Private Investigator Practice Questions (2026) — Free Sample Questions with Answers

Answer: A

Refuse, and invoice the actual client for the work performed: Correct. Describing personal surveillance as corporate security creates a false business record that could help defraud the company, its tax filings or the divorce court. Invoices must accurately describe the services and the client.

Bill the company using the neutral label "investigative services": A vague label still bills the company for the owner's personal matter, which misrepresents who the client is.

Comply if the owner signs a note accepting responsibility: A signed note shifts no blame for a false record and does not make the invoice accurate.

Bill the company now and reissue a correct invoice later: The false invoice exists as soon as it is sent; a later correction does not undo it.

Invoices must name the true client and accurately describe the work; never relabel services to help a client mislead others.

Answer: D

Surveillance, 7.5 hours: From 0615 to 1345 is 7.5 hours, which matches the log.

Mileage, 42 miles: The odometer entry records 42 miles, which matches the invoice.

Travel time, 1.0 hour: 0545–0615 plus 1345–1415 equals 1.0 hour, which matches the log.

Report preparation, 3.0 hours: Correct. The log shows report drafting from 1500 to 1630, which is 1.5 hours, so billing 3.0 hours is unsupported. Surveillance (0615–1345 = 7.5 h), travel (0.5 h each way = 1.0 h), mileage and parking all match the log.

Before billing, reconcile every invoice line against the contemporaneous log and receipts; bill only what the records support.

Answer: C

It means the investigator does not need a license: Working for an attorney does not exempt investigative work from licensing in most states.

It makes every investigator note absolutely privileged: Work product is qualified, not absolute; substantial need can overcome it.

It helps establish the work as litigation work product: Correct. Under FRCP 26(b)(3), materials prepared in anticipation of litigation by or for a party or its representative are work product, discoverable only on a showing of substantial need. Documenting that counsel directed the work supports that protection.

It frees the investigator from the duty of confidentiality: Confidentiality duties remain; the arrangement strengthens protection.

Engagement through counsel helps protect investigative materials as work product, but that protection is qualified, not absolute.

Answer: C

Refer him to an online records vendor for the address: Pointing him to a vendor still helps a restrained party find the protected person.

Run the locate but report only the city where she lives: Even partial location information could help the client find and harm her.

Decline the locate and document the reason: Correct. A protective order signals that the person may be at risk from the client. Locating her could facilitate stalking or a violation of the order, so the engagement should be declined and the reason recorded.

Check whether the order is still in effect first: Whether the order is active or expired, the history signals that she may be at risk from him; the status check does not change the answer.

Evaluate the client's purpose before any locate; refuse work that could help someone stalk or harm the subject.

Answer: C

Sentence 1: It gives the date, time, subject and location of an observation, which is proper factual reporting.

Sentence 2: It describes a specific physical action the investigator saw, which is factual.

Sentence 3: Correct. It states an opinion about honesty that the investigator did not observe; the report should describe what was seen and let the client draw conclusions.

Sentence 4: It gives a time and direction of travel that were observed, which is factual.

Reports state facts in neutral language (who, what, when, where, how) and avoid conclusions about honesty, guilt or motive.

Answer: B

The vehicles' points of final rest: Final rest is where the vehicles stopped after the crash, usually shown by their positions and fluid pools.

The point of impact: Correct. Gouges made when vehicle parts dig into the road at maximum engagement, and the densest debris field, mark where the vehicles collided.

Each driver's speed before braking: Speed estimates rely mainly on skid-mark length and road friction, not on gouges and debris.

Each driver's perception-reaction time: Reaction time cannot be read from gouges or debris; it depends on human factors.

Gouges, scrapes and the main debris field locate the point of impact; tire marks show the path and braking; vehicle positions show final rest.

Answer: C

0725, because the plate should not be recorded: Noting the plate of the vehicle the subject uses is routine and identifies it.

0712, because carrying a bag is not relevant to the claim: Carrying a bag in one hand is an observed physical activity and may be relevant.

0750, because it states a conclusion rather than an observation: Correct. The log should record what was seen; "obviously faking" is an unsupported opinion that the investigator did not observe and could be attacked as bias.

0910, because "normal pace" is a judgment the investigator cannot make: "Walking at a normal pace" is a plain description of observed movement, not a conclusion about the claim.

Surveillance logs record time-stamped, objective observations; conclusions about fraud or injury belong to the client or fact-finder.

Answer: A

Advise that federal law generally bars such testing: Correct. Under the Employee Polygraph Protection Act (29 U.S.C. §2002) most private employers may not require, request or use lie-detector tests or discipline employees who refuse; the narrow ongoing-investigation exemption (§2006(d)) needs a specific loss, access and individual reasonable suspicion.

Schedule the tests once every employee signs a consent form: Consent forms do not cure a blanket request; the Act bars requesting the test and firing employees who decline.

Limit the tests to employees who work the night shift: Working a shift is not individual reasonable suspicion, and firing for refusal is still prohibited.

Use voice stress analysis instead of a polygraph: The Act's definition of a lie detector includes voice stress analyzers, so the substitution does not help.

The federal EPPA bars most private employers from requiring or using lie-detector tests; the theft exemption is narrow and never allows blanket testing or firing for refusal.

Answer: B

That Dimitrov no longer has any interest in the house: The deed shows a transfer, but his continued possession suggests he kept the benefit.

