Investigating People GOSI Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An analyst is building a profile of a subject who is active on Twitter and Instagram. The subject's Twitter feed is heavily political, while their Instagram shows family activities. The analyst needs to determine if the subject is likely to attend a public protest on a specific date. Which combination of data would be most predictive?

   • AThe subject's family photos and the ages of their children.
   • BThe subject's past attendance at similar protests, their expressed intent in tweets, and their location check-ins near protest venues.
   • CThe subject's number of followers and the political leanings of their followers.
   • DThe subject's Instagram activity level and the number of posts they like.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   An analyst examines a target's public posts, likes, and check-ins to infer their age range, interests, and daily routines. Which OSINT activity is the analyst performing?

   • AArchival research
   • BIdentity resolution
   • CUsername correlation
   • DSocial media profiling
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An analyst is investigating a cybercriminal who uses multiple usernames across different platforms. The analyst has identified the usernames 'dark_hacker', 'ghost_ops', and 'silent_fox'. The analyst suspects they all belong to the same person but has no direct evidence. Which combination of techniques would most conclusively link these usernames?

   • AAnalyze the writing style and linguistic patterns of posts made under each username on various forums.
   • BCombine linguistic analysis, reverse image searches, and cross-referencing of any shared email addresses or phone numbers.
   • CSearch for all three usernames on a username aggregator and compare the registration dates and email addresses.
   • DUse a reverse image search on the profile pictures of all three accounts to see if any images are reused.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An analyst is investigating a subject who uses a VPN, a privacy-focused browser, and disposable email addresses. The subject's social media accounts use different usernames and no profile photos. The analyst has found a single post where the subject mentions a rare medical condition. Which approach is most likely to yield additional information?

   • ASearch for the subject's disposable email addresses in data breach databases.
   • BSearch for the rare medical condition in combination with the subject's general location or other unique details from the post.
   • CAbandon the investigation because the subject's privacy measures are too effective.
   • DUse a people search engine to look up the subject's usernames.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An analyst has a photo of a subject taken at a conference. The analyst wants to identify the conference and the subject's role. The photo shows a badge with a logo but the text is too small to read. Which technique would be most effective?

   • ACheck the photo's EXIF data for the conference location.
   • BEnhance the badge area of the photo and run a reverse image search on the enhanced badge to identify the logo.
   • CSearch the subject's name on LinkedIn to find conference attendance in their profile.
   • DUse a people search engine to find the subject's employer and then search for conferences that employer attends.
   Reveal Solution Discussion Select an answer first