McAfee CCII Practice Exams
Last updated on Oct 21,2026- Exam Code: CCII
- Exam Name: Certified Cyber Intelligence Investigator (CCII)
- Certification Provider: McAfee
- Latest update: Oct 21,2026
Question #41
Four types of computer-generated evidence are:
Visual output on the monitor
Printed evidence on a printer
Printed evidence on a plotter
Film recorder (to include optical drive and media).
- A . True
- B . False
Correct Answer: A
A
Explanation:
Computer-generated evidence includes variousforms of digital output, such as:
Monitor displaysC Screenshots, logs, and forensic captures.
Printer outputC Printed emails, reports, or logs.
Plotter-based printsC Engineering or architectural renderings used in investigations.
Film recorders and optical mediaC CDs, DVDs, and other storage media used for evidence recording.
Each type of evidence must becollected and preserved under forensic standards.
Reference: McAfee Institute Cyber Evidence Collection Guide
U.S. DOJ Digital Investigation Manual
Federal Rules on Computer Evidence Handling
A
Explanation:
Computer-generated evidence includes variousforms of digital output, such as:
Monitor displaysC Screenshots, logs, and forensic captures.
Printer outputC Printed emails, reports, or logs.
Plotter-based printsC Engineering or architectural renderings used in investigations.
Film recorders and optical mediaC CDs, DVDs, and other storage media used for evidence recording.
Each type of evidence must becollected and preserved under forensic standards.
Reference: McAfee Institute Cyber Evidence Collection Guide
U.S. DOJ Digital Investigation Manual
Federal Rules on Computer Evidence Handling
Question #42
You can often pull metadata from images on social media sites.
- A . True
- B . False
Correct Answer: A
A
Explanation:
EXIF metadata embedded inimagescan revealtimestamps, GPS coordinates, and device information.
Tools likeExifTool, FOCA, and OSINT Combine Metadata Extractorassist in analyzing this data.
Reference: McAfee Institute Image Forensics Guide
Federal Image Metadata Examination Manual
OSINT Advanced Digital Tracing
A
Explanation:
EXIF metadata embedded inimagescan revealtimestamps, GPS coordinates, and device information.
Tools likeExifTool, FOCA, and OSINT Combine Metadata Extractorassist in analyzing this data.
Reference: McAfee Institute Image Forensics Guide
Federal Image Metadata Examination Manual
OSINT Advanced Digital Tracing
Question #43
Is accessing someone’s social network against the law?
- A . Yes
- B . No
Correct Answer: A
A
Explanation:
Unauthorized access to a person’s social media accountswithout consentorby circumventing security controlsis illegal under laws such as theComputer Fraud and Abuse Act (CFAA)andGDPR. OSINT techniques must operate withinlegal and ethicalconstraints.
Reference: McAfee Institute Cyber Investigations Guide
U.S. Computer Fraud and Abuse Act
EU GDPR Data Access Regulations
A
Explanation:
Unauthorized access to a person’s social media accountswithout consentorby circumventing security controlsis illegal under laws such as theComputer Fraud and Abuse Act (CFAA)andGDPR. OSINT techniques must operate withinlegal and ethicalconstraints.
Reference: McAfee Institute Cyber Investigations Guide
U.S. Computer Fraud and Abuse Act
EU GDPR Data Access Regulations
Question #44
What technique can be used to track cryptocurrency transactions in cybercrime investigations?
- A . Blockchain analysis
- B . Reverse IP lookup
- C . Dark web forums
- D . Phishing attacks
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
Blockchain analysis helps track cryptocurrency transactions by:
Following transaction history using blockchain explorers (e.g., Bitcoin, Ethereum).
Identifying wallets and linking them to known entities.
Detecting laundering patterns used in illicit activities (e.g., mixing services).
While dark web forums and phishing are methods used to obtain private keys, blockchain analysis is a forensically sound technique used by law enforcement.
Reference: McAfee Institute CCII Cryptocurrency Investigations, Cybercrime Encyclopedia.
A
Explanation:
Comprehensive and Detailed In-Depth
Blockchain analysis helps track cryptocurrency transactions by:
Following transaction history using blockchain explorers (e.g., Bitcoin, Ethereum).
Identifying wallets and linking them to known entities.
Detecting laundering patterns used in illicit activities (e.g., mixing services).
While dark web forums and phishing are methods used to obtain private keys, blockchain analysis is a forensically sound technique used by law enforcement.
Reference: McAfee Institute CCII Cryptocurrency Investigations, Cybercrime Encyclopedia.
Question #45
What is the number one type of online fraud?
- A . Identity Theft
- B . Non-Delivery of Goods
- C . Credit Card Fraud
- D . Auction Fraud
Correct Answer: A
A
Explanation:
Identity theftis themost common type of online fraud, affecting millions of people worldwide each year. Cybercriminals stealpersonal and financial informationto:
Openfraudulent bank accounts.
Makeunauthorized transactionsusing stolen credit card details.
Conductloan fraudor apply for government benefits.
Common methods used for identity theft include:
Phishing attacks (fraudulent emails and fake websites).
Data breaches (hacking into databases to steal personal records).
Social engineering (manipulating people into revealing sensitive data).
Reference: McAfee Institute CCII Cyber Fraud Investigations, Cybercrime Encyclopedia.
A
Explanation:
Identity theftis themost common type of online fraud, affecting millions of people worldwide each year. Cybercriminals stealpersonal and financial informationto:
Openfraudulent bank accounts.
