Certified Fraud Examiner (CFE) exam is $450 USD for ACFE members. This fee typically covers all four sections of the exam.

Cisco

CompTIA

ISC

EC-Council

EXIN

Fortinet

ITIL

Juniper

Microsoft

VMware

Avaya

SAP

Google

NVIDIA

Salesforce

Amazon

Palo Alto Networks

ISC2

Splunk

ServiceNow

All Vendors

ACFE Certified Fraud Examiner - Fraud Prevention and Deterrence Exam Exam Questions
Certified Fraudiner - Fraud Prevention

Updated On: 19-Apr-2026

Pass the Certified Fraudiner - Fraud Prevention exam with community-verified questions and a free, built-in AI Tutor.

The ACFE Fraud Prevention and Deterrence exam targets internal auditors, forensic accountants, and compliance officers tasked with mitigating institutional risk. Candidates must master the implementation of the COSO Internal Control Integrated Framework and the Fraud Triangle to analyze organizational vulnerabilities. Technical assessment mandates expertise in deploying anti-fraud software, data analytics for anomaly detection, and biometric authentication protocols to secure transaction environments. Proficiency in evaluating ethical tone-at-the-top, whistleblower reporting mechanisms, and Sarbanes-Oxley regulatory compliance remains critical. Success requires applying quantitative risk modeling to identify systemic weaknesses within financial systems, ensuring robust structural defenses against occupational fraud, embezzlement, and complex asset misappropriation schemes.

AI Tutor: Every exam has a dedicated AI tutor. Don't just memorize—understand the why behind every correct answer.

11519
Students passed the Certified Fraud Examiner - Fraud Prevention and Deterrence Exam Exam using this exam dump

94.4%
Average score during Real Exams at the Testing Centre

256
Exam Questions and Answers in this Certified Fraud Examiner - Fraud Prevention and Deterrence Exam Prep

ACFE
Certified Fraud Examiner
Fraud Prevention and Deterrence Exam

Total Questions: 141

Browse Free CFE-Fraud-Prevention-and-Deterrence Questions

Post your Comments and Discuss ACFE Certified Fraud Examiner - Fraud Prevention and Deterrence Exam exam dumps with other Community members:

Comments:

Name:

Certified Fraud Examiner - Fraud Prevention and Deterrence Exam Exam Discussions & Posts

Community-Verified AI Explanation Commented on April 24, 2026
Question 1:

Scenario: A company buys cyber insurance to cover items listed on the risk register. This is about how the organization handles identified risks financially.

Why the answer is B: Transfer: Cyber insurance shifts the financial risk from the organization to a third party, covering losses tied to the identified risks.

Why the other options are not correct:

- Accept: Acknowledging risk without action; no insurance involved here. - Mitigate: Reducing likelihood or impact with controls, not transferring cost. - Avoid: Changing plans to eliminate the risk entirely; insurance doesn’t remove the risk.

Key concept: In risk management, transferring risk through insurance is a valid treatment option for financial exposure identified in the risk register.

Hanover, United States

Community-Verified AI Explanation Commented on April 24, 2026
Question 1:

Correct answers: A and C

Why:

- A. Notebook cells can be written in Python — True. Snowflake Notebooks support both SQL and Python as executable cell types. - C. Notebook cells can be written in SQL — True. SQL cells are also supported in Snowflake Notebooks.

Why the others are incorrect:

- B. Databases can process queries using Scala — False. Scala isn’t a direct query language for Snowflake; Scala is supported via Snowpark for application code, not as a native query syntax. - D. Worksheets can only be written in SQL — Not accurate. Worksheets (Snowsight) are predominantly SQL-based but can include procedural constructs; they aren’t restricted to SQL only. - E. Dashboards can be written in JavaScript — False. Dashboards use SQL-backed visualizations and built-in UI components; JavaScript isn’t an authoring language for the native dashboards.
Pune, India

Community-Verified AI Explanation Commented on April 24, 2026
Question 26:
Question 26 asks which port should be disabled to ensure all web connections are encrypted.

Correct answer: B (port 80)

Why: Port 80 is used for HTTP (unencrypted). Port 443 is HTTPS (encrypted). To enforce encryption, you should disable HTTP on 80 and require TLS/SSL on 443 (often with an HTTP-to-HTTPS redirect).

Quick notes: Ports 22 (SSH) and 587 (SMTP submission) are not web traffic; they can be left open or restricted per admin needs, but the priority for encryption of web traffic is to close 80.

Anonymous

Community-Verified AI Explanation Commented on April 24, 2026
Question 8:

Answer: LLDP

Why: LLDP (Link Layer Discovery Protocol) operates at the data-link layer to discover neighboring devices and the port IDs they’re connected to. On the switch, you can run commands like show lldp neighbors (and show lldp neighbors detail) to see which device is on which port, helping identify the exact switch and port the VoIP handset is using.

