McAfee CCII Practice Exams
Last updated on Oct 21,2026- Exam Code: CCII
- Exam Name: Certified Cyber Intelligence Investigator (CCII)
- Certification Provider: McAfee
- Latest update: Oct 21,2026
Question #61
A legal factor of computer-generated evidence is that it is considered hearsay.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Computer-generated evidence, such aslog files, metadata, and automated reports, is often classified ashearsaybecause it lacks a human declarant. However, exceptions exist under:
Business records exceptionC If logs are kept in the regular course of business.
Public records exceptionC If data is collected by government agencies.
Forensic investigators usehash verification and timestamp validationto ensure evidence reliability.
Reference: U.S. Federal Rules of Evidence (Rule 803)
McAfee Institute Digital Forensics Guide
Legal Standards for Cyber Evidence Admissibility
A
Explanation:
Computer-generated evidence, such aslog files, metadata, and automated reports, is often classified ashearsaybecause it lacks a human declarant. However, exceptions exist under:
Business records exceptionC If logs are kept in the regular course of business.
Public records exceptionC If data is collected by government agencies.
Forensic investigators usehash verification and timestamp validationto ensure evidence reliability.
Reference: U.S. Federal Rules of Evidence (Rule 803)
McAfee Institute Digital Forensics Guide
Legal Standards for Cyber Evidence Admissibility
Question #62
A worm is almost similar to a virus, except that it doesn’t need the execution of any executable file to get activated.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Acomputer wormis a type ofself-replicating malwarethat can spread without human intervention.
Unlike viruses, worms:
Do not require a host file or user actionto execute.
Exploit security vulnerabilitiesto spread across networks.
Can cause widespread damageby consuming system resources and spreading rapidly.
Famous worms includeILOVEYOU,Stuxnet, andWannaCry, which caused billions in damages worldwide.
Reference: McAfee Institute CCII Cybersecurity Threat Guide, Black Hat Python.
A
Explanation:
Acomputer wormis a type ofself-replicating malwarethat can spread without human intervention.
Unlike viruses, worms:
Do not require a host file or user actionto execute.
Exploit security vulnerabilitiesto spread across networks.
Can cause widespread damageby consuming system resources and spreading rapidly.
Famous worms includeILOVEYOU,Stuxnet, andWannaCry, which caused billions in damages worldwide.
Reference: McAfee Institute CCII Cybersecurity Threat Guide, Black Hat Python.
Question #63
Direct evidence is written testimony, where the knowledge is obtained from any of the witness’s five senses.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Direct evidence is first-hand knowledge obtained through seeing, hearing, touching, smelling, or tasting. In cyber investigations, this includes:
Eyewitness testimony from forensic investigators.
Real-time logs or digital recordings of cyber activity.
Live surveillance data.
Direct evidence carries strong legal weight in digital forensic cases.
Reference: McAfee Institute Digital Testimony Guidelines
DOJ Cyber Evidence Presentation Manual
Federal Rules of Criminal Procedure
A
Explanation:
Direct evidence is first-hand knowledge obtained through seeing, hearing, touching, smelling, or tasting. In cyber investigations, this includes:
Eyewitness testimony from forensic investigators.
Real-time logs or digital recordings of cyber activity.
Live surveillance data.
Direct evidence carries strong legal weight in digital forensic cases.
Reference: McAfee Institute Digital Testimony Guidelines
DOJ Cyber Evidence Presentation Manual
Federal Rules of Criminal Procedure
Question #64
Investigatorsdo notneed to capture the date and time an IP address was logged, because it will not bring any value to an investigation.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Capturing the date, time, and IP address logs is crucialfor cyber investigations and digital forensics.
These details help:
Establish a timelineof suspect activity.
Identify locations and devicesused in cybercrimes.
Provide evidence for subpoenas and legal cases(e.g., tracking a suspect’s online activity).
Without accurate timestamps, investigatorscannot validatewhen a suspect accessed a system or engaged in illegal activities.
Reference: McAfee Institute CCII Digital Evidence Guide, Cyber Forensics Up and Running.
B
Explanation:
Capturing the date, time, and IP address logs is crucialfor cyber investigations and digital forensics.
These details help:
Establish a timelineof suspect activity.
Identify locations and devicesused in cybercrimes.
Provide evidence for subpoenas and legal cases(e.g., tracking a suspect’s online activity).
Without accurate timestamps, investigatorscannot validatewhen a suspect accessed a system or engaged in illegal activities.
Reference: McAfee Institute CCII Digital Evidence Guide, Cyber Forensics Up and Running.
Question #65
What is the most commonly used email domain for fraud?
- A . Yahoo.com
- B . Gmail.com
- C . Outlook.com
- D . Hotmail.com
Correct Answer: A
A
Explanation:
Fraudsters frequently useYahoo.comdue to itslax verification requirements and historical use in cybercrime rings.
Reference: McAfee Institute CCII Cyber Intelligence Guide, Cyber Forensics Up and Running.
