Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
McAfee
McAfee Institute
CCII
Certified Cyber Intelligence Investigator (CCII) Questions and Answers

Pass the McAfee Institute CCII Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam CCII Premium Access

View all detail and faqs for the CCII exam

Go to Exam

810 Students Passed

88% Average Score

94% Same Questions

Viewing page 2 out of 4 pages

Viewing questions 11-20 out of questions

Questions # 11:

Computer-generated evidence is always suspect because of the ease with which it can be altered, usually without a trace.

Options:

True

False

Answer

Explanation

Computer-generated evidence must bevalidatedbefore being used in court. Forensic experts employ:

Hashing techniques– MD5, SHA-256 for data integrity.

Digital signatures and timestamps– Ensuring authenticity.

Audit trails and access logs– Tracking modifications.

Without proper validation,altered evidencecan mislead investigations.

References:

McAfee Institute Cyber Evidence Authentication Guide

DOJ Cybercrime Evidence Validation Protocols

Federal Digital Forensic Examination Manual

Questions # 12:

What is shill bidding?

Options:

Buying an item online

Going out to eat with a friend

Increasing the bid on an item with another account so that you can drive the price up

Answer

Explanation

Shill biddingis anillegal auction practicewhere sellers usefake accounts or associatestoartificially increase the priceof an item. Thismisleads real buyers into overpaying. It is a common type offraud in online auctions like eBayand is a violation ofplatform policies and fraud laws.

References:McAfee Institute CCII Auction Fraud Training, Cybercrime Encyclopedia.

Questions # 13:

What are the top steps that will help you document an incident and assist federal, state, and local law enforcement agencies in their investigation?

Options:

Preserve the state of the computer at the time of the incident by making a backup copy of logs

If the incident is in progress, activate auditing software and consider implementing a keystroke monitoring system

Document the losses suffered by your organization as a result of the incident

Contact law enforcement

All of the above

Answer

Explanation

Incident documentation iscriticalin cyber investigations. Best practices include:

Data Preservation:Creatingforensic copiesof digital evidence.

Active Monitoring:Usingkeystroke logging and network traffic analysis.

Loss Documentation:Quantifyingfinancial and operational damage.

Legal Reporting:Contactinglaw enforcement and relevant regulatory bodies.

Following these steps ensuresevidence is admissible in court.

References:

McAfee Institute Cybercrime Reporting Guide

U.S. Department of Justice Digital Forensics Manual

Chain of Custody in Digital Evidence Collection

Questions # 14:

Tactical intelligence is considered actionable intelligence about imminent or near-term threats that is disseminated to the line functions of law enforcement.

Options:

True

False

Answer

Explanation

Tactical intelligencefocuses onimmediate threats that require quick action. It is:

Directly shared with field officers, SWAT teams, and emergency responders.

Used in counterterrorism, cybercrime investigations, and rapid deployment operations.

Time-sensitive and specific to particular events or individuals.

Example: If anactive shooterorhacker targeting a critical infrastructureis detected, tactical intelligence is used tomobilize security teams quickly.

References:McAfee Institute CCII Tactical Intelligence Guide, National Intelligence Strategy Document.

Questions # 15:

Which one of the following methods best reflects how thieves stash their stolen goods?

Options:

At McDonald's in the bathroom

Back alleys were used to stash and to transport stolen goods by thieves on foot

Stolen goods are never dumped or stashed

Answer

Explanation

Thieves commonly useback alleys, abandoned buildings, or hidden storage locationsto stash stolen goods temporarily before transport.Reasons include:

Avoiding immediate detectionafter committing theft.

Waiting for an opportunity to move goods to buyerswithout being tracked.

Using intermediaries to pick up and distribute goodsfrom hidden locations.

References:McAfee Institute CCII Organized Crime Analysis, Cyber Crime Investigator’s Field Guide.

Questions # 16:

Preservation of physical and digital evidence is mandatory for a successful investigation.

Options:

True

False

Answer

Explanation

Forensic investigations rely on theproper collection, preservation, and documentationofboth physical and digital evidenceto ensure their integrity and admissibility in legal proceedings. Digital evidence, like logs, metadata, and encrypted data, must be properly stored and secured against tampering or loss.Following the chain of custody is crucialto avoid contamination and legal challenges.

Questions # 17:

Regardless of the type of intelligence, the single function that permeates all activities is the Intelligence Process (also known as the Intelligence Cycle).

Options:

True

False

Answer

Explanation

The Intelligence Process (Intelligence Cycle) consists of five key stages:

Planning & Direction

Collection

Processing & Exploitation

Analysis & Production

Dissemination & Feedback

This cycle ensures intelligence is accurate, timely, and actionable.

References: McAfee Institute CCII Course, Cyber Crime Investigator’s Field Guide.

Questions # 18:

Non-delivery of goods is when a seller doesn’t receive money for a product ordered by a buyer.

Options:

True

False

Answer

Explanation

Non-delivery fraudoccurs when abuyer makes a paymentbutnever receives the product. This is one of themost common online fraud schemesused onclassified ad sites, social media marketplaces, and dark web platforms.

References:McAfee Institute CCII Fraud Investigations Guide, OSINT Handbook.

Questions # 19:

If an investigator can positively identify an online identity as belonging to a specific suspect, the investigator might also be able to develop further leads about co-conspirators based on other identities contained in their friend's network.

Options:

True

False

Answer

Explanation

Bymapping online social networks, investigators can:

Uncover associates and co-conspirators.

Track illicit activities via connections.

Analyze communications between criminal groups.

References:McAfee Institute CCII OSINT Techniques, Cyber Crime Investigator’s Field Guide.

Questions # 20:

Those forced to travel and steal did so because they were too well known locally, but they normally returned to their local area in order to sell.

Options:

True

False

Answer

Explanation

Many thieves and organized retail crime rings operateacross multiple jurisdictionsto avoid law enforcement detection. However, they often return to theirhome territory to sell goods, where they havetrusted contacts, fences, or buyers.

References:McAfee Institute CCII Retail Crime Guide, Cybercrime Encyclopedia.

Viewing page 2 out of 4 pages

Viewing questions 11-20 out of questions