McAfee CCII Practice Exams
Last updated on Oct 21,2026- Exam Code: CCII
- Exam Name: Certified Cyber Intelligence Investigator (CCII)
- Certification Provider: McAfee
- Latest update: Oct 21,2026
Question #11
You are simply awesome and 100k forward to this phenomenal training and certification program!
- A . True
- B . False
Correct Answer: B
B
Explanation:
This question does not align with the CCII curriculumor any verified documentation. While the program is regarded as highly beneficial for cyber intelligence professionals, its structure and objectives remain rooted inpractical application, investigative techniques, and law enforcement protocols, not promotional statements.
B
Explanation:
This question does not align with the CCII curriculumor any verified documentation. While the program is regarded as highly beneficial for cyber intelligence professionals, its structure and objectives remain rooted inpractical application, investigative techniques, and law enforcement protocols, not promotional statements.
Question #12
What is a privacy policy?
- A . A policy no one reads
- B . A policy that helps establish how your personal information is handled
Correct Answer: B
B
Explanation:
Aprivacy policyoutlineshow companies collect, store, share, and protect personal information.
UnderGDPR, CCPA, and other privacy laws, organizations must:
Inform userswhat data is collected and why.
Explainhow data is shared or soldto third parties.
Allow users toopt-out or delete their data.
Reference: McAfee Institute CCII Cyber Intelligence Guide, Privacy in Practice.
B
Explanation:
Aprivacy policyoutlineshow companies collect, store, share, and protect personal information.
UnderGDPR, CCPA, and other privacy laws, organizations must:
Inform userswhat data is collected and why.
Explainhow data is shared or soldto third parties.
Allow users toopt-out or delete their data.
Reference: McAfee Institute CCII Cyber Intelligence Guide, Privacy in Practice.
Question #13
What are the top steps that will help you document an incident and assist federal, state, and local law enforcement agencies in their investigation?
- A . Preserve the state of the computer at the time of the incident by making a backup copy of logs
- B . If the incident is in progress, activate auditing software and consider implementing a keystroke monitoring system
- C . Document the losses suffered by your organization as a result of the incident
- D . Contact law enforcement
- E . All of the above
Correct Answer: E
E
Explanation:
Incident documentation iscriticalin cyber investigations. Best practices include:
Data Preservation: Creatingforensic copiesof digital evidence.
Active Monitoring: Usingkeystroke logging and network traffic analysis.
Loss Documentation: Quantifyingfinancial and operational damage.
Legal Reporting: Contactinglaw enforcement and relevant regulatory bodies.
Following these steps ensuresevidence is admissible in court.
Reference: McAfee Institute Cybercrime Reporting Guide
U.S. Department of Justice Digital Forensics Manual
Chain of Custody in Digital Evidence Collection
E
Explanation:
Incident documentation iscriticalin cyber investigations. Best practices include:
Data Preservation: Creatingforensic copiesof digital evidence.
Active Monitoring: Usingkeystroke logging and network traffic analysis.
Loss Documentation: Quantifyingfinancial and operational damage.
Legal Reporting: Contactinglaw enforcement and relevant regulatory bodies.
Following these steps ensuresevidence is admissible in court.
Reference: McAfee Institute Cybercrime Reporting Guide
U.S. Department of Justice Digital Forensics Manual
Chain of Custody in Digital Evidence Collection
Question #14
The chain of evidence shows:
- A . Who obtained the evidence
- B . Who secured the evidence
- C . Who had control or possession of the evidence
- D . All of the above
Correct Answer: D
D
Explanation:
Achain of evidence (chain of custody) documents:
Who initially collected the evidence.
How the evidence was stored and handled.
Who accessed it and for what purpose.
This ensuresaccountability and integrityin cyber investigations.
Reference: McAfee Institute Digital Chain of Custody Training
DOJ Evidence Handling Guidelines
Law Enforcement Cyber Investigation Manual
D
Explanation:
Achain of evidence (chain of custody) documents:
Who initially collected the evidence.
How the evidence was stored and handled.
Who accessed it and for what purpose.
This ensuresaccountability and integrityin cyber investigations.
Reference: McAfee Institute Digital Chain of Custody Training
DOJ Evidence Handling Guidelines
Law Enforcement Cyber Investigation Manual
Question #15
Shoplifters who used drugs and traveled by train often bought tickets.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Addiction-driven shoplifters oftenuse trains or public transportationto move betweenmultiple retail locations, stealing and selling items to fund their drug use.Buying tickets avoids suspicionand allows
them tomove freely without using personal vehicles (which could be traced).
Reference: McAfee Institute CCII Retail Theft Analysis, Cyber Crime Investigator’s Field Guide.
A
Explanation:
Addiction-driven shoplifters oftenuse trains or public transportationto move betweenmultiple retail locations, stealing and selling items to fund their drug use.Buying tickets avoids suspicionand allows
them tomove freely without using personal vehicles (which could be traced).
Reference: McAfee Institute CCII Retail Theft Analysis, Cyber Crime Investigator’s Field Guide.
Question #16
Intelligence is the beginning product of an analytical process that evaluates information collected from diverse sources.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Intelligence is not raw databut aprocessed and analyzed productderived fromvarious information sources. Intelligence analysts:
Gather data from multiple sources (OSINT, HUMINT, SIGINT, etc.).
Analyze patterns and connectionsto detect security threats or criminal activity.
Develop actionable insightsfor law enforcement and national security agencies.
This process ensures that intelligence isaccurate, reliable, and usefulfor decision-making.
