CCII logo
Focused certification exam prep
Start practice

CCII Cheat Sheet 2026: One-Page Review of Must-Know Facts

TL;DR
  • CCII covers 5 domains: intelligence analysis, case management, social media investigation, mobile/digital forensics, and e-commerce fraud.
  • Passing requires 70% or better on every course section and 70% or better on the final proctored exam.
  • Mobile forensics, social media investigation, and legal fundamentals carry the deepest coverage across all 26 modules.
  • Certification lasts two years and needs 20 CPE credits per cycle, including 2 ethics hours.

Quick Facts Snapshot

Before diving into domain-by-domain detail, here is the condensed version of everything a candidate needs to hold in working memory. The Certified Cyber Intelligence Investigator (CCII) is administered by McAfee Institute, a private board-certification body based in Chesterfield, Missouri. Unlike certifications delivered through Pearson VUE or Prometric test centers, the CCII exam runs entirely online through McAfee Institute's own proctored platform, and the training itself is self-paced across 26 modules available around the clock.

One-Line Summary: CCII is a self-study, online-proctored board certification built around investigative fieldwork - social media tracing, mobile forensics, and legal procedure - not generic IT security theory.

If you want the long-form breakdown of any single fact below, the CCII Study Guide 2026 and the CCII Exam Domains 2026 guide both go deeper than a cheat sheet reasonably can. This page exists so you can review the essentials in one sitting the night before your final exam attempt.

The Five Domains at a Glance

Every scored question on the CCII exam maps back to one of five domains. Memorize these names exactly - they are not interchangeable buzzwords, and knowing which domain a question belongs to often tells you what kind of answer the exam wants.

Domain 1: Cyber Intelligence and Intelligence Analysis

Tests your ability to collect, structure, and interpret raw information into actionable intelligence.

  • Intelligence cycle stages and analytic tradecraft
  • Open-source intelligence (OSINT) sourcing and validation

Domain 2: Cyber Investigations and Case Management

Covers how an investigation is opened, documented, and carried through to a defensible conclusion.

  • Chain of custody and evidence handling
  • Case file structure and investigative reporting standards

Domain 3: Social Media Investigation Methodologies

One of the three heaviest-weighted domains. Expect detailed scenario questions on platform-specific tracing techniques.

  • Sock puppet and undercover account methodology
  • Metadata extraction and account attribution

Domain 4: Mobile and Digital Forensics

The other heavily weighted domain. Covers acquisition and analysis of mobile devices and digital artifacts.

  • Logical vs. physical extraction methods
  • Artifact interpretation and forensic tool limitations

Domain 5: E-Commerce, Fraud, Hacking, and Auction Fraud

Reflects the certification's origins in retail loss prevention and online fraud investigation.

  • Auction and marketplace fraud schemes
  • Hacking indicators and e-commerce fraud red flags

For a full walkthrough of how these five areas interact and where the exam blueprint places emphasis, see the CCII Exam Domains 2026: Complete Guide to All 5 Content Areas.

Registration and Fee Mechanics

The CCII enrollment structure is different from most vendor-neutral certifications, so get the mechanics straight before you pay anything.

  • Standard enrollment bundles the full 26-module course library, the official manual, a proctored exam license, and the board credential upon successful completion.
  • A standalone Certified Exam License is sold separately for experienced practitioners who already know the material and don't need the training bundle.
  • To earn certification you must: submit all course quizzes, score 70% or better on every course section, score 70% or better on the final online proctored exam, submit proof of eligibility with your exam application, and pay all fees in full.
  • Candidates who don't yet meet eligibility can still complete the training and receive a "Qualified" credential, then purchase the Certified Exam License later to convert to "Certified" once they qualify.

For the itemized dollar breakdown of each bundle and license option, read CCII Certification Cost 2026: Complete Pricing Breakdown. If you're unsure exactly what score you need on each section, the CCII Passing Score 2026 article walks through the 70% threshold in detail.

Key Takeaway

Don't confuse "enrolled" with "eligible." You can finish all 26 modules and still be stuck at "Qualified" status if your degree/experience combination doesn't clear the eligibility bar - check this before you invest study time.

Must-Know Topics by Weight

Not all 26 modules deserve equal study time. Based on the certification's own weighting, three areas carry the deepest coverage and should absorb the largest share of your review hours:

  1. Mobile forensics - device acquisition methods, artifact recovery, and interpretation of extracted data (Domain 4).
  2. Social media investigation - undercover profile methodology, platform-specific evidence collection, and attribution techniques (Domain 3).
  3. Legal fundamentals - evidentiary standards, chain of custody, and procedural rules that cut across Domains 2 and 5.

These three threads show up disproportionately across scenario-style questions, so a candidate who under-studies them will feel the difficulty gap immediately. For a broader discussion of what makes the exam challenging in practice, see How Hard Is the CCII Exam? Complete Difficulty Guide 2026.

Study Weight Rule of Thumb: If a topic touches mobile devices, social platforms, or legal admissibility, assume it's fair game for a deeper, scenario-based question rather than a simple definition lookup.

Eligibility Cheat Sheet

Eligibility is tiered by education level, and it must be documented at application time - not assumed.

Education LevelRequired Experience
Bachelor's degree or higher1 year in e-commerce, fraud, investigations, intelligence, military, cybersecurity, law enforcement, forensics, computer/digital forensics, criminal justice, or law
Associate's degree2 years in the same qualifying fields
High school diploma or equivalency3 years in the same qualifying fields

Disqualifying factors: anyone convicted of a felony, a crime of moral turpitude, or a misdemeanor relating to honesty, theft, embezzlement, or fraud is ineligible for certification. This is a hard exclusion, not a case-by-case waiver. For the complete eligibility discussion, including documentation requirements, see CCII Requirements 2026: Eligibility, Prerequisites & How to Qualify.