Why not the others:

- IKE: VPN protocol, not relevant to local switch port mapping. - VLAN: Indicates which VLAN a device is in, but not the specific switch port. - netstat: Shows active connections on the host, not how it’s wired to the switch.
Anonymous

Kuah Commented on April 24, 2026
exams practice questions questions and answers are very helpful
New Taipei City, Taiwan

Community-Verified AI Explanation Commented on April 24, 2026
Question 1:
Question 1: What are three sources of malware sample data for the Threat Intelligence Cloud? (Choose three)
Correct sources:

C. Correlation Objects generated by AutoFocus

AutoFocus provides correlated threat intelligence objects that contribute malware samples and indicators to the Threat Intelligence Cloud.

D. Third-party data feeds such as partnership with ProofPoint and the Cyber Threat Alliance

External feeds from partners supply additional malware samples and intelligence.

E. Palo Alto Networks non-firewall products such as Traps and Prisma SaaS

Telemetry from endpoint and cloud apps (Traps, Prisma SaaS) feeds malware data into the Threat Intelligence Cloud.
Why the others aren’t sources (brief):

A. Next-generation firewalls deployed with WildFire Analysis Security Profiles and

B. WF-500 configured as private clouds for privacy concerns

These are deployment/usage modes, not direct sources of malware samples into the Threat Intelligence Cloud according to this exam perspective.
Dar Es Salaam, Tanzania

Community-Verified AI Explanation Commented on April 24, 2026
Question 1:
Question 1 asks about a company buying cyber insurance to cover items on the risk register. This represents a risk transfer strategy.

Why B (Transfer) is correct: Cyber insurance shifts the financial impact of identified risks from the organization to a third party (the insurer). This is a classic risk transfer, not a fix to the risk itself.

Why the others are incorrect:

- Accept: Acknowledging risk without action; insurance implies action to cover losses, not just acceptance. - Mitigate: Reduces likelihood or impact with controls, not transferring the cost. - Avoid: Changes plans to eliminate risk entirely; insurance does not eliminate the risk itself.
Key concept: In risk management, response options include Accept, Transfer, Mitigate, and Avoid. Insurance is a transfer of financial risk.
St Louis, United States

Community-Verified AI Explanation Commented on April 24, 2026
Question 6:

Answer: B — Leverage the Kubernetes Cluster Autoscaler to automatically start/stop nodes as needed.

Why B is correct:

For bursty workloads (1000 1-hour jobs per week), autoscaling creates capacity only when there are pending pods, and scales down when idle. This minimizes idle infrastructure and cost while meeting the deadline.

Why the other options are less cost-effective:

A: Pre-allocating an exact node group with taints/tolerations reserves capacity continuously, causing potential idle time and higher cost.

C: Committing to a fixed spend (e.g., reserved instances) reduces flexibility and is inefficient for unpredictable weekly bursts.

D: PriorityClasses affect scheduling order but do not provide capacity or cost savings; they can’t guarantee completion if resources aren’t available.

Key concepts:

Cluster Autoscaler: scales cluster capacity up/down based on pending pods and resource requests.

Optimal for variable workloads where demand spikes are time-bound.

Tip: Combine autoscaler with sensible min/max node settings to ensure quick scale-up for the batch and quick scale-down afterward.
Lagos, Nigeria

Community-Verified AI Explanation Commented on April 24, 2026
Question 1:

Correct answer: A

Explanation:

AWS Snowball Edge pricing includes a free usage window for the device, typically up to a 10-day period for a single job. During this window, you can load data onto the device without separate device rental charges.

The other activities involve data transfer or extended usage and are billed:

- B: Transferring data out of S3 to the Snowball Edge is billed (data transfer/job fees). - C: Transferring data from the Snowball Edge back into S3 is billed (data transfer/job fees). - D: Daily use after 10 days would incur ongoing charges (device rental/usage fees).
So the only no-cost activity listed is using the Snowball Edge for up to 10 days
Pune, India

Community-Verified AI Explanation Commented on April 24, 2026
Question 9:

Correct answer: D) Advanced Currency Management

Why: Advanced Currency Management (ACM) provides dated exchange rates so the converted amount on an opportunity is locked in at the rate in effect on the close date. This prevents future rate changes from altering the closed opportunity amount. The other options do not lock the amount:

- Locale, Company Profile: not related to locking currency amounts. - Multi-currency: allows multiple currencies but doesn’t lock the converted amount. - None of the above: not correct since ACM provides the lock.
Assago, Italy

Community-Verified AI Explanation Commented on April 23, 2026
Question 1:

Correct answer: C: Databricks web application

Explanation:

In the classic Databricks architecture, the control plane hosts management and UI components (the Databricks web app, APIs, authentication, and workspace metadata).

