McAfee CCII Practice Exams
Last updated on Oct 22,2026- Exam Code: CCII
- Exam Name: Certified Cyber Intelligence Investigator (CCII)
- Certification Provider: McAfee
- Latest update: Oct 22,2026
Question #91
A trojan is a program pretending to be like useful software, while its actual strategy is to access, steal, or destroy user data and access authorization.
- A . True
- B . False
Correct Answer: A
A
Explanation:
ATrojan horse (Trojan)is atype of malware disguised as legitimate software. Once installed, a Trojan can:
Create backdoors for attackersto access a system.
Steal sensitive datasuch as passwords, banking details, and personal files.
Disable antivirus softwareor delete important system files.
Unlike viruses and worms, Trojans do not replicate themselvesbut rely onsocial engineering techniquesto trick users into installing them.
Reference: McAfee Institute CCII Cyber Threat Intelligence, Cyber Forensics Up and Running.
A
Explanation:
ATrojan horse (Trojan)is atype of malware disguised as legitimate software. Once installed, a Trojan can:
Create backdoors for attackersto access a system.
Steal sensitive datasuch as passwords, banking details, and personal files.
Disable antivirus softwareor delete important system files.
Unlike viruses and worms, Trojans do not replicate themselvesbut rely onsocial engineering techniquesto trick users into installing them.
Reference: McAfee Institute CCII Cyber Threat Intelligence, Cyber Forensics Up and Running.
Question #92
Which of the following is the most effective method for verifying a suspect’s online identity?
- A . Checking multiple social media accounts for consistency
- B . Using a single source for confirmation
- C . Relying on unverified third-party information
- D . Assuming identity based on email address alone
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
Verifying an online identity requires cross-referencing multiple sources to establish consistency in:
Username patterns across different platforms.
Profile photos and metadata analysis.
Publicly available records and connections.
Using a single source or unverified third-party data can lead to false positives, making multiple-source verification a key practice in cyber investigations.
Reference: McAfee Institute CCII OSINT Training, Cyber Crime Investigator’s Field Guide.
A
Explanation:
Comprehensive and Detailed In-Depth
Verifying an online identity requires cross-referencing multiple sources to establish consistency in:
Username patterns across different platforms.
Profile photos and metadata analysis.
Publicly available records and connections.
Using a single source or unverified third-party data can lead to false positives, making multiple-source verification a key practice in cyber investigations.
Reference: McAfee Institute CCII OSINT Training, Cyber Crime Investigator’s Field Guide.
Question #93
Within the framework of the discipline, there are three types of intelligence of concern for the present discussion:
(1) Law enforcement (or criminal) intelligence
(2) Homeland Security―also known as
(3) National Security Intelligence.
- A . True
- B . False
Correct Answer: A
A
Explanation:
The three primary types of intelligence relevant to cyber investigations are:
Law Enforcement IntelligenceC Focuses oncriminal activities, fraud investigations, and cybercrime detection.
Homeland Security IntelligenceC Centers around counterterrorism, cyber warfare, and securing national infrastructure.
National Security IntelligenceC Encompasses strategic intelligence operations that involve state
actors, cyber espionage, and military intelligence.
A
Explanation:
The three primary types of intelligence relevant to cyber investigations are:
Law Enforcement IntelligenceC Focuses oncriminal activities, fraud investigations, and cybercrime detection.
Homeland Security IntelligenceC Centers around counterterrorism, cyber warfare, and securing national infrastructure.
National Security IntelligenceC Encompasses strategic intelligence operations that involve state
actors, cyber espionage, and military intelligence.
Question #94
Computer-generated evidence is never suspect, because of the ease with which it can be altered, usually without a trace.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Computer-generated evidencecan be altered or manipulated, making itsuspect until properly authenticated. Investigators use:
Hashing algorithms (MD5, SHA-256)to verify data integrity. Forensic imaging tools (EnCase, FTK)to create tamper-proof copies. Evidencemust be validated before use in legal proceedings.
Reference: Digital Forensics Integrity Guide
McAfee Institute Cyber Investigation Handbook
Federal Cyber Crime Evidence Standards
B
Explanation:
Computer-generated evidencecan be altered or manipulated, making itsuspect until properly authenticated. Investigators use:
Hashing algorithms (MD5, SHA-256)to verify data integrity. Forensic imaging tools (EnCase, FTK)to create tamper-proof copies. Evidencemust be validated before use in legal proceedings.
Reference: Digital Forensics Integrity Guide
McAfee Institute Cyber Investigation Handbook
Federal Cyber Crime Evidence Standards
Question #95
How do online fraudsters hide their identities?
- A . Fake Profiles
- B . Fake Identities
- C . Using prepaid Credit Cards
- D . Anonymous or Free Email Services
- E . Proxy Servers
- F . All of the Above
Correct Answer: F
F
Explanation:
Fraudsters use multiple techniques to remain anonymous and evade detection, including:
Fake identities and accounts to mask real information
Prepaid credit cards for untraceable transactions
Anonymous email services to avoid linking accounts
Proxy servers and VPNs to hide IP addresses
Reference: McAfee Institute CCII Cyber Intelligence Guide, OSINT Handbook.
