- CCII covers 5 domains: intelligence analysis, case management, social media investigation, mobile/digital forensics, and e-commerce fraud.
- Passing requires 70% or better on every course section and 70% or better on the final proctored exam.
- Mobile forensics, social media investigation, and legal fundamentals carry the deepest coverage across all 26 modules.
- Certification lasts two years and needs 20 CPE credits per cycle, including 2 ethics hours.
Quick Facts Snapshot
Before diving into domain-by-domain detail, here is the condensed version of everything a candidate needs to hold in working memory. The Certified Cyber Intelligence Investigator (CCII) is administered by McAfee Institute, a private board-certification body based in Chesterfield, Missouri. Unlike certifications delivered through Pearson VUE or Prometric test centers, the CCII exam runs entirely online through McAfee Institute's own proctored platform, and the training itself is self-paced across 26 modules available around the clock.
If you want the long-form breakdown of any single fact below, the CCII Study Guide 2026 and the CCII Exam Domains 2026 guide both go deeper than a cheat sheet reasonably can. This page exists so you can review the essentials in one sitting the night before your final exam attempt.
The Five Domains at a Glance
Every scored question on the CCII exam maps back to one of five domains. Memorize these names exactly - they are not interchangeable buzzwords, and knowing which domain a question belongs to often tells you what kind of answer the exam wants.
Domain 1: Cyber Intelligence and Intelligence Analysis
Tests your ability to collect, structure, and interpret raw information into actionable intelligence.
- Intelligence cycle stages and analytic tradecraft
- Open-source intelligence (OSINT) sourcing and validation
Domain 2: Cyber Investigations and Case Management
Covers how an investigation is opened, documented, and carried through to a defensible conclusion.
- Chain of custody and evidence handling
- Case file structure and investigative reporting standards
Domain 3: Social Media Investigation Methodologies
One of the three heaviest-weighted domains. Expect detailed scenario questions on platform-specific tracing techniques.
- Sock puppet and undercover account methodology
- Metadata extraction and account attribution
Domain 4: Mobile and Digital Forensics
The other heavily weighted domain. Covers acquisition and analysis of mobile devices and digital artifacts.
- Logical vs. physical extraction methods
- Artifact interpretation and forensic tool limitations
Domain 5: E-Commerce, Fraud, Hacking, and Auction Fraud
Reflects the certification's origins in retail loss prevention and online fraud investigation.
- Auction and marketplace fraud schemes
- Hacking indicators and e-commerce fraud red flags
For a full walkthrough of how these five areas interact and where the exam blueprint places emphasis, see the CCII Exam Domains 2026: Complete Guide to All 5 Content Areas.
Registration and Fee Mechanics
The CCII enrollment structure is different from most vendor-neutral certifications, so get the mechanics straight before you pay anything.
- Standard enrollment bundles the full 26-module course library, the official manual, a proctored exam license, and the board credential upon successful completion.
- A standalone Certified Exam License is sold separately for experienced practitioners who already know the material and don't need the training bundle.
- To earn certification you must: submit all course quizzes, score 70% or better on every course section, score 70% or better on the final online proctored exam, submit proof of eligibility with your exam application, and pay all fees in full.
- Candidates who don't yet meet eligibility can still complete the training and receive a "Qualified" credential, then purchase the Certified Exam License later to convert to "Certified" once they qualify.
For the itemized dollar breakdown of each bundle and license option, read CCII Certification Cost 2026: Complete Pricing Breakdown. If you're unsure exactly what score you need on each section, the CCII Passing Score 2026 article walks through the 70% threshold in detail.
Key Takeaway
Don't confuse "enrolled" with "eligible." You can finish all 26 modules and still be stuck at "Qualified" status if your degree/experience combination doesn't clear the eligibility bar - check this before you invest study time.
Must-Know Topics by Weight
Not all 26 modules deserve equal study time. Based on the certification's own weighting, three areas carry the deepest coverage and should absorb the largest share of your review hours:
- Mobile forensics - device acquisition methods, artifact recovery, and interpretation of extracted data (Domain 4).
- Social media investigation - undercover profile methodology, platform-specific evidence collection, and attribution techniques (Domain 3).
- Legal fundamentals - evidentiary standards, chain of custody, and procedural rules that cut across Domains 2 and 5.
These three threads show up disproportionately across scenario-style questions, so a candidate who under-studies them will feel the difficulty gap immediately. For a broader discussion of what makes the exam challenging in practice, see How Hard Is the CCII Exam? Complete Difficulty Guide 2026.
