McAfee CCII Practice Exams
Last updated on Oct 22,2026- Exam Code: CCII
- Exam Name: Certified Cyber Intelligence Investigator (CCII)
- Certification Provider: McAfee
- Latest update: Oct 22,2026
NSI may be defined as "the collection and analysis of information concerned with the relationship and homeostasis of the United States with foreign powers, organizations, and persons with regard to political and economic factors as well as the maintenance of the United States’ sovereign principles."
- A . True
- B . False
A
Explanation:
National Security Intelligence (NSI) is a category of intelligence focusing on foreign and domestic threats, particularly those that may impact political stability, national economy, or defense strategies. It is critical for counterterrorism operations, diplomatic strategies, and geopolitical risk assessment.
Reference: McAfee Institute CCII Official Guide, U.S. Intelligence Community Reports.
The preservation letter does not legally require the ISP to turn over its records.
- A . True
- B . False
A
Explanation:
Apreservation letteronlyrequires ISPs to retain data, but it doesnot authorize access.
Investigators must obtain:
A court order
A subpoena
A search warrant
This ensurescompliance with privacy lawswhile protecting investigation integrity.
Reference: U.S. Cyber Law & Digital Evidence Guide
ISP Data Handling and Compliance Guidelines
McAfee Institute Cyber Law and Investigation Training
Hostnames are the system names assigned by a computer by the system, user, or owner.
- A . True
- B . False
A
Explanation:
Ahostnameis aunique identifier assigned to a computer on a network.
Used innetwork security and OSINT investigationstotrack users and devices.
Law enforcement can subpoena ISPsto obtainhostname logs and associated IPsin cyber investigations.
Reference: McAfee Institute CCII Cyber Intelligence Guide, OSINT Handbook.
When evidence of a threat is identified, the Intelligence Process must assess where the threat lies on a multivariate continuum of probability.
- A . True
- B . False
A
Explanation:
Threat assessment involves evaluating probability, severity, and impact using statistical models and intelligence analysis techniques. This ensures effective risk mitigation.
Reference: McAfee Institute CCII Training, OSINT Handbook.
What is the general modus operandi for thieves selling & transporting stolen goods?
- A . Many thieves had around 20-30 people and retail outlets where they felt they could "safely" sell stolen goods.
- B . Fences liked to sell goods out of their houses.
- C . Boosters are the best at selling counterfeit goods.
A
Explanation:
Organized retail theft groups operatein networks, usingmultiple people(20-30 members) tosteal and distribute goods. These stolen goods are typically:
Sold through legitimate-looking businessesto avoid detection.
Funneled into black marketsor international criminal enterprises.
Sold online through fake accounts or social media marketplaces.Understanding thismodus operandihelps law enforcementtrack and dismantleorganized retail crime rings.
Reference: McAfee Institute CCII Retail Crime Analysis, Cybercrime Encyclopedia.
Program developers are urged to explore the diverse application of law enforcement intelligence where training voids exist and adopt the same philosophy and curricular issues described within this certification program.
- A . True
- B . False
A
Explanation:
The McAfee Institute’s cyber intelligence training encourages developers to expand intelligence training applications across various disciplines, particularly wheregaps exist in investigative methodologies. The certification program provides a framework adaptable to multiple investigative contexts, including financial fraud, counterterrorism, cybercrime, and organized crime.
What is non-delivery of goods?
- A . When an item is stolen from the customer’s doorstep
- B . When items are ordered with stolen credit cards
- C . When merchandise ordered is not received
C
Explanation:
Non-delivery of goods fraud happens when a fraudster advertises an item, accepts payment, but never delivers it. This scam is frequently seen in online retail fraud, e-commerce platforms, and fake drop shipping schemes.
Reference: McAfee Institute CCII Cyber Fraud Module, Cyber Crime Encyclopedia.
What is Organized Retail Crime (ORC)?
- A . The sale of stolen merchandise online
- B . The stealing of retail merchandise, by multiple perpetrators
- C . The act of stealing merchandise for profit
- D . All of the above
D
Explanation:
Organized Retail Crime (ORC)refers tocoordinated theft ringsthat steal merchandise in bulk and resell iton online platforms, black markets, and dark web marketplaces. These crimescause billions in lossesfor retailers annually.
Reference: McAfee Institute CCII Retail Crime Training, Cybercrime Encyclopedia.
ICE has been taking a heavy stance and prosecuting Organized Retail Crime (ORC).
- A . True
- B . False
A
Explanation:
ICE, through itsHomeland Security Investigations (HSI)unit,targets organized retail crimelinked to:
Stolen goods resale operations
Identity theft rings
Financial fraud networks
ICE collaborates withlocal law enforcementto track and dismantlelarge-scale ORC enterprises.
Reference: Homeland Security ORC Reports
ICE Financial Crimes Unit Investigation Manual
The first broad class is the "application of intelligence," which deals with knowledge related to a specific crime. Intelligence analysis that produces information about new methods and indicators in the uses of improvised explosive devices (IED) by jihadists, for example, is the "application of intelligence."
- A . True
- B . False
A
Explanation:
The application of intelligence refers to the practical use of intelligence data in specific scenarios, such as crime investigation, counterterrorism, or threat assessment. Intelligence analysts use various sources and analytical methodologies to develop insights into criminal activities, including terrorist methods like IED usage. This approach helps law enforcement and intelligence agencies understand, predict, and counter threats effectively.
Reference: McAfee Institute CCII Manual, National Security Intelligence Framework.