McAfee CCII Exam - Topic 1 Question 16 Discussion

Actual exam question for McAfee's CCII exam

Question #: 16
Topic #: 1

[All CCII Questions]

A forensic examiner should always turn off a mobile device at the time of seizure and before starting an acquisition.

ATrue

BFalse

Show Suggested Answer

Suggested Answer: B

Forensic best practices recommendkeeping the device powered onbecause:

Turning off the device may trigger encryption locks, making data inaccessible.

Live data acquisitionallows retrieval of RAM contents, running apps, and network logs.

Airplane mode should be enabled instead of shutting downto prevent remote wiping.

by Cristen at Nov 19, 2025, 07:26 AM

Limited Time Offer

25%

Off

Get Premium CCII Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Elenor

2 months ago

B) False could be risky. We need to capture everything possible.

upvoted 0 times

...

Ronald

2 months ago

I lean towards A) True. Better safe than sorry!

upvoted 0 times

...

Elly

2 months ago

But what if the device is locked? B) False could help access it.

upvoted 0 times

...

Brice

2 months ago

A) True makes sense. We need to preserve evidence.

upvoted 0 times

...

Linsey

3 months ago

I disagree, B) False. You might lose volatile data if you turn it off.

upvoted 0 times

...

Tabetha

3 months ago

Seems risky, what if you lose something important by shutting it down?

upvoted 0 times

...

Glenn

3 months ago

Always turn it off, it's standard procedure.

upvoted 0 times

...

Scarlet

3 months ago

Wait, really? I thought you could just take a snapshot.

upvoted 0 times

...

Van

4 months ago

I disagree, sometimes you need to keep it on for evidence.

upvoted 0 times

...

Elenor

4 months ago

False, how else am I supposed to play Angry Birds during the exam?

upvoted 0 times

...

Alesia

4 months ago

True, can't have that device self-destructing on me.

upvoted 0 times

...

Dahlia

4 months ago

False, I need that GPS data for my investigation!

upvoted 0 times

...

Fletcher

4 months ago

True, gotta preserve that battery life!

upvoted 0 times

...

In

5 months ago

This is tricky! I remember some guidelines saying to keep the device on to avoid altering evidence, but I can’t remember if that applies to all situations.

upvoted 0 times

...

Irene

5 months ago

I recall a case study where turning off the device caused data loss, so I think it should be False.

upvoted 0 times

...

Alesia

5 months ago

I’m not entirely sure, but I feel like there were practice questions that mentioned the risks of turning off a device. Maybe it’s True?

upvoted 0 times

...

Craig

5 months ago

I think we discussed this in class, and I remember something about preserving the state of the device. So, I’m leaning towards False.

upvoted 0 times

...

Mitsue

5 months ago

Wait, is this a trick question? I thought we were supposed to leave the device powered on to capture any live data. Now I'm second-guessing myself. I'll have to review my notes on this.

upvoted 0 times

...

Helene

5 months ago

Okay, I remember learning about this in class. Turning off the device is important to prevent any changes to the data before the forensic examination. I'll mark this as true.

upvoted 0 times

...

Colton

6 months ago

I think it's A) True. Turning it off prevents data alteration.

upvoted 0 times

...

Noah

6 months ago

Definitely true, you don't want to alter any data.

upvoted 0 times

...

Herman

6 months ago

Turning off the device is the way to go. That ensures the data is preserved in its original state. I'm feeling good about selecting true for this one.

upvoted 0 times

...

Lauryn

7 months ago

Hmm, I'm a bit unsure about this one. I know we need to handle devices carefully, but I can't recall if turning it off is always required. I'll have to think this through.

upvoted 0 times

...