PCI Practice Questions (2026) — Free Sample Questions with Answers

Answer: C

Investigate both warehouses now and explain the overrun with full documentation in the final report.: Do it but document it: documentation after the fact does not substitute for the client's prior authorization of added cost.

Finish the first warehouse within budget and mention the second site in the final report.: Withholds a material lead from the client until it may be too late to act on it within the deadline.

Brief the client on the new lead, the added hours and time, and get approval before expanding.: Correct: a scope or budget change is the client's decision. The investigator presents the lead with a revised cost and timeline estimate and proceeds only on approval, keeping resource use authorized and documented.

Shift hours from the remaining planned interviews at the first site to cover the second warehouse.: Silently reallocates resources away from the approved plan, weakening the original inquiry without client approval.

When new information would change scope, cost or time, the investigator re-estimates resources and gets the client's approval before proceeding.

Answer: B

Suspend all internal work until the criminal case has been fully resolved: Overcorrects: parallel proceedings do not automatically halt the internal case; counsel and the police may agree on steps that can continue.

Coordinate with the police through counsel before further internal steps: Correct. In parallel proceedings, internal steps such as the subject interview or evidence handling can compromise the criminal case; counsel coordinates timing and information sharing while the organization's own decisions proceed lawfully.

Continue as planned and give the police the findings at case closure: Ignoring the criminal case risks alerting the subject, duplicating or tainting evidence, and conflicting with police steps.

Interview the agent right away, before the police are able to contact the agent: Racing the police can alert the subject and interfere with the criminal investigation.

When a criminal investigation runs in parallel, coordinate the internal case flow with law enforcement through counsel so neither proceeding is compromised.

Answer: D

A link chart of his associates: A link chart shows relationships, not the subject's movements over time.

A comparison of the witnesses' time estimates: Witness estimates are the least precise source; they corroborate a timeline rather than replace it.

A review of the badge-reader records alone: Badge data is useful, but a single source cannot be cross-checked; the timeline combines and reconciles all of them.

A timeline of all time-stamped sources: Correct. A timeline places every time-stamped record in sequence (after reconciling clock differences between systems) and directly tests the claimed departure time.

To test an alibi or reconstruct events, build a timeline from all time-stamped sources and reconcile their clocks.

Answer: B

Accept after obtaining the supplier's written acknowledgment of the earlier engagement: The new client's consent cannot waive the former client's confidentiality interests; the conflict remains.

Decline the engagement, stating only that a conflict of interest prevents acceptance: Correct. The prior engagement and the nondisclosure agreement create a conflict of interest adverse to the former client. The investigator discloses that a conflict exists, not the facts behind it, and declines.

Decline, but advise the supplier to examine Company X's procurement approval records: "Hint and decline": steering the supplier uses confidential knowledge from the prior engagement.

Accept, rely only on public records, and document that no prior knowledge was used: "Do it but document it": the investigator cannot set aside what was learned, and the conflict persists.

When a prior engagement creates a conflict adverse to a former client, decline the case; disclose that a conflict exists, never the confidential facts.

Answer: C

direct threats from conditional threats: Direct and conditional threats are types of communicated threats; the principle concerns people who communicate nothing.

instrumental violence from affective violence: This distinguishes planned, goal-directed violence from reactive, emotional violence; it is related but is not the "communicated vs actual risk" principle.

posing a threat from making a threat: Correct. Making a threat (communicating it) and posing a threat (being on a path toward violence) are different; the assessment focuses on behavior and preparation, not only on statements.

actionable intelligence from raw information: This is an intelligence-cycle distinction about processed vs unprocessed information, not about threat behavior.

Threat assessment asks whether a person poses a threat (behavior, planning, preparation), not just whether the person made one.

Answer: D

Allow a small, controlled theft so the operative keeps his credibility, and document it in detail.: A "controlled" theft is still a crime by the operative; documentation does not make it lawful and taints the evidence.

Allow participation once client management gives written approval and the goods are recovered later.: Client approval cannot authorize a crime, and recovering the goods later does not remove the operative's criminal participation.

Have the operative act only as a lookout and handle none of the goods.: Acting as a lookout is still taking part in the theft; limiting the role does not make it lawful.

Tell the operative not to take part, document the approach, and reassess safety and the plan.: Correct. An operative must not commit crimes or encourage others to commit them. The approach is documented, and the case manager reassesses safety and other ways to identify the buyer, such as surveillance or law enforcement liaison.

Undercover operatives observe and report; they do not commit or instigate offenses, and a demand to take part triggers a documented safety and strategy review.

Answer: B

Report that the employee displayed deceptive behavior consistent with involvement.: Wrong — it states an opinion as a finding; behavior cues are not proof and do not belong in a report as conclusions.

Treat the behaviors as cues, probe the vague period, and seek corroborating evidence.: Correct — deception indicators only flag areas to probe; findings must rest on evidence, not on demeanor.

Reinterview the employee and ask why the employee was lying about the evening.: Wrong — it treats cues as proof and turns the interview accusatory without evidence.

Close the interview phase, since the behaviors together establish that the account is untrue.: Wrong — nervousness and word choice have innocent explanations; they cannot establish untruthfulness.

Verbal and nonverbal indicators of deception are cues to probe further and corroborate, never proof of deception or guilt.

Answer: C

Interview the manager first, so the explanation can be tested against later witnesses.: Wrong order — interviewing the subject first reveals the inquiry before facts are fixed and gives the subject the chance to influence witnesses.

Interview the director first, then the manager, and the clerks last.: Wrong order — the subject is questioned before the clerks' processing knowledge is gathered.

Interview the clerks first, then the approving director, and the manager last.: Correct — interview from least to most involved, so the subject is interviewed last with all evidence and witness accounts in hand.