F
Explanation:
Fraudsters use multiple techniques to remain anonymous and evade detection, including:
Fake identities and accounts to mask real information
Prepaid credit cards for untraceable transactions
Anonymous email services to avoid linking accounts
Proxy servers and VPNs to hide IP addresses
Reference: McAfee Institute CCII Cyber Intelligence Guide, OSINT Handbook.
Question #96
The intent of this training & certification program is to provide a perspective and guidance for the development and delivery of cyber intelligence training for law enforcement and fraud professionals.
- A . True
- B . False
Correct Answer: A
A
Explanation:
The CCII certification is developed to equip law enforcement, intelligence analysts, and fraud investigators with advanced cyber intelligence techniques. It emphasizes real-world applications, tactical intelligence gathering, and the use of cyber tools for identifying and neutralizing threats.
A
Explanation:
The CCII certification is developed to equip law enforcement, intelligence analysts, and fraud investigators with advanced cyber intelligence techniques. It emphasizes real-world applications, tactical intelligence gathering, and the use of cyber tools for identifying and neutralizing threats.
Question #97
When searching online for a common name, you might want to try:
- A . Switching to Bing to conduct your search as it beats Google
- B . Adding the city to their name
Correct Answer: B
B
Explanation:
Includinggeographic informationin searches helps narrow results, particularly for common names. Tools likePipl, Spokeo, and OSINT Frameworkenhance search precision when combined with location-based filtering.
Reference: McAfee Institute OSINT Framework
Google Advanced Search Techniques
Digital Investigative Methods
B
Explanation:
Includinggeographic informationin searches helps narrow results, particularly for common names. Tools likePipl, Spokeo, and OSINT Frameworkenhance search precision when combined with location-based filtering.
Reference: McAfee Institute OSINT Framework
Google Advanced Search Techniques
Digital Investigative Methods
Question #98
Prevention involves gaining or developing information related to threats of crime or terrorism and using it to apprehend offenders, harden targets, and use strategies that will eliminate or mitigate the threats.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Prevention is acore function of intelligence and law enforcement operations. It involves:
Collecting intelligence on potential threatsbefore they materialize.
Identifying criminal or terrorist activitiesthrough surveillance and OSINT.
Hardened security measuresfor potential targets (e.g., increasing cybersecurity, bordersecurity).
Taking legal actionagainst identified offenders (e.g., arrests, asset seizures).Byusing proactive intelligence gathering, agencies candisrupt crime networks, prevent terrorist attacks, and reduce financial fraud.
Reference: McAfee Institute CCII Threat Prevention Module, Cyber Crime Investigator’s Field Guide.
A
Explanation:
Prevention is acore function of intelligence and law enforcement operations. It involves:
Collecting intelligence on potential threatsbefore they materialize.
Identifying criminal or terrorist activitiesthrough surveillance and OSINT.
Hardened security measuresfor potential targets (e.g., increasing cybersecurity, bordersecurity).
Taking legal actionagainst identified offenders (e.g., arrests, asset seizures).Byusing proactive intelligence gathering, agencies candisrupt crime networks, prevent terrorist attacks, and reduce financial fraud.
Reference: McAfee Institute CCII Threat Prevention Module, Cyber Crime Investigator’s Field Guide.
Question #99
Which of the following is a common OSINT tool used for gathering domain information?
- A . WHOIS Lookup
- B . Virtual Private Networks (VPNs)
- C . Dark web marketplaces
- D . Google Translate
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
WHOIS Lookup provides public registration details about a domain, including:
Owner details (if not protected by privacy services).
Hosting provider and IP addresses.
Historical domain records for tracking ownership changes.
Investigators use WHOIS data for website attribution, fraud detection, and cyber threat intelligence.
Reference: McAfee Institute CCII OSINT Techniques, Exploring the Real-World Value of OSINT.
A
Explanation:
Comprehensive and Detailed In-Depth
WHOIS Lookup provides public registration details about a domain, including:
Owner details (if not protected by privacy services).
Hosting provider and IP addresses.
Historical domain records for tracking ownership changes.
Investigators use WHOIS data for website attribution, fraud detection, and cyber threat intelligence.
Reference: McAfee Institute CCII OSINT Techniques, Exploring the Real-World Value of OSINT.
Question #100
Non-delivery of goods is when a seller doesn’t receive money for a product ordered by a buyer.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Non-delivery fraud occurs when a buyer makes a paymentbutnever receives the product. This is one of the most common online fraud schemes used on classified ad sites, social media marketplaces, and dark web platforms.
Reference: McAfee Institute CCII Fraud Investigations Guide, OSINT Handbook.
B
Explanation:
Non-delivery fraud occurs when a buyer makes a paymentbutnever receives the product. This is one of the most common online fraud schemes used on classified ad sites, social media marketplaces, and dark web platforms.
Reference: McAfee Institute CCII Fraud Investigations Guide, OSINT Handbook.