Free Professional Certified Investigator (PCI) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Professional Certified Investigator (PCI) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An ASIS member owns a financial stake in a business whose conduct the member is asked to investigate. Which ethical issue is directly raised by that financial stake?

   1. A. Conflict of interest
   2. B. Lack of competence
   3. C. Breach of confidentiality
   4. D. Failure of diligence

   Answer: A

   Explanation: The ASIS Code addresses "conflicts of interest". CIGIE identifies "Official, professional, personal, or financial interests/relationships" as potential impairments to impartial investigative work. The stake raises a conflict; it does not by itself establish deficient skill, disclosure of protected information, or inadequate effort.

   Reference: ASIS International: Code of Ethics — Article III, Ethical Considerations

2. 2An investigator proposes recording every network packet sent and received by a particular employee. Under NIST's guidance, when should this targeted collection begin?

   1. A. After the analyst confirms adequate available capture storage
   2. B. After the analyst completes a trial of the capture configuration
   3. C. After successful completion of the formal request and approval process
   4. D. After the analyst compares the employee's normal traffic baseline

   Answer: C

   Explanation: NIST states that recording all packets for a user "should be initiated only after the successful completion of a formal request and approval process." Storage, configuration, and baselines are technical preparations and do not substitute for authorization.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 6.3.1, Legal Considerations, p. 6-9

3. 3A forensic report must address two plausible accounts of an event that the available information has not resolved. Which reporting consideration named by NIST governs methodically testing those competing accounts?

   1. A. Alternative explanations
   2. B. Audience consideration
   3. C. Actionable information
   4. D. Data-source fidelity

   Answer: A

   Explanation: NIST states, "When an event has two or more plausible explanations, each should be given due consideration in the reporting process." That is its Alternative Explanations consideration. Audience concerns presentation to recipients; actionable information supports further action; fidelity concerns the trustworthiness of source data.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 3.4, Reporting, p. 3-6, Alternative Explanations

4. 4A federal OIG investigator receives an assignment involving a program whose operating decisions the investigator previously managed. Which independence impairment should the investigator identify under CIGIE's investigation standards?

   1. A. External impairment
   2. B. Personal impairment
   3. C. Organizational impairment
   4. D. No independence impairment

   Answer: B

   Explanation: Under Personal Impairments, CIGIE includes "Previous involvement in a decision-making or management capacity that would affect current operations of the entity or program being investigated." The investigator’s own prior involvement is the controlling fact, rather than outside interference or the OIG’s reporting position.

   Reference: Quality Standards for Investigations — General Standards B, Independence, p. 6, Personal Impairments item 3

5. 5An authorized investigator needs to inspect the contents of traffic entering through an encrypted tunnel that terminates at an organizational gateway. Where should the monitoring source be positioned to see decrypted activity?

   1. A. Immediately outside the central gateway
   2. B. Immediately inside the central gateway
   3. C. At the service provider's upstream router
   4. D. At the remote office's external uplink

   Answer: B

   Explanation: NIST states, "To collect data about the decrypted traffic, a data source must be positioned where it can see the decrypted activity." For the tunnel terminating at the stated gateway, the inside position can observe traffic after gateway decryption; the other positions are along the tunnel path.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 6.3.2, Technical Issues, p. 6-10, Encrypted Traffic

6. 6A forensic investigator prepares a briefing for senior management following a network intrusion. Which presentation does NIST identify as suited to that audience?

   1. A. A high-level overview of the incident and how to prevent similar incidents
   2. B. A packet-by-packet decoding of the complete captured traffic record
   3. C. A field-by-field inventory of every operating-system audit entry
   4. D. A device-by-device dump of the original network configuration files

   Answer: A

   Explanation: NIST says senior management may want "a high-level overview of what happened" and prevention information. Detailed raw technical records remain useful supporting material but do not substitute for the requested executive briefing.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 3.4, Reporting, p. 3-7, Audience Consideration

7. 7An ASIS member agreed to protect a client's nonpublic investigative information. The engagement has ended, and no authorization or legal exception permits disclosure. How long does the ethical duty of confidentiality continue?

   1. A. Until the last investigative invoice is paid
   2. B. Until the final report is accepted by the client
   3. C. After the business relationship has terminated
   4. D. Until the investigator closes the evidence file

   Answer: C

   Explanation: The Code states, "This confidentiality continues ... after the business relationship ... has terminated." The confidentiality agreement survives termination under the stipulated facts; payment, report acceptance, and file closure are not substitutes for authorization or a legal exception.

   Reference: ASIS International: Code of Ethics — Article V, Ethical Considerations, due care paragraph

8. 8Several internal hosts share one public address through network address translation. An investigator has the public address and source port associated with suspicious traffic. Which device record is most directly useful for identifying the corresponding internal address?

   1. A. The name-to-address entry in the resolver's cache
   2. B. The physical-to-network address entry in a host's cache
   3. C. The destination-network entry in the router's routing table
   4. D. The address-and-port mapping in the translation device's log

   Answer: D

   Explanation: NIST explains that NAT distinguishes internal addresses through source ports and states, "The NAT device typically records each NAT address and port mapping." That mapping connects the observed translated endpoint to the internal host; DNS, neighbor, and route entries serve other mappings.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 6.2.1, Firewalls and Routers, p. 6-5, NAT paragraph

9. 9A report entry identifies a newly discovered person as a potential source to contact for more information about the incident. What is the appropriate characterization of that entry?

   1. A. Management recommendation
   2. B. Investigative lead
   3. C. Substantiated finding
   4. D. Documented case outcome

   Answer: B

   Explanation: NIST states, "Reporting also includes identifying actionable information gained from data that may allow an analyst to collect new sources of information." A contact for possible additional facts is an investigative lead, rather than an already substantiated conclusion, completed outcome, or management correction.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 3.4, Reporting, p. 3-7, Actionable Information

10. 10An OIG case manager is reviewing the investigator's proposed method. Although the method has worked in other cases, it would not address this case's objectives. Which CIGIE professional-judgment criterion directly governs the choice of method?

    1. A. Timeliness
    2. B. Impartiality
    3. C. Thoroughness
    4. D. Appropriate Techniques

    Answer: D

    Explanation: CIGIE states, "Specific methods and techniques used in each investigation should be appropriate for the circumstances and objectives." Familiarity with a technique does not establish its suitability for the current investigative objective.

    Reference: Quality Standards for Investigations — General Standards C, Professional Judgment, p. 7, Appropriate Techniques