Interview the clerks first, then the manager, and the approving director last.: Wrong order — the subject is interviewed before the director's approval practice is known, leaving a gap to confront later.

Sequence interviews from neutral witnesses to those closer to the matter, with the subject last, once the evidence and witness accounts are fixed.

Answer: B

Refuse all cooperation with the regulator in order to keep the promise made to the source: Overcorrects: refusing all cooperation may breach legal duties and damages the liaison relationship.

Consult legal counsel on any duty to disclose, and release the identity only if the law requires it: Correct. The investigator protects the source within the law and lets counsel decide whether disclosure is required.

Name the source to the regulator because a government request overrides the promise of confidentiality: An informal request does not automatically create a legal duty to disclose; this abandons the source too early.

Decline to name the source but describe the source's department and role so the regulator can follow up: Hint and decline: identifying details reveal the source just as surely as a name.

Protect source identities to the extent the law allows; disclosure decisions under official requests go through counsel.

Answer: C

Unplug the power cord immediately so that the contents of the hard drive are frozen in their current state: Loses volatile memory and may relock the encrypted volume, making its contents unreadable.

Shut the computer down through the operating system so that any open files are saved before seizure: A normal shutdown changes the system, discards memory, and relocks the encrypted volume.

Leave the computer running, secure and photograph the screen, and call in a qualified forensic examiner: Correct. The live state holds evidence that is lost on power-down; the investigator secures it and gets a qualified examiner to capture volatile data.

Copy the open files from the encrypted volume to a clean USB drive before the volume can lock: Exceeds competency and alters the original; an unverified file copy is not a forensically sound collection.

Do not power down a live system with open encrypted data; secure it and have a qualified examiner capture volatile evidence first.

Answer: B

10:42 a.m. Subject showed no sign of the claimed back injury while loading a box into a gray sedan.: Opinion in a log: it draws a conclusion about the injury instead of recording the observed actions.

10:42 a.m. Subject left residence carrying a cardboard box and placed it in the trunk of a gray sedan.: Correct. The entry gives an exact time and records only what was observed, in objective terms.

Late morning. Subject left residence with a box and placed it in the trunk of a gray sedan as expected.: Imprecise time and an editorial comment ("as expected"); logs need exact times.

10:42 a.m. Subject loaded a box that appeared to weigh at least 40 pounds into a gray sedan.: Speculation: the weight is an unsupported estimate that cross-examination will attack.

Surveillance logs record exact times and observed facts only, with no conclusions, estimates or editorial comments.

Answer: D

Install the device for a few days only and record the client's cost justification in the case file: Do it but document: a short duration and a file note do not make unconfirmed tracking lawful.

Install the device after the client signs a written instruction accepting all liability for its use: Exceeds authority: a client cannot authorize what the law does not permit, and the investigator stays accountable.

Arrange for the client's own staff to install the device so that the investigator never handles it: Directing someone else to do it is still the investigator acting; the legal problem is shifted, not solved.

Decline until counsel confirms legal authority, and propose lawful physical surveillance instead: Correct. Surveillance must be authorized and lawful before it begins; with authority unconfirmed, the investigator gets legal advice and offers a lawful method that meets the goal.

Confirm legal authority before any electronic or physical surveillance; client pressure or cost savings never substitute for it.

Answer: D

a people-search database entry: Aggregated data can be outdated or wrong; it is a lead to confirm at the primary record.

a recent tax assessment notice for the parcel: Tax records name the assessed party and can lag behind transfers; they are secondary to the title record.

the title insurance policy issued at purchase: Shows who took title at the time of purchase, not who holds it now.

the official land records at the registry: Correct: the government office that records title is the primary source of record for ownership.

Prefer the primary source of record (the agency that creates the record) over secondary compilations.

Answer: B

Report the profile as an adverse finding and note that the identity has not been confirmed.: Partial-disclosure compromise: a qualifier does not prevent unverified, possibly wrong information from harming the applicant.

Corroborate the identity with more identifiers before using the profile in any finding.: Correct: open-source results must be tied to the subject through several independent identifiers; an unverified match risks reporting false adverse information.

Delay the report until the applicant can be asked whether the profile is theirs.: Asking the applicant may be part of a later process, but the investigator first does the research needed to attribute the profile.

Include the profile, since the name and city match the details on the application.: A common name and a city are not enough to attribute the profile; the match may be a different person.

Attribute open-source information to the subject with several independent identifiers before reporting it.

Answer: D

Leave the email out of the report but keep it in the case file in case it is requested.: Keeping it in the file while leaving it out of the report still produces a misleading report; this is the "keep it but don't report it" compromise.

Mention in a footnote that some contrary material exists without describing it.: A vague footnote hints at the fact without disclosing it, so the report remains incomplete and misleading.

Ask the in-house counsel to decide whether the email belongs in the report.: Deferring to someone who already wants it left out abandons the investigator's duty of objectivity; material facts are not suppressed.

Include the email and explain its effect on the findings in the report.: Correct. Objectivity and integrity require reporting exculpatory as well as inculpatory facts; the email changes which expenses are substantiated and must be in the report.

Reports must be complete and objective: include all relevant facts, including those that favor the subject, regardless of the client's preference.

Answer: B

"Yes, along with the supervisor's staff.": Wrong — it volunteers that other people were interviewed and may open new lines of questioning.

"Yes, I did.": Correct — it answers exactly what was asked, truthfully and briefly.

"I believe so.": Wrong — hedging when the investigator knows the answer is inaccurate and weakens credibility.

"Yes, and it went well.": Wrong — it adds an unrequested, subjective characterization of the interview.

Listen to the question, answer it truthfully and directly, and stop; let counsel bring out further detail on redirect.