McAfee CCII Practice Exams
Last updated on Oct 22,2026- Exam Code: CCII
- Exam Name: Certified Cyber Intelligence Investigator (CCII)
- Certification Provider: McAfee
- Latest update: Oct 22,2026
Question #81
GSM stands for Global System for Mobile Communications.
- A . True
- B . False
Correct Answer: A
A
Explanation:
GSM (Global System for Mobile Communications) is awidely used mobile network standardthat enablesglobal roaming, encryption, and secure communications. Cyber investigatorsanalyze GSM networks inSIM card forensics and call tracking cases.
Reference: McAfee Institute CCII Mobile Forensics, Cybercrime Encyclopedia.
A
Explanation:
GSM (Global System for Mobile Communications) is awidely used mobile network standardthat enablesglobal roaming, encryption, and secure communications. Cyber investigatorsanalyze GSM networks inSIM card forensics and call tracking cases.
Reference: McAfee Institute CCII Mobile Forensics, Cybercrime Encyclopedia.
Question #82
Facebook does not release user information to law enforcement.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Social media companiescomply with legal requestsfromlaw enforcement and intelligence agencies.
Facebook, for example:
Provides user metadata and private messageswith a warrant.
Uses AI to monitor posts for criminal activity.
Shares data with government agencies in cases of terrorism, child exploitation, and fraud.
Reference: Privacy in Practice, OSINT Handbook.
B
Explanation:
Social media companiescomply with legal requestsfromlaw enforcement and intelligence agencies.
Facebook, for example:
Provides user metadata and private messageswith a warrant.
Uses AI to monitor posts for criminal activity.
Shares data with government agencies in cases of terrorism, child exploitation, and fraud.
Reference: Privacy in Practice, OSINT Handbook.
Question #83
The CCII program and manual should be viewed as a living document and learning environment.
- A . True
- B . False
Correct Answer: A
A
Explanation:
The Certified Cyber Intelligence Investigator (CCII)program manual is designed to be a living document, meaning it is continuously updated to accommodate new threats, methodologies, and best practices in cyber intelligence investigations. This approach ensures that professionals remain equipped with the latest knowledge and strategies to combat evolving cyber threats.
A
Explanation:
The Certified Cyber Intelligence Investigator (CCII)program manual is designed to be a living document, meaning it is continuously updated to accommodate new threats, methodologies, and best practices in cyber intelligence investigations. This approach ensures that professionals remain equipped with the latest knowledge and strategies to combat evolving cyber threats.
Question #84
What value does a friend’s list bring to your investigation?
- A . Tells you what kind of people they date
- B . It might present possible accomplices or additional persons of interest
- C . They bring no value
Correct Answer: B
B
Explanation:
A suspect’sfriend listcan helpmap relationships,identify potential conspirators, andconnect different digital identities. OSINT investigators leveragesocial network analysis (SNA)to establish links between individuals.
Reference: McAfee Institute Digital Footprinting
FBI Social Network Analysis Reports
OSINT Graph Analysis Tools
B
Explanation:
A suspect’sfriend listcan helpmap relationships,identify potential conspirators, andconnect different digital identities. OSINT investigators leveragesocial network analysis (SNA)to establish links between individuals.
Reference: McAfee Institute Digital Footprinting
FBI Social Network Analysis Reports
OSINT Graph Analysis Tools
Question #85
Computer crimes can be separated into two categories:
- A . Crimes facilitated by a computer and crimes where a computer or network is the target
- B . Crimes where an animal was involved and crimes not on the internet
Correct Answer: A
A
Explanation:
Cybercrimes are categorized into:
Crimes facilitated by computers(e.g., fraud, phishing, online scams).
Crimes where computers are the target(e.g., hacking, ransomware, data breaches).
Understanding these categories helps investigatorsapply relevant legal frameworksandforensic methodologies.
Reference: McAfee Institute Cybercrime Classification Guide
FBI Cybercrime Division Reports
U.S. Digital Fraud and Cybersecurity Legislation
A
Explanation:
Cybercrimes are categorized into:
Crimes facilitated by computers(e.g., fraud, phishing, online scams).
Crimes where computers are the target(e.g., hacking, ransomware, data breaches).
Understanding these categories helps investigatorsapply relevant legal frameworksandforensic methodologies.
Reference: McAfee Institute Cybercrime Classification Guide
FBI Cybercrime Division Reports
U.S. Digital Fraud and Cybersecurity Legislation
Question #86
One of the most important weapons in a cybercrime investigator’s arsenal is a letter requesting that the ISP preserve the data.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Adata preservation request (DPR)is a legal tool used bylaw enforcementto preventdata deletionbefore a subpoena is issued. ISPs often comply withgovernment investigationsunder statutes like:
Computer Fraud and Abuse Act (CFAA)
Stored Communications Act (SCA)
Patriot Act Cyber Provisions.
