McAfee CCII Practice Exams
Last updated on Oct 21,2026- Exam Code: CCII
- Exam Name: Certified Cyber Intelligence Investigator (CCII)
- Certification Provider: McAfee
- Latest update: Oct 21,2026
Question #1
You do not need a subpoena to request user information from Facebook.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Facebookrequires legal documentationsuch as:
Subpoenas for user metadata(IP addresses, email, basic profile info).
Search warrants for private messages, photos, and posts.
Emergency disclosure requestsfor imminent threats (e.g., terrorism).
Reference: McAfee Institute CCII Legal Guide, Cyber Crime Investigator’s Field Guide.
B
Explanation:
Facebookrequires legal documentationsuch as:
Subpoenas for user metadata(IP addresses, email, basic profile info).
Search warrants for private messages, photos, and posts.
Emergency disclosure requestsfor imminent threats (e.g., terrorism).
Reference: McAfee Institute CCII Legal Guide, Cyber Crime Investigator’s Field Guide.
Question #2
Federal law enforcement can only gather proprietary information concerning an incident in the following ways:
- A . Request for voluntary disclosure of information
- B . Court order
- C . Federal grand jury subpoena
- D . Search warrant
- E . All of the above
Correct Answer: E
E
Explanation:
Federal law enforcement agencies must obtainlegal authorizationto access proprietary information.
The methods include:
Voluntary disclosureC When a company voluntarily shares data with law enforcement.
Court orderC Issued by a judge to access specific records.
Grand jury subpoenaC Used to compel testimony or evidence.
Search warrantC Required for seizing electronic evidence.
Unauthorized accessviolates privacy laws, including theFourth Amendmentin the U.S..
Reference: U.S. Patriot Act Cybercrime Provisions
Federal Digital Evidence Collection Guidelines
McAfee Institute Cyber Investigation Training
E
Explanation:
Federal law enforcement agencies must obtainlegal authorizationto access proprietary information.
The methods include:
Voluntary disclosureC When a company voluntarily shares data with law enforcement.
Court orderC Issued by a judge to access specific records.
Grand jury subpoenaC Used to compel testimony or evidence.
Search warrantC Required for seizing electronic evidence.
Unauthorized accessviolates privacy laws, including theFourth Amendmentin the U.S..
Reference: U.S. Patriot Act Cybercrime Provisions
Federal Digital Evidence Collection Guidelines
McAfee Institute Cyber Investigation Training
Question #3
Once evidence is seized, the next step is to provide for its accountability and protection.
- A . True
- B . False
Correct Answer: A
A
Explanation:
After evidence is seized, investigators must follow achain of custodyprocess, ensuring:
Proper logging and documentationof evidence.
Secure storageto prevent tampering.
Access control measuresto maintain integrity.
Failure to follow proper procedures can result inevidence being deemed inadmissible in court.
Reference: Federal Rules of Evidence Handling
McAfee Institute Chain of Custody Guide
Digital Forensics Best Practices
A
Explanation:
After evidence is seized, investigators must follow achain of custodyprocess, ensuring:
Proper logging and documentationof evidence.
Secure storageto prevent tampering.
Access control measuresto maintain integrity.
Failure to follow proper procedures can result inevidence being deemed inadmissible in court.
Reference: Federal Rules of Evidence Handling
McAfee Institute Chain of Custody Guide
Digital Forensics Best Practices
Question #4
A public IP address is assigned to every computer that connects to the Internet where each IP is unique.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Apublic IP addressisglobally uniqueand assigned to devices connected directly to the Internet. It enablesdirect communication between devices and services across the web. Unlikeprivate IPs, public IPs are exposed and can be tracked incyber investigations.
Reference: McAfee Institute CCII Cyber Investigations Guide, OSINT Handbook.
A
Explanation:
Apublic IP addressisglobally uniqueand assigned to devices connected directly to the Internet. It enablesdirect communication between devices and services across the web. Unlikeprivate IPs, public IPs are exposed and can be tracked incyber investigations.
Reference: McAfee Institute CCII Cyber Investigations Guide, OSINT Handbook.
Question #5
Which of the following are types of Trojans?
- A . Remote Access Trojans
- B . Password Sending Trojans
- C . Keyloggers
- D . Destructive Trojans
- E . Denial of Service (DoS) Attack Trojans
- F . All of the Above
Correct Answer: F
F
Explanation:
Trojans aremalicious programsdisguised as legitimate software to perform unauthorized actions:
Remote Access Trojans (RATs)C Allow attackers to control a victim’s system.
Password Sending TrojansC Steal and send login credentials.
KeyloggersC Record keystrokes for stealing sensitive data.
Destructive TrojansC Damage or delete files.
DoS Attack TrojansC Overload servers with traffic.
Reference: McAfee Institute CCII Cybersecurity Training, Black Hat Python.
F
Explanation:
Trojans aremalicious programsdisguised as legitimate software to perform unauthorized actions:
Remote Access Trojans (RATs)C Allow attackers to control a victim’s system.
Password Sending TrojansC Steal and send login credentials.
KeyloggersC Record keystrokes for stealing sensitive data.
Destructive TrojansC Damage or delete files.
DoS Attack TrojansC Overload servers with traffic.