The data plane runs the actual compute and storage (e.g., Driver node, Worker nodes, and Databricks Filesystem (DBFS) backed by cloud storage).

A JDBC data source is external connectivity, not a Databricks control-plane component.

Therefore, the only item hosted completely in the control plane is the Databricks web application.

Waukesha, United States

Max Commented on April 23, 2026
Question 72 is D - Mean time to contain The key phrase in the question is “how long it takes to stop the spread of malware after it enters the network.” That’s specifically about containing an incident not just detecting or fixing it. Mean time to contain (MTTC): Time to stop the spread of the malware once it’s in the network. The correct answer is: Mean time to contain This metric directly reflects how quickly the team can isolate and prevent further damage, which is exactly what executives are asking about.
Grecia, Costa Rica

Community-Verified AI Explanation Commented on April 23, 2026
Question 57:

Correct answer: Traces (option D)

Explanation:

- In distributed telemetry, a trace represents the end-to-end flow of a single request as it travels through multiple services. - A trace is made up of multiple spans, where each span details a single operation (duration, start/end time, identifiers, etc.) within the overall request path. - Other telemetry types: - Metrics: aggregated measurements (counts, gauges, histograms). - Logs: discrete messages tied to events. - So when the question mentions “a series of related distributed events that encode the end-to-end request flow,” that describes a trace.
Lagos, Nigeria

Community-Verified AI Explanation Commented on April 23, 2026
Question 13:

Correct answer: Cluster Autoscaler (Option B)

Explanation:

The Cluster Autoscaler automatically adjusts the number of nodes in your cluster to meet demand.

It scales up when there are unschedulable pods due to insufficient resources, and scales down when nodes are underutilized (draining workloads first, respecting DaemonSets, etc.).

It works with cloud providers (e.g., AWS, GCP, Azure) via node groups or similar constructs.

This is different from:

- Horizontal Pod Autoscaler (HPA): scales the number of pod replicas. - Vertical Pod Autoscaler (VPA): adjusts resource requests/limits of containers. - The term “Node Autoscaler” is less common; the standard Kubernetes component is the Cluster Autoscaler.
Lagos, Nigeria

Community-Verified AI Explanation Commented on April 23, 2026
Question 6:
Correct answer: B

Why B is correct: The Cluster Autoscaler automatically adds cloud nodes when pods cannot be scheduled due to insufficient resources, and scales down when nodes become underutilized. For a bursty, time-limited workload (1000 one-hour jobs by Monday night), autoscaling minimizes cost by provisioning nodes only as needed and releasing them afterward, without paying for idle capacity.

Why the other options are less cost-effective:

- A: Reserved a fixed group of nodes means paying for idle capacity outside the batch window and reduces flexibility. - C: Reserved instances or discounts lock you into a price irrespective of actual usage, which isn’t ideal for unpredictable bursts. - D: PriorityClasses control scheduling priority but don’t reduce the total cost or capacity footprint; you still pay for nodes.

Key concepts to understand:

- The autoscaler reacts to pending pods and resource requests to adjust NodeGroups within configured min/max sizes. - Proper resource requests/limits on pods are essential for accurate scaling. - Aligns with cost optimization by scaling exactly to need during the Monday batch and scaling down afterward.
Lagos, Nigeria

Community-Verified AI Explanation Commented on April 23, 2026
Question 5:

Correct answer: B — --authorization-mode=AlwaysAllow.

Why: The authorization-mode flag controls how the API server enforces access. If you do not configure it, the default is AlwaysAllow, meaning no authorization checks are performed by the API server (requests are allowed unless blocked by other controls). In practice, you’d enable a secure mode like RBAC to enforce proper access control.

Lagos, Nigeria

Community-Verified AI Explanation Commented on April 23, 2026
Question 63:

Correct answer: A: kubectl explain

Why: kubectl explain <resource> retrieves the documentation and field definitions for that Kubernetes resource. It’s the built-in way to learn what fields exist and what they mean (for example, kubectl explain pod or kubectl explain deployments.spec.template).

How it works:

- Example: kubectl explain pods shows top-level fields like apiVersion, kind, metadata, spec, and status, with descriptions. - You can drill into nested fields, e.g., kubectl explain deployments.spec.template.spec.containers.

Why other options are incorrect:

- kubectl api-resources lists resource types, not their field definitions. - kubectl get --help shows usage and flags for get, not resource field docs. - kubectl show is not a valid kubectl command.
Lagos, Nigeria

Community-Verified AI Explanation Commented on April 23, 2026
Question 3:
I can’t view the image-based hotspot diagram in Question 3, but I can explain the concept and why the answer is A.

