Using AI for OSINT GOAA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A penetration testing firm is conducting OSINT for a client in the financial sector. The firm's AI tool can automatically scrape social media profiles and analyze sentiment. The client is concerned about regulatory compliance (e.g., GDPR, financial regulations). The firm wants to proceed with the engagement. Which step is most important to take first?

   • AUse a third-party tool that is hosted in a non-EU country to avoid GDPR.
   • BConduct a data protection impact assessment (DPIA) and document the legal basis for processing personal data.
   • CProceed with collection because the client has authorized the engagement.
   • DAnonymize all data immediately after collection to avoid any regulatory issues.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An analyst is tasked with gathering OSINT on a target organization's supply chain. The analyst wants to collect data from public business registries, news articles, and social media about the organization's partners and vendors. The goal is to identify any high-risk relationships. Which AI approach would be most effective?

   • AUse an anomaly detection model on the number of mentions to find unusual spikes.
   • BUse a sentiment analysis tool to gauge the tone of news articles about the organization.
   • CUse an AI tool that automatically aggregates data from multiple public sources and applies entity resolution to link mentions of the same organization.
   • DManually search each source and maintain a spreadsheet of organizations.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security consultant is conducting OSINT for a client in the healthcare sector. The consultant plans to use AI to analyze public social media posts of hospital staff to identify potential targets for a phishing test. The client is in the EU, and the consultant is in the US. Which consideration is most critical for compliance?

   • AAnonymize all data before analysis to avoid GDPR entirely.
   • BEnsure that the processing of personal data has a legal basis under GDPR, such as legitimate interest, and that data transfers from the EU to the US comply with appropriate safeguards.
   • CObtain written consent from every employee before collecting their public posts.
   • DUse a VPN to hide the consultant's location and avoid GDPR jurisdiction.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An intelligence analyst is investigating a data breach where stolen credentials were posted on a dark web forum. The analyst has collected forum posts, usernames, and timestamps. The goal is to identify the likely threat actor group based on their posting patterns and language. Which AI approach would be most effective?

   • AGenerate a network graph of all users and apply community detection.
   • BUse sentiment analysis to gauge the emotional tone of the posts.
   • CApply stylometry analysis to the posts to identify unique writing styles, then cluster similar authors.
   • DPerform named-entity recognition to extract technical terms from the posts.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An offensive security analyst is monitoring a target's public social media activity to identify the best time to send a phishing email that is likely to be opened. The analyst has collected months of posts and wants to infer the target's daily routine and emotional state. Which AI technique should the analyst apply to the collected data?

   • ASentiment analysis combined with timestamp clustering to identify patterns in mood and posting times.
   • BTopic modeling to categorize the subjects of the posts.
   • CImage classification to identify objects in posted photos.
   • DNamed-entity recognition to extract the names of people the target mentions.
   Reveal Solution Discussion Select an answer first