McAfee CCII Practice Exams
Last updated on Oct 22,2026- Exam Code: CCII
- Exam Name: Certified Cyber Intelligence Investigator (CCII)
- Certification Provider: McAfee
- Latest update: Oct 22,2026
Question #111
"Fruit of the Poisonous Tree" relates to when an illegal search has been conducted to collect evidence in violation of the Fourth Amendment.
- A . True
- B . False
Correct Answer: A
A
Explanation:
The"Fruit of the Poisonous Tree" doctrinestates thatany evidence obtained illegallyis inadmissible in court. If investigatorsviolate constitutional protectionswhen gathering evidence, any subsequent evidence derived from itcannot be used.
Reference: U.S. Supreme Court Rulings on Digital Privacy
McAfee Institute Cyber Investigation Training
Legal Precedents in Digital Evidence Collection
A
Explanation:
The"Fruit of the Poisonous Tree" doctrinestates thatany evidence obtained illegallyis inadmissible in court. If investigatorsviolate constitutional protectionswhen gathering evidence, any subsequent evidence derived from itcannot be used.
Reference: U.S. Supreme Court Rulings on Digital Privacy
McAfee Institute Cyber Investigation Training
Legal Precedents in Digital Evidence Collection
Question #112
Evidence must be collected by law enforcement in accordance with court guidelines governing search and seizure.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Digital evidence must be collected followinglegal search and seizure procedures,
ensuringadmissibility in court. Key legal doctrines include:
The Fourth Amendment (U.S.)C Protects against unlawful searches.
The Stored Communications Act (SCA)C Governs data access from ISPs.
Chain of CustodyC Ensures evidence integrity.
Failure to comply results inexclusion of evidence in court.
Reference: McAfee Institute Evidence Collection Guide
U.S. Federal Rules of Criminal Procedure
Chain of Custody in Digital Investigations
A
Explanation:
Digital evidence must be collected followinglegal search and seizure procedures,
ensuringadmissibility in court. Key legal doctrines include:
The Fourth Amendment (U.S.)C Protects against unlawful searches.
The Stored Communications Act (SCA)C Governs data access from ISPs.
Chain of CustodyC Ensures evidence integrity.
Failure to comply results inexclusion of evidence in court.
Reference: McAfee Institute Evidence Collection Guide
U.S. Federal Rules of Criminal Procedure
Chain of Custody in Digital Investigations
Question #113
Investigators may legally impersonate a false identity online during OSINT investigations.
- A . True
- B . False
Correct Answer: B
B
Explanation:
While some law enforcement agencies may havelegal exemptions, impersonation can violate:
Terms of Service (TOS) agreementson social media platforms.
State and federal laws, such as fraud statutes.
Ethical guidelines, especially for private investigators.
In most cases,OSINT must be conducted using publicly available information, rather than deception or false identities.
Reference: McAfee Institute CCII Ethical OSINT Guide, Privacy in Practice.
B
Explanation:
While some law enforcement agencies may havelegal exemptions, impersonation can violate:
Terms of Service (TOS) agreementson social media platforms.
State and federal laws, such as fraud statutes.
Ethical guidelines, especially for private investigators.
In most cases,OSINT must be conducted using publicly available information, rather than deception or false identities.
Reference: McAfee Institute CCII Ethical OSINT Guide, Privacy in Practice.
Question #114
Before evidence can be presented in court, it must be competent, relevant, and material to the issue and must be presented in compliance with the rules of evidence.
- A . True
- B . False
Correct Answer: A
A
Explanation:
For digital evidence to beadmissible in court, it must meet three key criteria:
CompetenceC Evidence must be authentic and legally obtained.
RelevanceC Evidence must relate to the case.
MaterialityC Evidence must have a direct impact on proving an element of the crime.
Failure to meet these criteria may result inevidence exclusion.
Reference: McAfee Institute Digital Evidence Standards
DOJ Federal Rules of Evidence
Cyber Investigations Legal Framework
A
Explanation:
For digital evidence to beadmissible in court, it must meet three key criteria:
CompetenceC Evidence must be authentic and legally obtained.
RelevanceC Evidence must relate to the case.
MaterialityC Evidence must have a direct impact on proving an element of the crime.
Failure to meet these criteria may result inevidence exclusion.
Reference: McAfee Institute Digital Evidence Standards
DOJ Federal Rules of Evidence
Cyber Investigations Legal Framework
Question #115
CDMA stands for:
- A . Code Division Major Access
- B . Code Division Multiple Access
- C . Code Division Municipal Access
- D . Code Division Mobile Access
Correct Answer: B
B
Explanation:
CDMA (Code Division Multiple Access) is a wireless communication technology used in mobile networks. It allows multiple signals to occupy the same transmission channel, making communication more efficient and reducing interference. CDMA is widely used in cellular and satellite networks.
Reference: McAfee Institute CCII Manual, Cybersecurity Best Practices.
B
Explanation:
CDMA (Code Division Multiple Access) is a wireless communication technology used in mobile networks. It allows multiple signals to occupy the same transmission channel, making communication more efficient and reducing interference. CDMA is widely used in cellular and satellite networks.
Reference: McAfee Institute CCII Manual, Cybersecurity Best Practices.