Correct answer: A. This means the origin host is the one that started the infection.

How to determine the origin:

- Review logs from all hosts and the firewall for the infection timeline. - Look for the earliest host that shows malware activity or initiates suspicious outbound/inbound traffic that later leads to other hosts becoming infected. - Use the firewall/IDS logs to trace the infection path: which host first contacted a malicious external host, or which host first communicated with others in a way that preceded infections on those hosts.

Assess other hosts:

- Mark as infected if their logs show signs of infection after receiving contact from the origin (e.g., malware callbacks, unusual outbound connections, file changes). - Mark as clean if there are no indicators of compromise and they did not participate in the infection chain.

Quick checklist:

- Timestamp order of events. - First host with anomalous activity ? potential origin. - Subsequent hosts’ logs showing infection indicators ? infected; otherwise clean.
If you can describe the key log entries or the visible connections in the diagram, I can help assign which host is A and categorize the others as clean or infected.
Brasília, Brazil

Community-Verified AI Explanation Commented on April 23, 2026
Question 3:
For Question 3, the correct option is C: Configure an Access-Control-Allow-Origin header to authorized domains.
Why:

HttpOnly (A) only protects cookies from JavaScript access; it does not enforce HTTPS.

X-Frame-Options (B) mitigates clickjacking but doesn’t directly control cross-origin data exposure.

Access-Control-Allow-Origin (C) is the CORS setting that restricts which origins can read your web resources. After a vulnerability assessment, tightening CORS to trusted domains reduces exposure of data (such as PII) to unauthorized sites.

Disabling the CORS header (D) would increase exposure and is not a prudent security practice.

So, configuring Access-Control-Allow-Origin to authorized domains directly addresses cross-origin data access risks identified in a web app vulnerability assessment.
Basingstoke, United Kingdom

Community-Verified AI Explanation Commented on April 23, 2026
Question 181:

STP root bridge is chosen by the lowest Bridge ID (priority + MAC). If all priorities are equal (default), the switch with the lowest MAC address becomes the root.

Bridge ID = Priority (default 32768) + MAC address. Since all priorities are default, compare MACs.

Given MACs:

- SW1: 0C:E0:38:41:86:07 - SW2: 0C:0E:15:22:05:97 - SW3: 0C:0E:15:1A:3C:9D - SW4: 0C:E0:18:A1:B3:19

Comparing hex values, SW3 has the smallest MAC after the first two octets (0C:0E:15:1A... is smaller than 0C:0E:15:22... and smaller than the 0C:E0… entries).

Therefore, the root bridge is SW3.

Answer: C.

Frankfurt Am Main, Germany

Community-Verified AI Explanation Commented on April 23, 2026
Question 3:
Answer: False
Explanation:

In Snowflake, a database is an account-scoped object and exists in a single Snowflake account.

Cross-account access is possible via Secure Data Sharing or by creating a database in the consumer account from a shared object, but that results in a separate database in the consumer account, not the same database existing in both accounts.

Therefore, a single database cannot exist in more than one Snowflake account.

Bengaluru, India

Community-Verified AI Explanation Commented on April 23, 2026
Question 16:

Answer: No

Why: The Azure API Management service is for publishing, securing, and monitoring APIs. It does not automate or provision Azure infrastructure resources.

What to use instead:

- Azure Resource Manager (ARM) templates or Bicep to define the identical set of resources once and deploy them per business unit. - You can parameterize the template to customize naming or unit-specific settings. - For governance and scalable deployments across many units/subscriptions, consider Azure Blueprints or deployments via pipelines.

Summary: To auto-create identical resource sets for multiple units, use ARM/Bicep (with parameters) rather than API Management.

London, United Kingdom

Community-Verified AI Explanation Commented on April 23, 2026
Question 41:

Answer: C (1, 6, 11)

Explanation:

In the 2.4-GHz band, each WLAN channel is about 20 MHz wide and adjacent channels overlap, which can cause collisions.

To minimize interference in a single area, you use three non-overlapping channels: 1, 6, and 11. These are spaced so their 20 MHz footprints don’t significantly overlap.

The mention of “direct sequence spread spectrum (DSSS)” refers to the modulation method used by older 2.4-GHz networks; it doesn’t change the need for non-overlapping channels. Choosing 1, 6, and 11 helps reduce collisions even with DSSS.

Frankfurt Am Main, Germany

Community-Verified AI Explanation Commented on April 23, 2026
Question 39:

Correct answer: C

Explanation:

In CSMA/CD Ethernet, collisions are detected while transmitting. If a collision is detected after at least 64 bytes have been transmitted, it is a late collision.

A runt collision refers to a collision on a frame smaller than the minimum 64 bytes.

The CRC counter increments when a frame fails the CRC check, not due to a collision timing.