Reference: ISP Compliance and Legal Guidelines
U.S. Digital Evidence Retention Laws
McAfee Institute Cyber Intelligence Investigator Training
A
Explanation:
Adata preservation request (DPR)is a legal tool used bylaw enforcementto preventdata deletionbefore a subpoena is issued. ISPs often comply withgovernment investigationsunder statutes like:
Computer Fraud and Abuse Act (CFAA)
Stored Communications Act (SCA)
Patriot Act Cyber Provisions.
Reference: ISP Compliance and Legal Guidelines
U.S. Digital Evidence Retention Laws
McAfee Institute Cyber Intelligence Investigator Training
Question #87
What is the best way to collect evidence from an online forum without alerting suspects?
- A . Taking screenshots and downloading web pages
- B . Posting in the forum to gather information
- C . Using automation tools to scrape all data at once
- D . Contacting the forum administrator immediately
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
Covert evidence collection requires a low-profile approach to prevent alerting suspects.
Screenshots and web downloads preserve evidence without modifying website logs.
Avoid direct engagement (e.g., posting, commenting) to maintain anonymity.
Automation tools may violate Terms of Service and cause detection.
Investigators must use legally accepted methods and ensure the chain of custody for digital evidence.
Reference: McAfee Institute CCII Digital Evidence Guide, OSINT Techniques.
A
Explanation:
Comprehensive and Detailed In-Depth
Covert evidence collection requires a low-profile approach to prevent alerting suspects.
Screenshots and web downloads preserve evidence without modifying website logs.
Avoid direct engagement (e.g., posting, commenting) to maintain anonymity.
Automation tools may violate Terms of Service and cause detection.
Investigators must use legally accepted methods and ensure the chain of custody for digital evidence.
Reference: McAfee Institute CCII Digital Evidence Guide, OSINT Techniques.
Question #88
The United States Secret Service (USSS) is responsible for financial crimes around the United States.
- A . True
- B . False
Correct Answer: A
A
Explanation:
TheUSSS Cyber Fraud Task Force (CFTF)investigatesfinancial cybercrime,credit card fraud, andcounterfeit currency operations. They work closely withbanking institutions, financial regulators, and forensic experts.
Reference: USSS Financial Crime Reports
McAfee Institute Financial Investigations Guide
U.S. Treasury Department Reports
A
Explanation:
TheUSSS Cyber Fraud Task Force (CFTF)investigatesfinancial cybercrime,credit card fraud, andcounterfeit currency operations. They work closely withbanking institutions, financial regulators, and forensic experts.
Reference: USSS Financial Crime Reports
McAfee Institute Financial Investigations Guide
U.S. Treasury Department Reports
Question #89
Often, "information sharing" and "intelligence sharing" are used interchangeably by persons who do not understand the subtleties―yet importance―of the distinction.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Information sharing refers to the exchange of raw data among agencies or organizations. Intelligence sharing, on the other hand, means processed and analyzed data that provides actionable insights. In cyber intelligence investigations, intelligence sharing ensures that classified or sensitive data is properly handled and disseminated to relevant stakeholders.
Reference: McAfee Institute CCII Official Guide, National Cybersecurity Workforce Framework.
A
Explanation:
Information sharing refers to the exchange of raw data among agencies or organizations. Intelligence sharing, on the other hand, means processed and analyzed data that provides actionable insights. In cyber intelligence investigations, intelligence sharing ensures that classified or sensitive data is properly handled and disseminated to relevant stakeholders.
Reference: McAfee Institute CCII Official Guide, National Cybersecurity Workforce Framework.
Question #90
The Best Evidence Rule was established to deter any alteration of evidence, either intentionally or unintentionally.
- A . True
- B . False
Correct Answer: A
A
Explanation:
TheBest Evidence Rulemandates thatoriginal digital evidenceor authenticated copies must be presented in court.Forensic imaging toolsare used to ensure evidence integrity, preventingdata tampering or manipulation.
Reference: McAfee Institute Digital Evidence Handbook
Federal Rules of Evidence in Cyber Investigations
FBI Computer Forensics Guidelines
A
Explanation:
TheBest Evidence Rulemandates thatoriginal digital evidenceor authenticated copies must be presented in court.Forensic imaging toolsare used to ensure evidence integrity, preventingdata tampering or manipulation.
Reference: McAfee Institute Digital Evidence Handbook
Federal Rules of Evidence in Cyber Investigations
FBI Computer Forensics Guidelines