Reference: McAfee Institute CCII Intelligence Cycle Guide, Cyber Crime Investigator’s Field Guide.
A
Explanation:
Intelligence is not raw databut aprocessed and analyzed productderived fromvarious information sources. Intelligence analysts:
Gather data from multiple sources (OSINT, HUMINT, SIGINT, etc.).
Analyze patterns and connectionsto detect security threats or criminal activity.
Develop actionable insightsfor law enforcement and national security agencies.
This process ensures that intelligence isaccurate, reliable, and usefulfor decision-making.
Reference: McAfee Institute CCII Intelligence Cycle Guide, Cyber Crime Investigator’s Field Guide.
Question #17
The United States Secret Service was originally created to:
- A . Investigate and prevent the counterfeiting of US currency
- B . Protect the President of the United States
- C . Protect the Vice President of the United States
Correct Answer: A
A
Explanation:
The United States Secret Service (USSS)was originally founded in1865to combat counterfeiting, which was a significant issue post-Civil War. The agency later expanded its role to include:
Financial crimesinvestigations.
Cyber fraud detection and prevention.
Protective services for high-ranking officials (added later).
Today, the USSS plays a key role infinancial cybercrime investigations.
Reference: U.S. Secret Service History and Reports
Financial Crimes Investigation Manual
McAfee Institute Cyber Crime Investigator Training
A
Explanation:
The United States Secret Service (USSS)was originally founded in1865to combat counterfeiting, which was a significant issue post-Civil War. The agency later expanded its role to include:
Financial crimesinvestigations.
Cyber fraud detection and prevention.
Protective services for high-ranking officials (added later).
Today, the USSS plays a key role infinancial cybercrime investigations.
Reference: U.S. Secret Service History and Reports
Financial Crimes Investigation Manual
McAfee Institute Cyber Crime Investigator Training
Question #18
Computer-generated evidence is always suspect because of the ease with which it can be altered, usually without a trace.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Computer-generated evidence must bevalidatedbefore being used in court. Forensic experts employ:
Hashing techniquesC MD5, SHA-256 for data integrity.
Digital signatures and timestampsC Ensuring authenticity.
Audit trails and access logsC Tracking modifications.
Without proper validation,altered evidencecan mislead investigations.
Reference: McAfee Institute Cyber Evidence Authentication Guide
DOJ Cybercrime Evidence Validation Protocols
Federal Digital Forensic Examination Manual
A
Explanation:
Computer-generated evidence must bevalidatedbefore being used in court. Forensic experts employ:
Hashing techniquesC MD5, SHA-256 for data integrity.
Digital signatures and timestampsC Ensuring authenticity.
Audit trails and access logsC Tracking modifications.
Without proper validation,altered evidencecan mislead investigations.
Reference: McAfee Institute Cyber Evidence Authentication Guide
DOJ Cybercrime Evidence Validation Protocols
Federal Digital Forensic Examination Manual
Question #19
How is a privacy policy used in social networks?
- A . To protect members’ information
- B . To set guidelines on how information will be shared
- C . All of the above
Correct Answer: C
C
Explanation:
Social media platforms arelegally requiredto publishprivacy policiesthat explain:
How they protect user informationfrom breaches and unauthorized access.
The guidelines for data sharingwith third parties, advertisers, and governments.
What security measures are in place(e.g., encryption, multi-factor authentication).
Despite privacy policies, many platforms have been criticized forviolating privacy rightsthrough:
Unlawful data collection and sale(e.g., Facebook-Cambridge Analytica scandal).
Failing to notify users about security breaches.
Tracking user activity even after logging out.
Thus, while privacy policiesexist to protect users, they oftenfavor corporate interestsover privacy rights.
Reference: Privacy in Practice, OSINT Techniques by Michael Bazzell.
C
Explanation:
Social media platforms arelegally requiredto publishprivacy policiesthat explain:
How they protect user informationfrom breaches and unauthorized access.
The guidelines for data sharingwith third parties, advertisers, and governments.
What security measures are in place(e.g., encryption, multi-factor authentication).
Despite privacy policies, many platforms have been criticized forviolating privacy rightsthrough:
Unlawful data collection and sale(e.g., Facebook-Cambridge Analytica scandal).
Failing to notify users about security breaches.
Tracking user activity even after logging out.
Thus, while privacy policiesexist to protect users, they oftenfavor corporate interestsover privacy rights.
Reference: Privacy in Practice, OSINT Techniques by Michael Bazzell.
Question #20
Which one of the following methods best reflects how thieves stash their stolen goods?
- A . At McDonald’s in the bathroom
- B . Back alleys were used to stash and to transport stolen goods by thieves on foot
- C . Stolen goods are never dumped or stashed
Correct Answer: B
B
Explanation:
Thieves commonly useback alleys, abandoned buildings, or hidden storage locationsto stash stolen goods temporarily before transport.Reasons include:
Avoiding immediate detectionafter committing theft.
Waiting for an opportunity to move goods to buyerswithout being tracked.
Using intermediaries to pick up and distribute goodsfrom hidden locations.
Reference: McAfee Institute CCII Organized Crime Analysis, Cyber Crime Investigator’s Field Guide.
B
Explanation:
Thieves commonly useback alleys, abandoned buildings, or hidden storage locationsto stash stolen goods temporarily before transport.Reasons include:
Avoiding immediate detectionafter committing theft.
Waiting for an opportunity to move goods to buyerswithout being tracked.
Using intermediaries to pick up and distribute goodsfrom hidden locations.
Reference: McAfee Institute CCII Organized Crime Analysis, Cyber Crime Investigator’s Field Guide.