Here, since the collision is detected after the first 64 bytes, the interface counter increments for a late collision.

Frankfurt Am Main, Germany

Community-Verified AI Explanation Commented on April 23, 2026
Question 37:

Correct answer: B

Explanation:

You need one subnet to cover all floors with 30–40 users per floor ? roughly 320 hosts. The subnet must provide at least 320 usable addresses.

A /23 (255.255.254.0) gives 510 usable addresses, which is sufficient.

Other options are too small or wasteful:

- A: /16 = 65,536 addresses (wasteful for a single building) - C: /25
Frankfurt Am Main, Germany

Community-Verified AI Explanation Commented on April 23, 2026
Question 28:
Correct answer: D

CAPWAP stands for Control and Provisioning of Wireless Access Points. In local mode, an AP forms a CAPWAP tunnel to the WLC over the IP network, so the AP can be connected to any switch in the network as long as it can reach the WLC (no need for a direct link to the WLC).

Discovery and traffic flow: The AP discovers the WLC (via DHCP option, DNS, or configured WLC IP) and then tunnels control and data traffic to the WLC using CAPWAP (control on UDP 5246, data on UDP 5247). This centralizes management and RF decisions at the WLC.

Why other options are incorrect: It does not have to be on the same switch as the WLC (B) or directly connected via copper to the WLC (C), and it does not create a network loop simply by being wired (A).

Frankfurt Am Main, Germany

Community-Verified AI Explanation Commented on April 23, 2026
Question 25:

Correct answers: A and C.

Why:

A: “5GHz provides increased network capacity with up to 23 nonoverlapping channels.” 5 GHz offers many more nonoverlapping channels than 2.4 GHz, increasing capacity and reducing co-channel interference.

C: “Cells that overlap one another are configured to use nonoverlapping channels.” In overlapping cells, you assign nonoverlapping channels to minimize interference.

Why others are not correct:

B: “5GHz channel selection requires an autonomous access point.” Not true; auto channel selection can be done by a Wireless LAN Controller (WLC) as well.

D: “Adjacent cells with overlapping channels use a repeater access point.” Repeater/mesh often reduces throughput; not a standard best-practice for maximizing performance.

E: “For maximum throughput, the WLC is configured to dynamically set adjacent points to the channel.” Dynamic channel assignment exists, but it’s not listed as one of the two primary design standards in this question.

Frankfurt Am Main, Germany

Community-Verified AI Explanation Commented on April 23, 2026
I thought public and private ip each has own NIC?

No. In Azure, a single NIC can have both a private IP and a public IP address.

For five VMs, you need five NICs total (one NIC per VM) to give each VM both IPs, meeting the requirement.

Only add more NICs if a VM requires connections to multiple networks or subnets, not just for separate IPs.

Kigali, Rwanda

Community-Verified AI Explanation Commented on April 22, 2026
Question 27:

Answer: No.

Why: To manage Defender for Office 365 settings and policies (including those for Teams, SharePoint, and OneDrive), SecAdmin1 must have the Security Administrator role. The Exchange Administrator role only provides rights to manage Exchange Online and does not grant Defender or Purview/compliance access.

How to fix: Grant SecAdmin1 the Security Administrator role in Microsoft Entra ID (or via the Microsoft 365 admin center under Roles > Security Administrator). This role gives access to Defender portals and related security features.

Singapore, Singapore

Community-Verified AI Explanation Commented on April 22, 2026
Détaille Include in every user group
Include in every user group (FortiOS 7.6)

Définition: lorsque cette option est activée lors de la configuration d’un serveur RADIUS sur FortiGate, FortiGate insère automatiquement le serveur RADIUS dans tous les groupes d’utilisateurs FortiGate existants et futurs.

Impact sur les utilisateurs: tout utilisateur qui s’authentifie via ce serveur RADIUS devient membre de chacun des groupes FortiGate. En pratique, cela permet à ces utilisateurs d’être pris en compte par toutes les politiques qui référencent des groupes FortiGate. Attention: un filtrage de groupe via des attributs RADIUS peut restreindre ou modifier ces associations.

Pourquoi l’utiliser: utile lorsque le même source d’authentification externe doit être accepté par plusieurs politiques utilisant différents groupes d’utilisateurs.

Points à considérer:

- ne modifie pas les groupes côté RADIUS; FortiGate n’envoie pas les groupes FortiGate vers le serveur RADIUS. - peut élargir l’accès si mal utilisé; combinez-le avec des attributs RADIUS pour des filtrages fins. - n’affecte pas les groupes LDAP/RADIUS côté serveur; il s’agit d’une relation côté FortiGate uniquement.

Exemple rapide: si une politique vérifie les appartenances à « VPN Users » et « Admins », activer cette option fera que les utilisateurs RADIUS authentifiés y seront automatiquement membres.

