Free CCII Practice Questions

Question 1

An analyst downloads 4,000 breach-forum posts, sorts them by date, removes duplicates, and delivers the cleaned spreadsheet to a manager who must decide whether to shut down a payment channel. At the moment of delivery, what has the analyst produced?

Accepted Answer

Information, processed but not analyzed

Answer

Intelligence, collected against a stated requirement

Answer

Intelligence, since deduplication and date-sorting are analytic techniques

Answer

Information, as open sources cannot yield intelligence

Question 2

An intelligence unit receives a tasking, collects on it, translates the material, analyzes it, and delivers a finished product. The consumer reads the product and asks three new questions. In the intelligence cycle, this consumer response is BEST described as:

Accepted Answer

Evaluation and feedback, restarting the cycle

Answer

The conclusion of the cycle, dissemination being the terminal phase of the process

Answer

A separate tasking activity sitting outside the cycle entirely, the product having been delivered

Answer

Processing and exploitation, since the new questions must be converted into collectible tasks

Question 3

An investigator logs into their online banking portal to review a subpoenaed statement. Which layer of the web are they accessing?

Accepted Answer

The deep web, because the account content sits behind authentication and is not indexed

Answer

The surface web, no anonymity software being needed

Answer

The dark web, the session being encrypted and access-controlled

Answer

The surface web, because the bank's public login page is itself indexed by search engines

Question 4

A suspect uses Tor to browse a conventional (non-.onion) website over plain HTTP. Which relay in the circuit is able to observe the unencrypted content of that traffic?

Accepted Answer

The exit node, which strips the final layer before forwarding

Answer

The entry (guard) node, being the first relay to receive the user's outbound traffic

Answer

The middle node, which bridges the entry and exit relays and carries all of the traffic

Answer

None, as Tor holds encryption end-to-end

Question 5

A vendor has moved across four dark web marketplaces after successive takedowns, using a different handle each time. Historically, which factor has MOST often enabled investigators to attribute such vendors?

Accepted Answer

Operational security mistakes by the vendor

Answer

Cryptographic weaknesses in the Tor protocol disclosed by academic researchers

Answer

Cooperation agreements negotiated between marketplace operators and law enforcement

Answer

Deanonymization of the vendor's guard node through sustained traffic timing analysis

Question 6

A fraud suspect moved funds through Bitcoin. Which statement about the resulting investigative posture is accurate?

Accepted Answer

Bitcoin is pseudonymous; the ledger is public and regulated exchanges are the strongest attribution point

Answer

Bitcoin is anonymous, so tracing works only where an address was reused

Answer

Bitcoin is private by default, so a warrant to the blockchain's operator is needed

Answer

Bitcoin is transparent, so the ledger discloses the suspect's legal identity

Question 7

An investigator receives a suspicious email as a forwarded message from the recipient and needs to determine its true origin. What is the MOST significant problem with the material as received?

Accepted Answer

Forwarding rewrites the header chain, so the original Received: path that would reveal the true origin is no longer intact

Answer

Forwarding strips the message body, leaving no content that can later be authenticated

Answer

Forwarding invalidates the Message-ID, the only header field identifying the origin

Answer

Forwarding is acceptable if the recipient confirms no edits

Question 8

An email purporting to come from a company's CFO passes both SPF and DKIM checks, and DMARC reports alignment. What may the investigator properly conclude?

Accepted Answer

It came from an authorized server and was unaltered

Answer

The message is legitimate, so the wire request it contains may be actioned

Answer

The From: header is cryptographically verified as the CFO's own

Answer

The sending account is confirmed free from compromise

Question 9

Responders arrive to find a suspect's desktop powered on, logged in, and running a full-disk-encrypted volume. Following the order of volatility, what should be collected FIRST?

Accepted Answer

The contents of RAM

Answer

A forensic image of the encrypted disk, taken before anyone can trigger a remote wipe of the device

Answer

The system and security event logs, which hold the record of the user's recent activity on the machine

Answer

Archived backups on the attached network share, being the data least likely to change over time

Question 10

An examiner is given a USB drive as evidence and connects it to a forensic workstation through a hardware write blocker. What does the write blocker accomplish?

Accepted Answer

It permits reading while preventing any write, so mere connection cannot alter the original evidence

Answer

It encrypts the drive so its contents cannot be read by unauthorized staff

Answer

It creates a verified bit-for-bit image automatically on connection

Answer

It calculates and records the drive's hash value as it is read

Free CCII Practice Questions

Domain 1: Cyber Intelligence and Intelligence Analysis

Question 1

Question 2

Domain 5: E-Commerce, Fraud, Hacking, and Auction Fraud

Question 3

Question 4

Question 5

Question 6

More CCII practice questions

Question 7

Question 8

Question 9

Question 10

The rest of the CCII blueprint

That's 10 of 1,051