Reference: McAfee Institute CCII Cybersecurity Training, Black Hat Python.
Question #6
It is NOT important to capture the URLs of a potential suspect’s social media account.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Capturing URLs of a suspect’s social media profile iscriticalin cyber investigations. URLs serve asunique identifiers for accounts, enabling forensic investigators to revisit, verify, and cross-check information. Without them, evidence may be lost due to profile deletions, username changes, or restrictions. Digital forensic guidelines emphasize the importance of preserving URLs for court-admissible evidence.
Reference: McAfee Institute OSINT Handbook
Federal Cyber Investigations Manual
Best Practices in Digital Forensics
B
Explanation:
Capturing URLs of a suspect’s social media profile iscriticalin cyber investigations. URLs serve asunique identifiers for accounts, enabling forensic investigators to revisit, verify, and cross-check information. Without them, evidence may be lost due to profile deletions, username changes, or restrictions. Digital forensic guidelines emphasize the importance of preserving URLs for court-admissible evidence.
Reference: McAfee Institute OSINT Handbook
Federal Cyber Investigations Manual
Best Practices in Digital Forensics
Question #7
A forensic investigator must follow the chain of custody when handling digital evidence.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Chain of custody ensures evidence integrityby:
Documenting every stepin handling and transferring evidence.
Ensuring evidence remains unalteredand admissible in court.
Using forensic hashing methods(MD5, SHA-256) to verify integrity.
Reference: McAfee Institute CCII Digital Evidence Guide, Cyber Forensics Up and Running.
A
Explanation:
Chain of custody ensures evidence integrityby:
Documenting every stepin handling and transferring evidence.
Ensuring evidence remains unalteredand admissible in court.
Using forensic hashing methods(MD5, SHA-256) to verify integrity.
Reference: McAfee Institute CCII Digital Evidence Guide, Cyber Forensics Up and Running.
Question #8
Computers are easily manipulated and easily ‘booby-trapped’ to intentionally destroy data.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Cybercriminalsoften configure malware, scripts, or hardware mechanismsto delete data when unauthorized access is detected. Examples:
Logic bombsthat triggerdata wipesif certain conditions are met.
Ransomwarethat encrypts or deletes files after a set period.
Self-destructing softwarethat erases logs.
Forensic investigators mustuse write-blockers and forensic imaging toolsto prevent triggering such mechanisms.
Reference: McAfee Institute Digital Forensics Guide
Best Practices for Data Preservation in Cyber Investigations Federal Cybersecurity & Incident Response Framework
A
Explanation:
Cybercriminalsoften configure malware, scripts, or hardware mechanismsto delete data when unauthorized access is detected. Examples:
Logic bombsthat triggerdata wipesif certain conditions are met.
Ransomwarethat encrypts or deletes files after a set period.
Self-destructing softwarethat erases logs.
Forensic investigators mustuse write-blockers and forensic imaging toolsto prevent triggering such mechanisms.
Reference: McAfee Institute Digital Forensics Guide
Best Practices for Data Preservation in Cyber Investigations Federal Cybersecurity & Incident Response Framework
Question #9
In general, hearsay evidence is not admissible in court.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Hearsay isgenerally inadmissiblebecause it isunverified and not subject to cross-examination.
However, exceptions apply in cases where:
Records are maintained in the ordinary course of business(e.g., server logs).
Official reportsfrom law enforcement agencies.
Cyber forensics reportsbacked by authentication procedures.
Reference: McAfee Institute Digital Evidence Handbook
U.S. Court Rulings on Hearsay Exceptions
DOJ Cyber Crime Investigation Manual
A
Explanation:
Hearsay isgenerally inadmissiblebecause it isunverified and not subject to cross-examination.
However, exceptions apply in cases where:
Records are maintained in the ordinary course of business(e.g., server logs).
Official reportsfrom law enforcement agencies.
Cyber forensics reportsbacked by authentication procedures.
Reference: McAfee Institute Digital Evidence Handbook
U.S. Court Rulings on Hearsay Exceptions
DOJ Cyber Crime Investigation Manual
Question #10
Planning and resource allocation provides information to decision-makers about the changing nature of threats.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Threat intelligence is constantly evolving, requiring agencies and organizations toadjust their strategies and allocate resources effectively. Planning ensures that:
Financial and human resourcesare directed tohigh-risk areas.
New cybersecurity defensesare developed to counter emerging threats.
Law enforcement operations are proactiverather than reactive.
For example, intelligence agenciesmonitor terrorist networks, cybercrime groups, and organized fraud ringsto adjust their priorities accordingly.
Reference: McAfee Institute CCII Threat Intelligence Guide, Exploring the Real-World Value of OSINT.
A
Explanation:
Threat intelligence is constantly evolving, requiring agencies and organizations toadjust their strategies and allocate resources effectively. Planning ensures that:
Financial and human resourcesare directed tohigh-risk areas.
New cybersecurity defensesare developed to counter emerging threats.
Law enforcement operations are proactiverather than reactive.
For example, intelligence agenciesmonitor terrorist networks, cybercrime groups, and organized fraud ringsto adjust their priorities accordingly.
Reference: McAfee Institute CCII Threat Intelligence Guide, Exploring the Real-World Value of OSINT.