Exam Format and Passing Score Rules

Because the CCII exam is delivered through McAfee Institute's own online proctoring rather than a physical test center, the logistics differ from what candidates coming from Pearson VUE-style certifications may expect. There's no test center check-in - instead you schedule a proctored session through the platform itself.

The scoring rule is straightforward but strict: 70% or better on every section of the course quizzes, and 70% or better on the final proctored exam. There is no averaging across sections - each one must independently clear the threshold. This section-by-section requirement is one reason candidates who skim modules on legal fundamentals or case management get tripped up even if their overall knowledge feels strong.

Scheduling flexibility, session windows, and what to do if you need to reschedule are covered in CCII Exam Dates 2026: Testing Windows, Deadlines & Scheduling.

Renewal and CPE Rules

  • Certification is valid for two years from the date earned.
  • Renewal requires 20 CPE credits per two-year cycle.
  • At least 2 of those 20 hours must be ethics-focused CPE.
  • A 30-day grace period applies after expiration - miss that window and the credential is permanently revoked, requiring purchase of a brand-new exam license to recertify.
  • CPE hours are self-reported through McAfee Institute's CPE reporting form, and records are retained for three years.

Key Takeaway

Set a renewal reminder well before the two-year mark. The 30-day grace period is unforgiving - after that, you're not renewing, you're starting over with a new exam license.

Recognitions and Funding

The CCII isn't just a private-industry badge - it has formal recognition that matters for government and military candidates:

  • Listed in the CISA NICCS Education & Training Catalog
  • Mapped to the NIST NICE Workforce Framework
  • Approved for Missouri POST CLEE credit
  • Eligible for DoD, Navy, Army, Coast Guard, and Air Force COOL and Credentialing Assistance funding

If you're weighing whether the credential justifies the cost and study time, particularly against these funding options, the analysis in Is the CCII Certification Worth It? Complete ROI Analysis 2026 and the numbers in CCII Salary Guide 2026: Complete Earnings Analysis are worth reading before you enroll.

Last-Week Review Schedule

If you're using this cheat sheet as a final-week refresher rather than a full study plan, structure the remaining days around the domains that carry the most weight rather than reviewing all 26 modules evenly.

Days 1-2

Mobile and Digital Forensics (Domain 4)

  • Re-read acquisition method distinctions (logical vs. physical)
  • Drill artifact interpretation scenarios
Days 3-4

Social Media Investigation (Domain 3)

  • Review undercover methodology and platform-specific tactics
  • Practice metadata and attribution question types
Days 5-6

Legal Fundamentals and Case Management (Domains 2 & 5)

  • Chain of custody rules and documentation standards
  • Fraud and e-commerce scheme identification
Day 7

Full Review and Rest

  • Light pass over Domain 1 intelligence-cycle concepts
  • Avoid cramming new material the night before

This isn't a generic spaced-repetition template - it's ordered specifically around where the CCII exam is heaviest. For a full multi-week version of this plan built from day one of enrollment, see the CCII Study Guide 2026.

Who Actually Hires CCIIs

Because the domains blend intelligence analysis, digital forensics, and fraud investigation, the credential draws interest from a wider hiring pool than a narrow technical certification would. Roles that commonly value CCII holders include corporate loss prevention and asset protection investigators, e-commerce and retail fraud analysts, law enforcement digital forensics units, private investigation firms, and military/government cyber intelligence billets eligible for COOL funding.

You can browse concrete job titles and typical responsibilities in CCII Jobs, and get a sense of expected compensation ranges in the CCII Salary Guide 2026. If you're still deciding whether to enroll in the full training or just sit the standalone exam license, the CCII Training overview breaks down what the 26 modules actually deliver.

To sharpen recall on the terminology itself, quick-reference pieces like What Is CCII?, CCII Meaning, and What Does CCII Stand For? are useful companions to this cheat sheet, especially if you're explaining the credential to a hiring manager unfamiliar with McAfee Institute's board-certification model.

Practice Before You Sit the Real Thing: Reviewing facts is only half the preparation. Running through scenario-style questions on our CCII practice test platform is the fastest way to see whether you can apply Domain 3 and Domain 4 knowledge under exam conditions, not just recognize it on a page.

FAQs

Is the CCII exam proctored in person or online?

Entirely online. McAfee Institute uses its own proctored exam platform rather than a third-party test center network like Pearson VUE or Prometric.

What score do I need to pass the CCII exam?

You need 70% or better on every section of the course quizzes and 70% or better on the final online proctored exam - both requirements apply independently.

What happens if I let my CCII certification expire?

You get a 30-day grace period after the two-year expiration date. If you don't renew within that window, the credential is permanently revoked and you must purchase a new exam license to recertify.

Can I earn CCII certification without meeting the experience requirement yet?

Yes. You can complete the training and receive a "Qualified" credential, then purchase the Certified Exam License later once you meet the eligibility tier to convert to fully "Certified."

Which domains should I prioritize if I'm short on study time?

Mobile and Digital Forensics (Domain 4) and Social Media Investigation Methodologies (Domain 3) carry the deepest coverage, alongside legal fundamentals woven through case management and fraud domains.

Keep this page bookmarked as your quick-reference companion, but pair it with hands-on practice - reviewing facts and answering scenario questions on our CCII practice exam are two different skills, and the real exam tests the second one.

Ready to pass your CCII exam?

Put this into practice with free CCII questions across every exam domain.