A possible fraudulent transfer to shield the house: Correct. A transfer to an insider-controlled entity, for nominal consideration, weeks after the judgment, while the debtor keeps living there, shows classic "badges of fraud" supporting a voidable (fraudulent) transfer claim.

That Dimitrov has filed for bankruptcy protection: Nothing in the records indicates a bankruptcy filing.

That Elena Dimitrov is personally liable for the judgment: The records do not show she is a judgment debtor; the claim would target the transfer.

Timing, insider transferees, nominal price and retained possession are indicators of a fraudulent transfer; report the facts and let counsel pursue the claim.

Answer: C

Run it, because licensed agencies may obtain DMV information: Section 2721(b)(8) limits agencies to purposes otherwise permitted under (b).

Run it, if the client signs a statement of his purpose: A signed statement of an impermissible purpose does not make it permissible.

Decline, because personal interest is not a permissible use: Correct. The DPPA allows motor vehicle record personal information only for listed permissible uses. A licensed agency may obtain it only for a purpose permitted under §2721(b), and a client's personal curiosity is not one.

Run it, but give the client only her first name: Obtaining the record for this purpose violates the Act regardless of what is shared.

Under the DPPA, a license gives no blanket access; every request for driver record information needs a listed permissible use.

Answer: B

Report the photos to the client as proof of fraud: Reporting unverified content risks a false conclusion and later impeachment.

Confirm the account is his and when the photos were taken: Correct. Open-source findings must be verified before they are reported: the account could belong to someone else, and a photo posted last week may have been taken years earlier. The investigator should also preserve captures with URLs and dates.

Message the claimant to ask about the trip: Contacting the subject compromises the investigation and may reach a represented party.

Send a friend request from a fictitious profile: Deceptive access adds legal and ethical risk and does not verify the photos.

Treat social media as a lead: verify ownership and the date of the activity, preserve it, then report facts.

Answer: B

Oct 2, 0930, because the client's employee handled the laptop: Receiving evidence from the client is normal; the transfer was sealed and signed by both people.

Oct 9, because it lacks time, signatures and seal status: Correct. The return entry does not show who returned the laptop, at what time, who received it, or whether it was resealed after the examination, leaving a gap in documented custody.

Oct 14, 0800, because the laptop left the cabinet for court: Removal for court is expected, and this entry records who took it, when, and that the bag was sealed.

Oct 6, 1400, because a forensic examiner took possession: Releasing evidence to an examiner is proper when it is signed and the seal is noted.

Every transfer in the chain of custody needs date, time, the persons releasing and receiving, purpose and seal condition; an undocumented step invites an authentication challenge.

Answer: A

Refuse and report the request to defense counsel: Correct. Corruptly persuading a witness to avoid testifying or ignore a subpoena is witness tampering under 18 U.S.C. §1512(b) and similar state laws; defense counsel must know of the request.

Offer the trip without mentioning the trial date: Timing the trip to the trial to keep her away is corrupt persuasion even if the reason goes unstated.

Pass along the message but make no promise of a trip: Telling a subpoenaed witness she need not appear is itself an attempt to induce her to evade legal process.

Tell the witness only that testifying is her choice: A subpoenaed witness is legally required to appear; telling her otherwise is misleading and obstructive.

Never discourage, pay off or mislead a witness about appearing or testifying; that is tampering and obstruction of justice.

Answer: C

Publish it, since the case closed two years ago: The duty of confidentiality to a client continues after the engagement ends.

Publish it with only the client's name changed: Details of the case can still identify the client and the employee; changing one name does not protect the client's confidences.

Get the client's written consent before publishing: Correct. The case information belongs to the client and remains confidential after the work ends. Using it for marketing requires the client's informed, written consent, and even then the account should avoid unnecessary detail about the employee.

Ask the former employee's permission to publish it instead: The duty of confidentiality is owed to the client; the subject's permission is the wrong consent.

Client information stays confidential after a case closes. Use it in advertising or talks only with the client's written consent.

Answer: A

Notify affected clients and follow breach-notice laws: Correct. Confidentiality includes protecting client data and being honest when it is compromised. Clients need prompt notice to protect themselves and their cases, and state data-breach laws may require notice to affected individuals (check your state’s law); reporting the theft to police is also appropriate.

Wait to see whether any client data is actually misused: Waiting leaves clients unable to protect themselves and may violate breach-notice deadlines.

Restore the files from backup and say nothing: Restoring the files recovers her work but does nothing about the exposure of clients' information.

Report the theft to police and change her passwords: These are sound steps, but they leave clients and affected people uninformed about the exposure of their data.

Protect client information (encrypt devices) and, when it is compromised, notify clients promptly and meet any breach-notice duty. Notice rules vary, so check your state's law.

Answer: A

Call 911 and report the theft and the man's location: Correct. A private investigator has no police powers. The right response is to give police prompt, accurate information. His notes and any video can be handed over later through proper channels.

Follow the neighbor and hold him until police arrive: Detaining a suspect exposes the investigator to assault and false-imprisonment liability and is not the investigator's role.

Stay silent to protect his cover and the client's case: Client confidentiality does not require ignoring a crime. Reporting a theft by a third party does not disclose the client's case.

Confront the neighbor and photograph his face up close: Confrontation creates a safety risk and a liability. A report to police is the priority, and photos can be taken from his current position.

When an investigator witnesses a crime, the priority is to notify law enforcement and document what was seen, not to pursue, detain or confront.