Makeunauthorized transactionsusing stolen credit card details.
Conductloan fraudor apply for government benefits.
Common methods used for identity theft include:
Phishing attacks (fraudulent emails and fake websites).
Data breaches (hacking into databases to steal personal records).
Social engineering (manipulating people into revealing sensitive data).
Reference: McAfee Institute CCII Cyber Fraud Investigations, Cybercrime Encyclopedia.
Question #46
Please select the steps in the evidence life cycle:
- A . Collection and identification
- B . Storage, preservation, and transportation
- C . Presentation in court
- D . Returned to the victim (i.e., the owner)
- E . All of the above
Correct Answer: E
E
Explanation:
The evidence life cyclein cyber investigations consists of multiple steps:
Collection and identificationC Gathering digital evidence while maintaining integrity.
Storage, preservation, and transportationC Ensuring secure storage to prevent tampering.
Presentation in courtC Providing evidence in a legally admissible manner.
Returned to the victimC In cases where applicable, digital devices or data are returned. Following these steps ensureschain of custody is maintainedandevidence is legally sound.
Reference: McAfee Institute Digital Evidence Handbook
DOJ Chain of Custody Guidelines
Federal Digital Investigation Procedures
E
Explanation:
The evidence life cyclein cyber investigations consists of multiple steps:
Collection and identificationC Gathering digital evidence while maintaining integrity.
Storage, preservation, and transportationC Ensuring secure storage to prevent tampering.
Presentation in courtC Providing evidence in a legally admissible manner.
Returned to the victimC In cases where applicable, digital devices or data are returned. Following these steps ensureschain of custody is maintainedandevidence is legally sound.
Reference: McAfee Institute Digital Evidence Handbook
DOJ Chain of Custody Guidelines
Federal Digital Investigation Procedures
Question #47
Regardless of the type of intelligence, the single function that permeates all activities is the Intelligence Process (also known as the Intelligence Cycle).
- A . True
- B . False
Correct Answer: A
A
Explanation:
The Intelligence Process (Intelligence Cycle) consists of five key stages:
Planning & Direction
Collection
Processing & Exploitation
Analysis & Production
Dissemination & Feedback
This cycle ensures intelligence is accurate, timely, and actionable.
Reference: McAfee Institute CCII Course, Cyber Crime Investigator’s Field Guide.
A
Explanation:
The Intelligence Process (Intelligence Cycle) consists of five key stages:
Planning & Direction
Collection
Processing & Exploitation
Analysis & Production
Dissemination & Feedback
This cycle ensures intelligence is accurate, timely, and actionable.
Reference: McAfee Institute CCII Course, Cyber Crime Investigator’s Field Guide.
Question #48
NSI embodies both policy intelligence and central intelligence.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Policy intelligence refers to intelligence used for strategic decision-making at the government level, while central intelligence involves intelligence collected, processed, and analyzed by agencies such as the CIA, NSA, and FBI. Both aspects are integral to NSI.
Reference: McAfee Institute CCII Official Training, National Security Strategy Reports.
A
Explanation:
Policy intelligence refers to intelligence used for strategic decision-making at the government level, while central intelligence involves intelligence collected, processed, and analyzed by agencies such as the CIA, NSA, and FBI. Both aspects are integral to NSI.
Reference: McAfee Institute CCII Official Training, National Security Strategy Reports.
Question #49
What is the information often contained in a photographic image?
- A . Meta Information
- B . Photo Data
Correct Answer: A
A
Explanation:
Metadata (EXIF Data)is embedded in digital images and provides valuable details such as:
Date and time of the photo.
Camera model and settings.
GPS coordinates of where the photo was taken.
This information is used inOSINT investigationsto track locations andverify the authenticity of images. However, criminals mayremove metadata to hide their tracks.
Reference: McAfee Institute CCII OSINT Techniques, Cyber Crime Investigator’s Field Guide.
A
Explanation:
Metadata (EXIF Data)is embedded in digital images and provides valuable details such as:
Date and time of the photo.
Camera model and settings.
GPS coordinates of where the photo was taken.
This information is used inOSINT investigationsto track locations andverify the authenticity of images. However, criminals mayremove metadata to hide their tracks.
Reference: McAfee Institute CCII OSINT Techniques, Cyber Crime Investigator’s Field Guide.
Question #50
Homeland Security is prosecuting international cases of human trafficking.
- A . True
- B . False
Correct Answer: A
A
Explanation:
The Department of Homeland Security (DHS)plays a critical role in prosecutinghuman trafficking
networksvia:
Cyber investigations of trafficking rings
Intercepting digital communication between traffickers
Tracking cryptocurrency transactions linked to exploitation
DHS collaborates withInterpol, Europol, and regional cybercrime units.
Reference: DHS Human Trafficking Prevention Reports
Interpol Cyber Trafficking Case Studies
McAfee Institute Cyber Intelligence Guide
A
Explanation:
The Department of Homeland Security (DHS)plays a critical role in prosecutinghuman trafficking
networksvia:
Cyber investigations of trafficking rings
Intercepting digital communication between traffickers
Tracking cryptocurrency transactions linked to exploitation
DHS collaborates withInterpol, Europol, and regional cybercrime units.
Reference: DHS Human Trafficking Prevention Reports
Interpol Cyber Trafficking Case Studies
McAfee Institute Cyber Intelligence Guide