Investigating People GOSI Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A corporate security team is investigating an employee who is suspected of leaking confidential documents. The employee has a public Facebook profile, a private Twitter account, and a public LinkedIn profile. The team has access to the employee's work email and knows their general location. Which approach would best build a behavioral profile to determine the employee's motives and potential contacts?

   • ASearch for the employee's name on a people search engine to find their home address and family members, then analyze their social media for any mentions of financial problems.
   • BCombine the employee's Facebook posts, LinkedIn connections, and geotagged check-ins to create a comprehensive profile of their behavior, routines, and social circle.
   • CAnalyze the employee's Facebook posts for signs of dissatisfaction and map their LinkedIn connections to identify potential collaborators.
   • DUse the employee's work email to search for public data breaches and find their personal email, then use that to access their private Twitter account.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An analyst is building a behavioral profile of a target who posts on a public Instagram account. The target frequently posts photos of coffee shops and co-working spaces, tags friends in stories, and has a public LinkedIn profile listing their employer. Which combination of open-source techniques would yield the most comprehensive profile?

   • ACombine geotagged post locations with the target's LinkedIn employment history to infer their commute and work-life balance, then correlate with the tags in their stories to identify close associates.
   • BAnalyze photo EXIF data for GPS coordinates and cross-reference with the target's check-ins to map their daily movement patterns.
   • CPerform a reverse image search on all photos to find other accounts using the same images, then analyze those accounts for additional personal details.
   • DExtract the target's list of followers and followings, then map their connections to the target's LinkedIn colleagues to identify overlapping professional and personal ties.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which type of online resource is specifically designed to aggregate public records, phone numbers, and addresses for locating information about individuals?

   • ASocial media platforms
   • BReverse image search engines
   • CWeb archives
   • DPeople search engines
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An investigator is trying to locate a person who has moved frequently. The investigator has the person's full name and a previous address from a public record. Which approach is most likely to yield current contact information?

   • ARun a reverse phone lookup on the previous address's landline number.
   • BSearch people search engines for the name and previous address, then look for associated phone numbers and newer addresses.
   • CUse the Wayback Machine to view the person's old personal website.
   • DSearch social media for the person's name and previous address to find current posts.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An analyst is investigating a subject who appears to be privacy-conscious. The subject uses different usernames on different platforms, has a phone number that is not linked to any social media, and uses a privacy-focused email service. Which adaptation is most likely to yield results?

   • AFocus on the phone number and use paid reverse lookup services to find associated accounts.
   • BSearch for the email address in data breach databases to find other accounts.
   • CAbandon the investigation because the subject's privacy measures are too effective.
   • DSearch for the subject's real name in combination with unique interests or affiliations found in any public posts.
   Reveal Solution Discussion Select an answer first