Free McAfee CCII Practice Exams

McAfee CCII Practice Exams

Last updated on Oct 21,2026
  • Exam Code: CCII
  • Exam Name: Certified Cyber Intelligence Investigator (CCII)
  • Certification Provider: McAfee
  • Latest update: Oct 21,2026
Question #21

The most common types of evidence include:

  • A . Direct
  • B . Documentary
  • C . Demonstrative
  • D . All of the above

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Thethree main types of evidencein cyber investigations are:

Direct EvidenceC Witness testimony, live observations, or real-time recordings. Documentary EvidenceC Written or recorded material such as logs, emails, contracts. Demonstrative EvidenceC Visual aids, reconstructions, or interactive representations of data. Each type plays a critical role inproving digital cases, especially in court proceedings.

Reference: McAfee Institute Cybercrime Investigator’s Guide Digital Forensics Standards and Evidence Classification U.S. Department of Justice Cyber Investigations Handbook
Question #22

In Rosenberg v. Collins, the court held that if the computer output is used in the regular course of business, the evidence shall be admitted.

  • A . True
  • B . False

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

InRosenberg v. Collins, the court established thatcomputer-generated records regularly used in business operationsareadmissibleas evidenceunder the business records exceptionto the hearsay rule. Investigators rely onmetadata, server logs, and financial recordsfor cyber investigations.

Reference: U.S. Court Rulings on Digital Evidence

Federal Rules of Evidence for Cyber Investigations

McAfee Institute Legal Framework for Digital Evidence
Question #23

Thieves, in general, are motivated to steal and sell goods because they can quickly convert them for money.

  • A . True
  • B . False

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

The primarymotivation behind theftis the ability toquickly convert stolen goods into cash. This is seen in:

Pawn shop transactions

Online marketplaces (e.g., eBay, Facebook Marketplace)

Dark web black markets

Selling through fences (middlemen who resell stolen goods)Quick conversion reduces the chance

oflaw enforcement tracking the stolen goodsand makestheft an attractive, high-profit crimefor criminals.

Reference: McAfee Institute CCII Financial Crime Guide, Cyber Crime Investigator’s Field Guide.
Question #24

What is the most trusted type of proxy server?

  • A . High Anonymity Proxy (Elite Proxy)
  • B . Anonymous Proxy Server
  • C . Distorting Proxy Server

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

High Anonymity Proxies (Elite Proxies) provide the highest level of privacy bymasking the user’s IP address completely. They are used incyber investigations, OSINT operations, and privacy-focused communicationsto preventtracking and monitoring.

Reference: McAfee Institute CCII OSINT Techniques, The Hitchhiker’s Guide to Online Anonymity.
Question #25

There are no laws that require an ISP to maintain their data for a length of time.

  • A . True
  • B . False

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Manyjurisdictions require ISPsto store data for aspecific retention period. Examples:

U.S. Electronic Communications Privacy Act (ECPA)

European Data Retention Directive

Local ISP compliance with national cybersecurity laws

Investigatorsrely on these logsfor cybercrimetracking, evidence collection, and threat intelligence.

Reference: Federal ISP Data Retention Guidelines

McAfee Institute Cyber Law Manual

EU General Data Protection Regulation (GDPR)
Question #26

What benefit do fraudsters obtain by manipulating feedback systems?

  • A . The ability to sell in shorter durations of time
  • B . Established trust
  • C . The ability to sell multiple quantities of like items
  • D . The ability to use multiple accounts to carry out fraud schemes
  • E . All of the above

Reveal Solution Hide Solution

Correct Answer: E
E

Explanation:

Fraudsters manipulate feedback systems to create a false sense of trust, enabling them to sell more products quickly and deceive buyers. They use multiple fake accounts, positive feedback loops, and low-value transactionstoinflate their credibility before executing larger fraud schemes. This method is commonly used ine-commerce fraud, dark web marketplaces, and social media scams.

Reference: McAfee Institute CCII Cyber Fraud Guide, Cyber Crime Investigator’s Field Guide.
Question #27

Information may be defined as "pieces of raw, unanalyzed data that identify persons, organizations, evidence, events, or illustrate processes that indicate the incidence of a criminal event or witness or evidence of a criminal event."

  • A . True
  • B . False

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Raw data and observations collected during investigations are classified as information. When properly analyzed, structured, and contextualized, this information transforms into intelligence, which is actionable for investigations and decision-making. Understanding this difference is critical in cyber intelligence investigations, where data mining and OSINT techniques play a crucial role.

Reference: McAfee Institute CCII Official Documentation, OSINT Techniques by Michael Bazzell.
Question #28

State and local law enforcement have held the primary responsibility for investigating and prosecuting organized retail crime.

  • A . True
  • B . False

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

State and local law enforcement agencies play aprimary rolein investigatingorganized retail crime (ORC)due to their jurisdiction overshoplifting rings, return fraud, and theft operations. Federal agencies assist when cases involvemulti-stateorcross-bordercrimes.

Reference: McAfee Institute Financial Crimes Guide

Organized Crime Investigative Framework

FBI & DHS Crime Reports
Question #29

Please indicate the best method for saving electronic records of the search results:

  • A . Screen recording software
  • B . Bookmark
  • C . Save webpage

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Savingentire webpagesensures that:

Metadata, timestamps, and digital artifactsare preserved.

Evidence remains admissiblein court.

Data tampering risks are minimized.

Forensic tools likeHunchly, Webrecorder, and OSINT Captureare commonly used.

Reference: McAfee Institute Digital Investigation Handbook

FBI Digital Evidence Capture Guidelines

Federal Cyber Investigation Procedures
Question #30

What is a privacy policy?

  • A . A policy no one reads
  • B . A policy that helps to establish how your personal information is handled

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Aprivacy policyis alegal documentthat explains how an organizationcollects, processes, stores, and shares personal data. It serves as anagreement between users and companies, ensuringcompliance with privacy regulationssuch as:

GDPR (General Data Protection Regulation)in the European Union.

CCPA (California Consumer Privacy Act)in the U.S.

Other national and industry-specific privacy laws.

The policy mustclearly inform usersabout:

What data is collected(e.g., location, browsing history, email, IP address).

How the data is used(e.g., advertising, analytics, government requests).

Who the data is shared with(e.g., third parties, law enforcement, advertisers).

How users can control their data(e.g., opt-out, data deletion, account deactivation).

Most usersdo not read privacy policies, making it easier for companies toembed complex terms that may compromise privacy.

Reference: McAfee Institute CCII Cyber Intelligence Guide, Privacy in Practice.
Previous Questions Next Questions