Eligibility Cheat Sheet
Eligibility is tiered by education level, and it must be documented at application time - not assumed.
| Education Level | Required Experience |
|---|---|
| Bachelor's degree or higher | 1 year in e-commerce, fraud, investigations, intelligence, military, cybersecurity, law enforcement, forensics, computer/digital forensics, criminal justice, or law |
| Associate's degree | 2 years in the same qualifying fields |
| High school diploma or equivalency | 3 years in the same qualifying fields |
Disqualifying factors: anyone convicted of a felony, a crime of moral turpitude, or a misdemeanor relating to honesty, theft, embezzlement, or fraud is ineligible for certification. This is a hard exclusion, not a case-by-case waiver. For the complete eligibility discussion, including documentation requirements, see CCII Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Exam Format and Passing Score Rules
Because the CCII exam is delivered through McAfee Institute's own online proctoring rather than a physical test center, the logistics differ from what candidates coming from Pearson VUE-style certifications may expect. There's no test center check-in - instead you schedule a proctored session through the platform itself.
The scoring rule is straightforward but strict: 70% or better on every section of the course quizzes, and 70% or better on the final proctored exam. There is no averaging across sections - each one must independently clear the threshold. This section-by-section requirement is one reason candidates who skim modules on legal fundamentals or case management get tripped up even if their overall knowledge feels strong.
Scheduling flexibility, session windows, and what to do if you need to reschedule are covered in CCII Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Renewal and CPE Rules
- Certification is valid for two years from the date earned.
- Renewal requires 20 CPE credits per two-year cycle.
- At least 2 of those 20 hours must be ethics-focused CPE.
- A 30-day grace period applies after expiration - miss that window and the credential is permanently revoked, requiring purchase of a brand-new exam license to recertify.
- CPE hours are self-reported through McAfee Institute's CPE reporting form, and records are retained for three years.
Key Takeaway
Set a renewal reminder well before the two-year mark. The 30-day grace period is unforgiving - after that, you're not renewing, you're starting over with a new exam license.
Recognitions and Funding
The CCII isn't just a private-industry badge - it has formal recognition that matters for government and military candidates:
- Listed in the CISA NICCS Education & Training Catalog
- Mapped to the NIST NICE Workforce Framework
- Approved for Missouri POST CLEE credit
- Eligible for DoD, Navy, Army, Coast Guard, and Air Force COOL and Credentialing Assistance funding
If you're weighing whether the credential justifies the cost and study time, particularly against these funding options, the analysis in Is the CCII Certification Worth It? Complete ROI Analysis 2026 and the numbers in CCII Salary Guide 2026: Complete Earnings Analysis are worth reading before you enroll.
Last-Week Review Schedule
If you're using this cheat sheet as a final-week refresher rather than a full study plan, structure the remaining days around the domains that carry the most weight rather than reviewing all 26 modules evenly.
Mobile and Digital Forensics (Domain 4)
- Re-read acquisition method distinctions (logical vs. physical)
- Drill artifact interpretation scenarios
Social Media Investigation (Domain 3)
- Review undercover methodology and platform-specific tactics
- Practice metadata and attribution question types
Legal Fundamentals and Case Management (Domains 2 & 5)
- Chain of custody rules and documentation standards
- Fraud and e-commerce scheme identification
Full Review and Rest
- Light pass over Domain 1 intelligence-cycle concepts
- Avoid cramming new material the night before
This isn't a generic spaced-repetition template - it's ordered specifically around where the CCII exam is heaviest. For a full multi-week version of this plan built from day one of enrollment, see the CCII Study Guide 2026.
Who Actually Hires CCIIs
Because the domains blend intelligence analysis, digital forensics, and fraud investigation, the credential draws interest from a wider hiring pool than a narrow technical certification would. Roles that commonly value CCII holders include corporate loss prevention and asset protection investigators, e-commerce and retail fraud analysts, law enforcement digital forensics units, private investigation firms, and military/government cyber intelligence billets eligible for COOL funding.
You can browse concrete job titles and typical responsibilities in CCII Jobs, and get a sense of expected compensation ranges in the CCII Salary Guide 2026. If you're still deciding whether to enroll in the full training or just sit the standalone exam license, the CCII Training overview breaks down what the 26 modules actually deliver.
To sharpen recall on the terminology itself, quick-reference pieces like What Is CCII?, CCII Meaning, and What Does CCII Stand For? are useful companions to this cheat sheet, especially if you're explaining the credential to a hiring manager unfamiliar with McAfee Institute's board-certification model.
FAQs
Entirely online. McAfee Institute uses its own proctored exam platform rather than a third-party test center network like Pearson VUE or Prometric.
You need 70% or better on every section of the course quizzes and 70% or better on the final online proctored exam - both requirements apply independently.
You get a 30-day grace period after the two-year expiration date. If you don't renew within that window, the credential is permanently revoked and you must purchase a new exam license to recertify.
Yes. You can complete the training and receive a "Qualified" credential, then purchase the Certified Exam License later once you meet the eligibility tier to convert to fully "Certified."
Mobile and Digital Forensics (Domain 4) and Social Media Investigation Methodologies (Domain 3) carry the deepest coverage, alongside legal fundamentals woven through case management and fraud domains.
Keep this page bookmarked as your quick-reference companion, but pair it with hands-on practice - reviewing facts and answering scenario questions on our CCII practice exam are two different skills, and the real exam tests the second one.