Paris, France

Anonymous User Commented on April 22, 2026
Upload this exam please!
Pretoria, South Africa

Community-Verified AI Explanation Commented on April 22, 2026
Question 22:

Correct answer: True (A)

Explanation: Snowflake’s data unload capability allows exporting data from a table to external storage in various file formats, including semi-structured formats like JSON and Parquet. By specifying the FILE_FORMAT option (e.g., JSON or PARQUET), you can unload structured data into these formats for interoperability with other systems or data lakes. The reference doc covers how to prepare and unload data in different formats.

Hyderabad, India

Community-Verified AI Explanation Commented on April 22, 2026
Question 4:
For Question 4, the correct answer is C: The Order field in the Variable form.
Why:

The display sequence of fields within a Service Catalog item is controlled by the Order value on each Variable record. Lower numbers display first; you can set increments (e.g., 10, 20, 30) to re-order easily.

The Default Value field only sets what value appears by default, not the display order.

The Sequence field in the Catalog Item form is not used to control per-variable display order.

The Choice field in the Variable form defines the available options for that variable (for select-type fields), not the overall display order.

Tip:

When arranging variables, edit each variable’s Order to achieve the desired sequence. If two variables share the same order, ServiceNow uses a secondary tie-breaker.

New Delhi, India

Community-Verified AI Explanation Commented on April 21, 2026
Question 30:

The goal: Build an app that routes incoming email/direct messages to French or English language support teams.

Correct answer: Use the Translator Text API at api/cognitive.microsofttranslator.com (Option A).

Why this is correct:

- The Translator API can detect a message’s language and translate content, enabling you to route messages to the appropriate language team based on detected language. - This directly supports language-based routing.

Why the other options are incorrect:

- eastus.api.cognitive.microsoft.com is associated with the Face API, not language routing. - portal.azure.com is the Azure portal for management, not a Cognitive Services API endpoint. - The endpoint /text/analytics/v3.1/entities/recognition/general is for Named Entity Recognition in the Text Analytics API, not for language detection or translation.
Nagercoil, India

Community-Verified AI Explanation Commented on April 21, 2026
Question 27:

Answer: No

Why: MFA (Multi-Factor Authentication) strengthens user login by requiring an additional factor, but it does not encrypt or protect credentials used during automated deployments. In automation, there’s no interactive user to provide MFA, and credentials could still be exposed in deployment artifacts.

What to use instead:

- Store admin credentials in Azure Key Vault as secrets. - Access secrets during deployment via a Managed Identity or a dedicated service principal with a certificate to securely retrieve them. - Ensure proper access policies and encryption at rest (Key Vault uses hardware-backed keys).

Quick takeaway: MFA secures human authentication; for protecting credentials in automated deployments, use Key Vault + Managed Identity/service principal approach.

Monza, Italy

Community-Verified AI Explanation Commented on April 21, 2026
Question 50:
Answer: A

A. Purchase Provisioned Throughput for the custom model. Why: To use a custom Bedrock model, you must allocate provisioning throughput so Bedrock has the compute capacity to run inferences and scale with demand.

Why the others are incorrect:

B. Deploy the custom model in an Amazon SageMaker endpoint. Not required for Bedrock; Bedrock serves models via its own endpoints.

C. Register the model with the Amazon SageMaker Model Registry. SageMaker Registry is separate from Bedrock; not needed to use Bedrock models.

D. Grant access to the custom model in Amazon Bedrock. Access control is important, but the must-do to enable usage is provisioning throughput.

Johannesburg, South Africa

Community-Verified AI Explanation Commented on April 21, 2026
Question 49:
Answer: A and C

A. Detect imbalances or disparities in the data. Why: Identifying data bias helps minimize discriminatory outcomes and improves fairness before training.

C. Evaluate the model's behavior so that the company can provide transparency to stakeholders. Why: Responsible AI requires monitoring and reporting on model behavior, enabling fairness audits and stakeholder trust.

Why others are incorrect:

B. Ensure that the model runs frequently. Not directly about bias minimization; more about operations/monitoring, not fairness.

D. Use ROUGE to ensure that the model is 100% accurate. ROUGE is for text summarization, not overall model accuracy; 100% accuracy is unrealistic.

E. Ensure that the model's inference time is within the accepted limits. Performance/latency, not bias minimization or transparency.

Johannesburg, South Africa

Community-Verified AI Explanation Commented on April 21, 2026
Question 51:

Answer: No.

Why: The goal is to implement a phrase list in Conversational Language Understanding, not to create a separate utterance for each phrase. A phrase list is a separate resource that provides a set of known strings to help the model recognize values (like city names) across intents. Creating a new utterance for each phrase does not utilize the phrase list feature correctly.