A
Explanation:
Fraudsters frequently useYahoo.comdue to itslax verification requirements and historical use in cybercrime rings.
Reference: McAfee Institute CCII Cyber Intelligence Guide, Cyber Forensics Up and Running.
Question #66
It’s important to check the Terms of Service (TOS) on each site as they might offer back doors.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Terms of Service (TOS)can:
Grant companies extensive permissionsover user data.
Allow AI algorithms to scan messages, photos, and videos.
Enable government surveillance or backdoor access.Platforms like Facebook and Google have faced scrutiny for theiruser data sharing practiceswith government agencies.
Reference: Privacy in Practice, Cyber Crime Investigator’s Field Guide.
A
Explanation:
Terms of Service (TOS)can:
Grant companies extensive permissionsover user data.
Allow AI algorithms to scan messages, photos, and videos.
Enable government surveillance or backdoor access.Platforms like Facebook and Google have faced scrutiny for theiruser data sharing practiceswith government agencies.
Reference: Privacy in Practice, Cyber Crime Investigator’s Field Guide.
Question #67
A virus is a program that attaches itself to a program or file. This allows it to spread across networks and cause damage to software and hardware.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Acomputer virusismalicious software (malware)that replicates itself by attaching to
legitimateprograms or files. Once activated, viruses can:
Corrupt or delete files.
Spread across networks, infecting multiple systems.
Cause performance issuesor even render a system inoperable.
Unlikeworms, which can spread independently, viruses requirehuman action(e.g., opening an infected file or running an executable).
Reference: McAfee Institute CCII Cyber Threat Guide, Cybercrime Encyclopedia.
A
Explanation:
Acomputer virusismalicious software (malware)that replicates itself by attaching to
legitimateprograms or files. Once activated, viruses can:
Corrupt or delete files.
Spread across networks, infecting multiple systems.
Cause performance issuesor even render a system inoperable.
Unlikeworms, which can spread independently, viruses requirehuman action(e.g., opening an infected file or running an executable).
Reference: McAfee Institute CCII Cyber Threat Guide, Cybercrime Encyclopedia.
Question #68
What is an escrow service?
- A . A company that holds your money in good faith while an item is shipped
- B . A place to find a date
- C . A local bar
Correct Answer: A
A
Explanation:
An escrow service acts as a trusted third party that hold spaymentsuntil a transaction is successfully completed. This prevents fraudulent sellers from taking money without delivering goods. Escrow services are widely used in real estate, online transactions, and high-value trades.
Reference: McAfee Institute CCII Cyber Fraud Guide, OSINT Techniques.
A
Explanation:
An escrow service acts as a trusted third party that hold spaymentsuntil a transaction is successfully completed. This prevents fraudulent sellers from taking money without delivering goods. Escrow services are widely used in real estate, online transactions, and high-value trades.
Reference: McAfee Institute CCII Cyber Fraud Guide, OSINT Techniques.
Question #69
Please select the most popular types of hackers:
- A . White Hat
- B . Grey Hat
- C . Black Hat
- D . All of the above
Correct Answer: D
D
Explanation:
Hackers are classified based on theirintentions and legal boundaries:
White Hat HackersC Ethical hackers who test security vulnerabilities legally.
Grey Hat HackersC Operate between ethical and illegal hacking, sometimes violating lawsfor good
reasons.
Black Hat HackersC Malicious hackers who break into systems for profit, theft, or harm.
Each type plays a role in cybersecurity, either inprotectingorexploitingdigital infrastructures.
Reference: McAfee Institute CCII Cyber Threat Guide, Ethical Hacking Handbook.
D
Explanation:
Hackers are classified based on theirintentions and legal boundaries:
White Hat HackersC Ethical hackers who test security vulnerabilities legally.
Grey Hat HackersC Operate between ethical and illegal hacking, sometimes violating lawsfor good
reasons.
Black Hat HackersC Malicious hackers who break into systems for profit, theft, or harm.
Each type plays a role in cybersecurity, either inprotectingorexploitingdigital infrastructures.
Reference: McAfee Institute CCII Cyber Threat Guide, Ethical Hacking Handbook.
Question #70
Hearsay is second-hand evidence―evidence that is not gathered from the personal knowledge of the witness but from another source.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Hearsay evidencerefers to statements made outside of court that arerelayed by a witness, rather
than directly observed. Most hearsay isinadmissible in court, but exceptions exist forbusiness records, public records, and forensic reportsthat have been properly authenticated.
Reference: U.S. Federal Rules of Evidence (Rule 802)
Legal Standards in Cyber Investigations
McAfee Institute Evidence Handling Guide
A
Explanation:
Hearsay evidencerefers to statements made outside of court that arerelayed by a witness, rather
than directly observed. Most hearsay isinadmissible in court, but exceptions exist forbusiness records, public records, and forensic reportsthat have been properly authenticated.
Reference: U.S. Federal Rules of Evidence (Rule 802)
Legal Standards in Cyber Investigations
McAfee Institute Evidence Handling Guide