McAfee CCII Practice Exams
Last updated on Oct 22,2026- Exam Code: CCII
- Exam Name: Certified Cyber Intelligence Investigator (CCII)
- Certification Provider: McAfee
- Latest update: Oct 22,2026
Question #71
Hearsay is second-hand evidence C which means it is not gathered from the personal knowledge of the witness but from other sources.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Hearsay is generallyinadmissible in courtunless it falls under exceptions such as:
Business records exceptionC Automated logs, database records.
Public records exceptionC Law enforcement reports, cybercrime registries.
Excited utterance exceptionC Statements made in reaction to events.
Digital investigators mustauthenticatehearsay evidence before presenting it in court.
Reference: U.S. Federal Rules of Evidence (Rule 802)
McAfee Institute Digital Forensics Guide
Legal Precedents in Cybercrime Investigations
A
Explanation:
Hearsay is generallyinadmissible in courtunless it falls under exceptions such as:
Business records exceptionC Automated logs, database records.
Public records exceptionC Law enforcement reports, cybercrime registries.
Excited utterance exceptionC Statements made in reaction to events.
Digital investigators mustauthenticatehearsay evidence before presenting it in court.
Reference: U.S. Federal Rules of Evidence (Rule 802)
McAfee Institute Digital Forensics Guide
Legal Precedents in Cybercrime Investigations
Question #72
All social media websites have strict privacy settings to protect their users.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Social media platformsprioritize data collection for advertisingrather than user privacy. Many privacy settings are:
Hidden or difficult to configure.
Disabled by defaultto maximize data exposure.
Changed frequently, forcing users to reconfigure privacy settings.
Reference: Privacy in Practice, The Hitchhiker’s Guide to Online Anonymity.
B
Explanation:
Social media platformsprioritize data collection for advertisingrather than user privacy. Many privacy settings are:
Hidden or difficult to configure.
Disabled by defaultto maximize data exposure.
Changed frequently, forcing users to reconfigure privacy settings.
Reference: Privacy in Practice, The Hitchhiker’s Guide to Online Anonymity.
Question #73
The Federal Bureau of Investigation (FBI), United States Secret Service (USSS), Immigration and Customs Enforcement (ICE), and United States Postal Inspector (USPI) are all investigating cyber-related crimes.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Each of these agencies hasspecific cybercrime responsibilities:
FBI: Investigatescyberterrorism, hacking, and fraudcases.
USSS: Focuses onfinancial crimes, identity theft, and cyber fraud.
ICE: Monitorscross-border cybercrimes and human trafficking cases.
USPI: Handlesmail fraud, package tracking, and digital scamsrelated to postal services.
These agenciescollaboratewithprivate sector cybersecurity expertsandinternational law enforcementto combat cyber threats.
Reference: McAfee Institute Cyber Crime Investigator’s Guide
FBI Cybercrime Task Force Manual
US Secret Service Financial Crimes Unit
A
Explanation:
Each of these agencies hasspecific cybercrime responsibilities:
FBI: Investigatescyberterrorism, hacking, and fraudcases.
USSS: Focuses onfinancial crimes, identity theft, and cyber fraud.
ICE: Monitorscross-border cybercrimes and human trafficking cases.
USPI: Handlesmail fraud, package tracking, and digital scamsrelated to postal services.
These agenciescollaboratewithprivate sector cybersecurity expertsandinternational law enforcementto combat cyber threats.
Reference: McAfee Institute Cyber Crime Investigator’s Guide
FBI Cybercrime Task Force Manual
US Secret Service Financial Crimes Unit
Question #74
A UICC does contain volatile and non-volatile memory.
- A . True
- B . False
Correct Answer: A
A
Explanation:
AUniversal Integrated Circuit Card (UICC), commonly found inSIM cards, storesboth volatile (temporary)andnon-volatile (persistent)data, such as contact lists, authentication keys, and network profiles.
Reference: McAfee Institute Cyber Forensics Guide
Mobile Device Forensics Best Practices
Digital Evidence Handbook
A
Explanation:
AUniversal Integrated Circuit Card (UICC), commonly found inSIM cards, storesboth volatile (temporary)andnon-volatile (persistent)data, such as contact lists, authentication keys, and network profiles.
Reference: McAfee Institute Cyber Forensics Guide
Mobile Device Forensics Best Practices
Digital Evidence Handbook
Question #75
What is informal discovery?
- A . Factual research obtained without document requests, interrogatories, subpoenas, or depositions.
- B . Information collected only through legal means.
Correct Answer: A
A
Explanation:
Informal discoveryrefers to gatheringopen-source intelligence (OSINT)or public recordswithout requiring legal proceduressuch as subpoenas or court orders. Examples include:
Searching public databases(e.g., business registrations, real estate records).
Analyzing social media profilesand publicly shared content.
Reviewing publicly available court records and news archives.
Investigators use informal discovery before proceeding toformal legal requests for restricted information.
Reference: McAfee Institute CCII OSINT Training, Exploring the Real-World Value of OSINT.