Question #116
Every state has the same laws and procedures that pertain to the investigation and prosecution of computer crimes.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Cybercrime lawsvary by statein the U.S. and internationally. Different jurisdictions havedifferent statutes, regulations, and prosecutorial approaches. For example:
Californiahas theCalifornia Consumer Privacy Act (CCPA).
New Yorkhasspecific cybersecurity regulationsfor financial institutions.
European nationshaveGDPR, whilethe U.S. has fragmented federal and state laws. Investigators must beaware of regional cyber lawsto ensure compliance.
Reference: McAfee Institute Cyber Law and Investigations Guide
U.S. DOJ Cybercrime Prosecution Manual
Global Cybersecurity Regulations
B
Explanation:
Cybercrime lawsvary by statein the U.S. and internationally. Different jurisdictions havedifferent statutes, regulations, and prosecutorial approaches. For example:
Californiahas theCalifornia Consumer Privacy Act (CCPA).
New Yorkhasspecific cybersecurity regulationsfor financial institutions.
European nationshaveGDPR, whilethe U.S. has fragmented federal and state laws. Investigators must beaware of regional cyber lawsto ensure compliance.
Reference: McAfee Institute Cyber Law and Investigations Guide
U.S. DOJ Cybercrime Prosecution Manual
Global Cybersecurity Regulations
Question #117
Which of the following is a well-known search engine used for OSINT investigations?
- A . Dogpyle
- B . Dogpile
Correct Answer: B
B
Explanation:
Dogpileis ametasearch enginethat aggregates results frommultiple search engines, such as Google, Bing, and Yahoo. It is widely used inOSINT investigationsbecause it:
Pulls results from multiple sources, reducing bias.
Finds hidden informationthat may not appear in standard searches.
Bypasses some search engine filtering restrictions.
Incorrect spelling (Dogpyle) is a typo and does not refer to a real OSINT tool.
Reference: McAfee Institute CCII OSINT Techniques, OSINT Handbook.
B
Explanation:
Dogpileis ametasearch enginethat aggregates results frommultiple search engines, such as Google, Bing, and Yahoo. It is widely used inOSINT investigationsbecause it:
Pulls results from multiple sources, reducing bias.
Finds hidden informationthat may not appear in standard searches.
Bypasses some search engine filtering restrictions.
Incorrect spelling (Dogpyle) is a typo and does not refer to a real OSINT tool.
Reference: McAfee Institute CCII OSINT Techniques, OSINT Handbook.
Question #118
War dialers are tools used to automatically scan phone numbers in search of unsecured modems and fax machines.
- A . True
- B . False
Correct Answer: A
A
Explanation:
War dialingis a hacking technique used toscan telephone linesfor open modems and fax machines, often forunauthorized access or exploitation. This method has becomeless common due to modern cybersecurity measuresbut remains a historical attack vector.
Reference: McAfee Institute CCII Cyber Threat Guide, Ethical Hacking Manual.
A
Explanation:
War dialingis a hacking technique used toscan telephone linesfor open modems and fax machines, often forunauthorized access or exploitation. This method has becomeless common due to modern cybersecurity measuresbut remains a historical attack vector.
Reference: McAfee Institute CCII Cyber Threat Guide, Ethical Hacking Manual.
Question #119
To ensure that only relevant and reliable evidence is entered into the proceedings, the judicial system has adopted the following concept of admissibility:
- A . Relevancy of evidence
- B . Reliability of evidence
- C . Both of the above
Correct Answer: C
C
Explanation:
Evidence must meet two main criteria:
RelevanceC It must directly relate to the case at hand.
ReliabilityC It must be collected and presented in acredible manner, following forensic best practices.
Judges assessadmissibilitybased on these factors.
Reference: McAfee Institute Digital Evidence Standards
U.S. Federal Rules of Evidence (Rule 401 & 403)
Law Enforcement Cyber Crime Investigation Manual
C
Explanation:
Evidence must meet two main criteria:
RelevanceC It must directly relate to the case at hand.
ReliabilityC It must be collected and presented in acredible manner, following forensic best practices.
Judges assessadmissibilitybased on these factors.
Reference: McAfee Institute Digital Evidence Standards
U.S. Federal Rules of Evidence (Rule 401 & 403)
Law Enforcement Cyber Crime Investigation Manual
Question #120
Tactical intelligence is considered actionable intelligence about imminent or near-term threats that is disseminated to the line functions of law enforcement.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Tactical intelligencefocuses onimmediate threats that require quick action. It is:
Directly shared with field officers, SWAT teams, and emergency responders.
Used in counterterrorism, cybercrime investigations, and rapid deployment operations.
Time-sensitive and specific to particular events or individuals.
Example: If anactive shooterorhacker targeting a critical infrastructureis detected, tactical intelligence is used tomobilize security teams quickly.
Reference: McAfee Institute CCII Tactical Intelligence Guide, National Intelligence Strategy Document.
A
Explanation:
Tactical intelligencefocuses onimmediate threats that require quick action. It is:
Directly shared with field officers, SWAT teams, and emergency responders.
Used in counterterrorism, cybercrime investigations, and rapid deployment operations.
Time-sensitive and specific to particular events or individuals.
Example: If anactive shooterorhacker targeting a critical infrastructureis detected, tactical intelligence is used tomobilize security teams quickly.
Reference: McAfee Institute CCII Tactical Intelligence Guide, National Intelligence Strategy Document.