Question 1

The United States Secret Service (USSS) is responsible for financial crimes around the United States.

Accepted Answer

A

Explanation: TheUSSS Cyber Fraud Task Force (CFTF)investigatesfinancial cybercrime,credit card fraud, andcounterfeit currency operations. They work closely withbanking institutions, financial regulators, and forensic experts. Reference: USSS Financial Crime Reports McAfee Institute Financial Investigations Guide U.S. Treasury Department Reports

Question 2

Four types of computer-generated evidence are: Visual output on the monitor Printed evidence on a printer Printed evidence on a plotter Film recorder (to include optical drive and media).

Accepted Answer

A

Explanation: Computer-generated evidence includes variousforms of digital output, such as: Monitor displays– Screenshots, logs, and forensic captures. Printer output– Printed emails, reports, or logs. Plotter-based prints– Engineering or architectural renderings used in investigations. Film recorders and optical media– CDs, DVDs, and other storage media used for evidence recording. Each type of evidence must becollected and preserved under forensic standards. Reference: McAfee Institute Cyber Evidence Collection Guide U.S. DOJ Digital Investigation Manual Federal Rules on Computer Evidence Handling

Question 3

State and local law enforcement have held the primary responsibility for investigating and prosecuting organized retail crime.

Accepted Answer

A

Explanation: State and local law enforcement agencies play aprimary rolein investigatingorganized retail crime (ORC)due to their jurisdiction overshoplifting rings, return fraud, and theft operations. Federal agencies assist when cases involvemulti-stateorcross-bordercrimes. Reference: McAfee Institute Financial Crimes Guide Organized Crime Investigative Framework FBI & DHS Crime Reports

Question 4

Computer crimes can be separated into two categories:

Accepted Answer

A

Explanation: Cybercrimes are categorized into: Crimes facilitated by computers(e.g., fraud, phishing, online scams). Crimes where computers are the target(e.g., hacking, ransomware, data breaches). Understanding these categories helps investigatorsapply relevant legal frameworksandforensic methodologies. Reference: McAfee Institute Cybercrime Classification Guide FBI Cybercrime Division Reports U.S. Digital Fraud and Cybersecurity Legislation

Question 5

ICE has been taking a heavy stance and prosecuting Organized Retail Crime (ORC).

Accepted Answer

A

Explanation: ICE, through itsHomeland Security Investigations (HSI)unit,targets organized retail crimelinked to: Stolen goods resale operations Identity theft rings Financial fraud networks ICE collaborates withlocal law enforcementto track and dismantlelarge-scale ORC enterprises. Reference: Homeland Security ORC Reports ICE Financial Crimes Unit Investigation Manual

Question 6

What value does a friend's list bring to your investigation?

Accepted Answer

B

Explanation: A suspect’sfriend listcan helpmap relationships,identify potential conspirators, andconnect different digital identities. OSINT investigators leveragesocial network analysis (SNA)to establish links between individuals. Reference: McAfee Institute Digital Footprinting FBI Social Network Analysis Reports OSINT Graph Analysis Tools

Question 7

In Rosenberg v. Collins, the court held that if the computer output is used in the regular course of business, the evidence shall be admitted.

Accepted Answer

A

Explanation: InRosenberg v. Collins, the court established thatcomputer-generated records regularly used in business operationsareadmissibleas evidenceunder the business records exceptionto the hearsay rule. Investigators rely onmetadata, server logs, and financial recordsfor cyber investigations. Reference: U.S. Court Rulings on Digital Evidence Federal Rules of Evidence for Cyber Investigations McAfee Institute Legal Framework for Digital Evidence

Question 8

Evidence must be collected by law enforcement in accordance with court guidelines governing search and seizure.