A
Explanation:
Informal discoveryrefers to gatheringopen-source intelligence (OSINT)or public recordswithout requiring legal proceduressuch as subpoenas or court orders. Examples include:
Searching public databases(e.g., business registrations, real estate records).
Analyzing social media profilesand publicly shared content.
Reviewing publicly available court records and news archives.
Investigators use informal discovery before proceeding toformal legal requests for restricted information.
Reference: McAfee Institute CCII OSINT Training, Exploring the Real-World Value of OSINT.
Question #76
What is the amount of losses retailers lose to Organized Retail Crime (ORC) each year according to the National Retail Federation?
- A . $2-$5 Billion
- B . $1M-$500 Million
Correct Answer: A
A
Explanation:
According to theNational Retail Federation (NRF), retailers lose between$2 billion and $5 billion annuallydue to Organized Retail Crime (ORC). ORC involves:
Coordinated theft ringsthat steal large quantities of merchandise.
Reselling stolen goodsvia online marketplaces, flea markets, and social media.
Use of counterfeit receipts and return fraud schemes.
Retailers report that ORC groups are becomingmore sophisticated, using tactics likegift cardfraud, online scams, and employee collusion. These crimes significantly impact the economy, leading to:
Higher costs for businesses.
Increased product prices for consumers.
Security and law enforcement expensesto combat ORC.
Reference: McAfee Institute CCII Retail Crime Guide, National Retail Federation ORC Report.
A
Explanation:
According to theNational Retail Federation (NRF), retailers lose between$2 billion and $5 billion annuallydue to Organized Retail Crime (ORC). ORC involves:
Coordinated theft ringsthat steal large quantities of merchandise.
Reselling stolen goodsvia online marketplaces, flea markets, and social media.
Use of counterfeit receipts and return fraud schemes.
Retailers report that ORC groups are becomingmore sophisticated, using tactics likegift cardfraud, online scams, and employee collusion. These crimes significantly impact the economy, leading to:
Higher costs for businesses.
Increased product prices for consumers.
Security and law enforcement expensesto combat ORC.
Reference: McAfee Institute CCII Retail Crime Guide, National Retail Federation ORC Report.
Question #77
Those forced to travel and steal did so because they were too well known locally, but they normally returned to their local area in order to sell.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Many thieves and organized retail crime rings operateacross multiple jurisdictionsto avoid law enforcement detection. However, they often return to theirhome territory to sell goods, where they havetrusted contacts, fences, or buyers.
Reference: McAfee Institute CCII Retail Crime Guide, Cybercrime Encyclopedia.
A
Explanation:
Many thieves and organized retail crime rings operateacross multiple jurisdictionsto avoid law enforcement detection. However, they often return to theirhome territory to sell goods, where they havetrusted contacts, fences, or buyers.
Reference: McAfee Institute CCII Retail Crime Guide, Cybercrime Encyclopedia.
Question #78
Fraudsters never manipulate feedback on auction sites.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Fraudsters commonlycreate fake positive reviews, use bot accounts, and manipulate transaction historyto deceive buyers into trusting fraudulent listings.
Reference: McAfee Institute CCII Fraud Investigations, OSINT Handbook.
B
Explanation:
Fraudsters commonlycreate fake positive reviews, use bot accounts, and manipulate transaction historyto deceive buyers into trusting fraudulent listings.
Reference: McAfee Institute CCII Fraud Investigations, OSINT Handbook.
Question #79
Just like a hostname can be changed, a MAC address can also be changed through a process called MAC Spoofing.
- A . True
- B . False
Correct Answer: A
A
Explanation:
MAC spoofingallows attackers tochange their network identity, making tracking harder.Cybercriminals use it to:
Bypass network security measures(e.g., MAC filtering).
Evade law enforcement trackingin cyber investigations.
Appear as another devicein network logs.
Reference: McAfee Institute CCII Cyber Threat Guide, The Hitchhiker’s Guide to Online Anonymity.
A
Explanation:
MAC spoofingallows attackers tochange their network identity, making tracking harder.Cybercriminals use it to:
Bypass network security measures(e.g., MAC filtering).
Evade law enforcement trackingin cyber investigations.
Appear as another devicein network logs.
Reference: McAfee Institute CCII Cyber Threat Guide, The Hitchhiker’s Guide to Online Anonymity.
Question #80
If you have no luck identifying a subject on a social network, try adjusting your regional settings and change your location. Sometimes, the user’s privacy settings are set to only show their profile to users in the same geographical location.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Many social media platformsrestrict visibilitybased on geographic settings. ChangingVPN locationsor utilizingregional search engines(e.g., Yandex for Russia, Baidu for China) increases the chances of discovering hidden profiles.
Reference: McAfee Institute Social Media OSINT Guide
Regional Privacy and Cybersecurity Laws
VPN Usage in Cyber Investigations
A
Explanation:
Many social media platformsrestrict visibilitybased on geographic settings. ChangingVPN locationsor utilizingregional search engines(e.g., Yandex for Russia, Baidu for China) increases the chances of discovering hidden profiles.
Reference: McAfee Institute Social Media OSINT Guide
Regional Privacy and Cybersecurity Laws
VPN Usage in Cyber Investigations