McAfee CCII Exam - Topic 1 Question 16 Discussion

Actual exam question for McAfee's CCII exam

Question #: 16
Topic #: 1

[All CCII Questions]

A forensic examiner should always turn off a mobile device at the time of seizure and before starting an acquisition.

ATrue

BFalse

Show Suggested Answer

Suggested Answer: B

Forensic best practices recommendkeeping the device powered onbecause:

Turning off the device may trigger encryption locks, making data inaccessible.

Live data acquisitionallows retrieval of RAM contents, running apps, and network logs.

Airplane mode should be enabled instead of shutting downto prevent remote wiping.

by Cristen at Nov 19, 2025, 07:26 AM

Limited Time Offer

25%

Off

Get Premium CCII Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Scarlet

3 days ago

Wait, really? I thought you could just take a snapshot.

upvoted 0 times

...

Van

8 days ago

I disagree, sometimes you need to keep it on for evidence.

upvoted 0 times

...

Elenor

13 days ago

False, how else am I supposed to play Angry Birds during the exam?

upvoted 0 times

...

Alesia

18 days ago

True, can't have that device self-destructing on me.

upvoted 0 times

...

Dahlia

24 days ago

False, I need that GPS data for my investigation!

upvoted 0 times

...

Fletcher

29 days ago

True, gotta preserve that battery life!

upvoted 0 times

...

In

1 month ago

This is tricky! I remember some guidelines saying to keep the device on to avoid altering evidence, but I can’t remember if that applies to all situations.

upvoted 0 times

...

Irene

1 month ago

I recall a case study where turning off the device caused data loss, so I think it should be False.

upvoted 0 times

...

Alesia

1 month ago

I’m not entirely sure, but I feel like there were practice questions that mentioned the risks of turning off a device. Maybe it’s True?

upvoted 0 times

...

Craig

2 months ago

I think we discussed this in class, and I remember something about preserving the state of the device. So, I’m leaning towards False.

upvoted 0 times

...

Mitsue

2 months ago

Wait, is this a trick question? I thought we were supposed to leave the device powered on to capture any live data. Now I'm second-guessing myself. I'll have to review my notes on this.

upvoted 0 times

...

Helene

2 months ago

Okay, I remember learning about this in class. Turning off the device is important to prevent any changes to the data before the forensic examination. I'll mark this as true.

upvoted 0 times

...

Colton

2 months ago

I think it's A) True. Turning it off prevents data alteration.

upvoted 0 times

...

Noah

3 months ago

Definitely true, you don't want to alter any data.

upvoted 0 times

...

Herman

3 months ago

Turning off the device is the way to go. That ensures the data is preserved in its original state. I'm feeling good about selecting true for this one.

upvoted 0 times

...

Lauryn

3 months ago

Hmm, I'm a bit unsure about this one. I know we need to handle devices carefully, but I can't recall if turning it off is always required. I'll have to think this through.

upvoted 0 times

...

Miles

3 months ago

I'm pretty confident this is true. Turning off the device before acquisition is a standard forensic procedure to preserve the data.

upvoted 0 times

Christiane

2 months ago

I agree, turning it off is crucial.

upvoted 0 times

...

Hershel

3 months ago

Definitely, it prevents data alteration.

upvoted 0 times

...