Accepted Answer

A

Explanation: Digital evidence must be collected followinglegal search and seizure procedures, ensuringadmissibility in court. Key legal doctrines include: The Fourth Amendment (U.S.)– Protects against unlawful searches. The Stored Communications Act (SCA)– Governs data access from ISPs. Chain of Custody– Ensures evidence integrity. Failure to comply results inexclusion of evidence in court. Reference: McAfee Institute Evidence Collection Guide U.S. Federal Rules of Criminal Procedure Chain of Custody in Digital Investigations

Question 9

Federal law enforcement can only gather proprietary information concerning an incident in the following ways:

Accepted Answer

E

Explanation: Federal law enforcement agencies must obtainlegal authorizationto access proprietary information. The methods include: Voluntary disclosure– When a company voluntarily shares data with law enforcement. Court order– Issued by a judge to access specific records. Grand jury subpoena– Used to compel testimony or evidence. Search warrant– Required for seizing electronic evidence. Unauthorized accessviolates privacy laws, including theFourth Amendmentin the U.S.. Reference: U.S. Patriot Act Cybercrime Provisions Federal Digital Evidence Collection Guidelines McAfee Institute Cyber Investigation Training

Question 10

The preservation letter does not legally require the ISP to turn over its records.

Accepted Answer

A

Explanation: Apreservation letteronlyrequires ISPs to retain data, but it doesnot authorize access. Investigators must obtain: A court order A subpoena A search warrant This ensurescompliance with privacy lawswhile protecting investigation integrity. Reference: U.S. Cyber Law & Digital Evidence Guide ISP Data Handling and Compliance Guidelines McAfee Institute Cyber Law and Investigation Training

Question 11

A trojan is a program pretending to be like useful software, while its actual strategy is to access, steal, or destroy user data and access authorization.

Accepted Answer

A

Explanation: ATrojan horse (Trojan)is atype of malware disguised as legitimate software. Once installed, a Trojan can: Create backdoors for attackersto access a system. Steal sensitive datasuch as passwords, banking details, and personal files. Disable antivirus softwareor delete important system files. Unlike viruses and worms,Trojans do not replicate themselvesbut rely onsocial engineering techniquesto trick users into installing them. Reference:McAfee Institute CCII Cyber Threat Intelligence, Cyber Forensics Up and Running.

Question 12

What is the number one type of online fraud?

Accepted Answer

A

Explanation: Identity theftis themost common type of online fraud, affecting millions of people worldwide each year. Cybercriminals stealpersonal and financial informationto: Openfraudulent bank accounts. Makeunauthorized transactionsusing stolen credit card details. Conductloan fraudor apply for government benefits. Common methods used for identity theft include: Phishing attacks(fraudulent emails and fake websites). Data breaches(hacking into databases to steal personal records). Social engineering(manipulating people into revealing sensitive data). Reference:McAfee Institute CCII Cyber Fraud Investigations, Cybercrime Encyclopedia.

Question 13

The most common types of evidence include:

Accepted Answer

D

Explanation: Thethree main types of evidencein cyber investigations are: Direct Evidence– Witness testimony, live observations, or real-time recordings. Documentary Evidence– Written or recorded material such as logs, emails, contracts. Demonstrative Evidence– Visual aids, reconstructions, or interactive representations of data. Each type plays a critical role inproving digital cases, especially in court proceedings. Reference: McAfee Institute Cybercrime Investigator’s Guide Digital Forensics Standards and Evidence Classification U.S. Department of Justice Cyber Investigations Handbook

Question 14

You can access the profile of a subject if they are represented by legal counsel.

Accepted Answer

B

Explanation: Accessing a subject’s profile when they are represented by legal counselmay violate legal and ethical boundaries. Investigators must ensure compliance withlegal regulationsto avoid infringement on privacy rights. Unauthorized access could result inlegal liabilitiesunder variouscybercrime laws and ethical guidelinesfor digital investigations. Reference: McAfee Institute Cybercrime Investigator’s Field Guide OSINT Handbook Federal Digital Privacy Laws

Question 15

A virus is a program that attaches itself to a program or file. This allows it to spread across networks and cause damage to software and hardware.

Accepted Answer

A

Explanation: Acomputer virusismalicious software (malware)that replicates itself by attaching to legitimateprograms or files. Once activated, viruses can: Corrupt or delete files. Spread across networks, infecting multiple systems. Cause performance issuesor even render a system inoperable. Unlikeworms, which can spread independently, viruses requirehuman action(e.g., opening an infected file or running an executable). Reference:McAfee Institute CCII Cyber Threat Guide, Cybercrime Encyclopedia.

Free McAfee CCII Actual Exam Questions