How to implement correctly:

- Create a Phrase List (e.g., LocationPhrases) containing the items: London, Seattle, Ukraine. - Attach or reference this phrase list from the FindContact intent so city names are recognized reliably. - Use these phrases to guide recognition of the location values in user input.

Result: This leverages the phrase list capability to improve matching of location names without inflating training utterances.

Courbevoie, France

Community-Verified AI Explanation Commented on April 21, 2026
Question 9:

Correct answer: D. Azure Logic Apps

Why: Defender for Cloud’s workflow automation is designed to trigger automated, end-to-end workflows when security alerts, recommendations, or compliance changes occur. Azure Logic Apps provides a low-code, visual workflow designer with built-in connectors (including Defender for Cloud) to orchestrate remediation, notifications, and ticketing across Azure and other systems.

How to implement (conceptual gist):

- Create a Logic Apps workflow that is triggered by Defender for Cloud security alerts or recommendations. - Add actions to remediate (e.g., run remediation scripts, adjust NSGs, notify InfraSec), and to log or ticket the incident. - Use connectors to integrate with other services (Azure Automation, ITSM, Teams/Slack) for coordinated response.

Why not the others:

- Azure Monitor alert webhooks: useful for basic notifications, not full workflow orchestration. - Azure Event Hubs: data ingestion, not remediation workflows. - Azure Functions: possible for automation but requires more custom coding; Logic Apps is the recommended, simpler workflow platform for this use case.
Bollnäs, Sweden

Community-Verified AI Explanation Commented on April 21, 2026
Question 64:

Correct answer: B, C, E

Why:

- B: Adjust the inventory quantity to zero — you need zero on-hand quantity so you don’t carry old stock into the new costing method. - C: Adjust the inventory cost to zero — clears existing value so the transition doesn’t lock in standard-cost balances. - E: Change the Item Model Group — the Item Model Group defines the costing method; switching it to Moving Average is how you enable moving average costing going forward.

Why the other options aren’t suitable:

- A: Change the Item Group — affects category/grouping, not the costing method needed for this conversion. - D: Run inventory close — not listed as required in the provided solution for this specific conversion sequence.

Quick implementation idea:

- For each item to convert, set on-hand quantity to 0 (B) and on-hand cost to 0 (C), then update the Item Model Group to use Moving Average (E). After this, new transactions will use moving average costing.
Bengaluru, India

Community-Verified AI Explanation Commented on April 21, 2026
Question 6:
For Question 6:

Correct answer: B. Create an AWS Snowball Edge job. Receive a Snowball Edge device on premises. Use the Snowball Edge client to transfer data to the device. Return the device so that AWS can import the data into Amazon S3.

Why this is correct:

The goal is to move about 70 TB with the least use of network bandwidth and as fast as possible.

Snowball Edge is a physical data transfer device. You load data locally, ship it back to AWS, and AWS imports it into S3. This minimizes impact on your production network and is typically the fastest option for large volumes.

Why other options are not optimal:

A: Copying over the network with the AWS CLI would consume significant bandwidth and take longer.

C: An S3 File Gateway transfers data over your network to S3, adding latency and using your bandwidth.

D: A Direct Connect link still relies on network transfer and adds unnecessary complexity for a one-time bulk migration.

Key concept: For large, one-time migrations with minimal network impact, offline transfer with Snowball Edge is preferred.
Chennai, India

Community-Verified AI Explanation Commented on April 20, 2026
Question 104:

Correct answer: A — PDU selections must be changed using the panel icon.

Explanation:

- With PDUs rated at 12A, you should not exceed 80% for continuous load, which is 9.6A per PDU. - To meet the 9.6A limit and maintain redundancy, reconfigure which devices are fed by which PDU (instead of leaving the same devices on the same PDUs). - In the simulator’s example, you would: - Keep the Mail Relay on Rack1, but move its primary/failover to PDU B. - Move VM Host 1 and VM Host 2 to Rack2. - Assign VM Host 1 primary to PDU A and failover to PDU B. - Assign VM Host 2 primary to PDU B and failover to PDU A. - This distributes load across PDUs A and B so no single PDU exceeds 9.6A and provides redundancy if one PDU fails.
Cape Town, South Africa

Community-Verified AI Explanation Commented on April 20, 2026
Question 2:
Correct answer: B
Explanation:

The peak is predictable (weekends 6 PM–11 PM), so a scheduled scaling action is the most operationally efficient. You configure the Auto Scaling Group to increase the desired capacity before the peak and decrease it after, with recurrence rules for the weekend times.

This uses built-in ASG functionality, requires no custom code or maintenance, and ensures capacity is ready in advance.

Why not the other options?

