ASIS PCI Certification Sample Questions

01. An investigator is mapping which communications in a workplace matter may be shielded by an evidentiary privilege before requesting them. Which relationship is generally not recognized as carrying such a privilege?
a) Communications between spouses made in confidence
b) Communications between a member of the clergy and a penitent
c) Communications between an attorney and a client about the matter
d) Communications between a parent and an adult child

02. Two employees have given written statements admitting they took company property. None of the property has been recovered, and the case is being prepared for referral to prosecutors. Which additional evidence would most strengthen the case?
a) Independent corroboration of the admissions from records or witnesses
b) Signed acknowledgments that each subject received the property policy
c) The investigator's notes or recordings documenting each interview session
d) A second statement from each subject taken independently by another investigator

03. A surveillance plan provides for progressive coverage of a subject's route in short segments spread across several days. Which requirement does that choice place on the team that continuous coverage would not?
a) Fixing the total number of coverage days in advance of the first observation period
b) Maintaining unbroken communication between all units for the whole of every observation period
c) Committing one operative to stay with the subject for the whole of the operation
d) Recording the point and time at which each period of observation is broken off

04. Before the investigator arrives at a workplace scene, a maintenance worker moves an item of physical evidence away from where it had been lying. How should the investigator handle the documentation of that item?
a) Returning the item to its original position and documenting the scene as found
b) Excluding the item from the evidence record because its position was altered
c) Documenting the item where it now lies and noting who moved it in the record
d) Recording the position the worker recalls and documenting it as the found location

05. A forensic image has been acquired, and its hash does not match the hash taken from the source media. How should the examiner proceed?
a) Hash the source and the image again, and adopt whichever pair matches
b) Re-acquire the image and record both the mismatch and the second result
c) Proceed with the examination and note the mismatch when the report is written
d) Examine the image and treat the difference as unlikely to be material

06. When identifying the audience for an investigative report, what is MOST important?
a) Adding a recommended disciplinary outcome for the audience to act on
b) Ensuring the report reaches every stakeholder named in the case file
c) Matching the level of detail and terminology to that audience
d) Removing exculpatory material and unrelated personal detail from the report

07. A surveillance team assesses that the subject is alert to being followed and that the risk of detection during continuous coverage is high. Which surveillance method is preferred under these conditions?
a) Rough-tail surveillance, applying open pressure on the subject during coverage
b) Close-tail surveillance, keeping continuous visual contact with the subject throughout
c) Fixed-post surveillance, observing the subject from one static vantage point each day
d) Progressive surveillance, covering the subject's route in short segments over several separate days

08. Which preparation step MOST improves an investigator's performance when testifying?
a) Reviewing the case documentation and one's own prior statements
b) Preparing an explanation for matters outside the investigator's personal knowledge
c) Memorizing the conclusions and recommendations in the final report
d) Rehearsing the answers with counsel, agreeing the wording in advance

09. A law firm has retained an investigator to conduct a background investigation on an applicant for one of the firm's clients. The investigator recalls that the applicant was discharged for misconduct following an embezzlement investigation that this same investigator conducted.
The reference from the former employer is glowing and was given by the applicant's former partner and confidant rather than by management. The investigator is bound by a nondisclosure agreement with the former employer.
How should the investigator proceed?
a) Completing the background investigation and reporting every fact the investigator knows about the applicant to the client
b) Advising the law firm that a conflict of interest exists and declining the engagement
c) Declining the engagement after summarizing the prior findings verbally so the law firm is not misled
d) Accepting the engagement and flagging the reference as unverified, leaving the prior case out of the report

10. Investigators reach a workstation that is still powered on, with an encrypted volume open and a messaging application running. How should the acquisition proceed?
a) Closing the open applications and shutting down cleanly, so that the file system is left intact
b) Disconnecting power at once so that nothing further is written to the disk
c) Leaving the machine untouched until an examiner is available on site
d) Capturing the running state first and recording what was done and why