A (Lambda with a scheduled rule): Adds custom code to manage capacity, increasing maintenance and potential failure points.

C (target tracking by memory): Reactive rather than proactive; may not align precisely with weekend peaks and may not guarantee capacity before load spikes.

D (cooldown adjustments): Cooldown manages pacing after scaling actions, not scheduling or pre-emptive scale-out for known peak times.

Key concept:

Use scheduled actions in an ASG to proactively adjust capacity at known peak times for predictable workloads, maximizing performance with minimal ongoing ops.

São Paulo, Brazil

Community-Verified AI Explanation Commented on April 20, 2026
Question 4:

Correct answer: D. A safe environment in which to develop practical skills and knowledge of a technology and to test the technology.

Explanation:

The primary purpose of a wireless equipment lab is to provide a controlled, safe space for hands-on learning and testing without impacting production systems.

It supports skill development, experimentation, and troubleshooting.

Other options are not the main benefit: not primarily for RF exposure testing (A), production failover (B), or repurposing old hardware (C).

Innisfil, Canada

Community-Verified AI Explanation Commented on April 20, 2026
Question 1:
Question 1 asks which statements correctly describe language options when using Snowflake interfaces (select TWO).

A. Notebook cells can be written in Python. Correct. Snowflake Notebooks support Python as an executable cell type alongside SQL.

C. Notebook cells can be written in SQL. Correct. Notebooks also support SQL cells for declarative querying.

Why the others are not correct:

B. Databases can process queries using Scala. Not correct. Snowflake does not natively execute queries in Scala; Scala is available via Snowpark for application code, not as a direct query language.

D. Worksheets can only be written in SQL. Not correct. Snowsight worksheets are SQL-based but can also use Snowflake Scripting (procedural code), so they’re not restricted to SQL alone.

E. Dashboards can be written in JavaScript. Not correct. Dashboards are SQL-backed visualizations in Snowsight; JavaScript isn’t the authoring language there.

Key takeaway: A and C are the correct options because Snowflake Notebooks support both SQL and Python for notebook cells.
Innisfil, Canada

Community-Verified AI Explanation Commented on April 20, 2026
Question 12:

Correct answer: Test a flow with rollback

Why: Flow Designer supports:

- Call a subflow from a flow - Use Delegated Developer - Run a flow from a MetricBase Trigger The ability to test a flow with rollback is a capability of the Automated Test Framework (ATF), not Flow Designer.
Bengaluru, India

Community-Verified AI Explanation Commented on April 20, 2026
Question 7:

Answer: A — Association Response is a Management Frame.

Why:

- 802.11 frames are categorized into Data Frame, Management Frame, and Control Frame. - The Association Request/Association Response are part of the Management Frame used during the initial association process between a station and an AP. - The AP sends the Association Response in reply to the Association Request, indicating status and assigning an AID.
If you want, I can explain what’s included in the Association Response (e.g., status code, AID).
Harare, Zimbabwe

Community-Verified AI Explanation Commented on April 20, 2026
Question 21:

Answer: Utility (D)

Explanation:

In ITIL 4, value from a service comes from two properties: utility and warranty.

Utility = fitness for purpose; it asks whether the service provides the right functionalities and outcomes to meet customer needs.

Warranty = fitness for use; it covers availability, capacity, continuity, and security.

So to determine if a service is fit for purpose, assess its utility—does it deliver the required features and outcomes for the user?

Norwich, United Kingdom

Sumit Chaturvedi Commented on April 20, 2026
Is CAD Exam Have same questions every time or it changes on each attempts or changes few but not all, Please Suggest if some one have this info
Singapore, Singapore

Community-Verified AI Explanation Commented on April 20, 2026
Question 1:

Correct answer: Databricks web application (Option C)

Why:

- In the classic Databricks architecture, the control plane hosts the managed services that handle UI, authentication, and orchestration (the Databricks web application and related APIs). - The data plane runs the actual compute resources (the driver node and worker nodes) and storage interfaces like DBFS. - Therefore, the web application is hosted completely in the control plane, while the compute components (driver/worker) are in the data plane.
Pune, India

ACFE Certified Fraud Examiner - Fraud Prevention and Deterrence Exam Exam Questions Certified Fraudiner - Fraud Prevention

Pass the Certified Fraudiner - Fraud Prevention exam with community-verified questions and a free, built-in AI Tutor.

ACFECertified Fraud ExaminerFraud Prevention and Deterrence Exam

Total Questions: 141

Certified Fraud Examiner - Fraud Prevention and Deterrence Exam Exam Discussions & Posts

ACFE Certified Fraud Examiner - Fraud Prevention and Deterrence Exam Exam Questions
Certified Fraudiner - Fraud Prevention

ACFE
Certified Fraud Examiner
Fraud Prevention and Deterrence Exam