Privacy and Operational Security Fundamentals GOSI Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An OSINT analyst is investigating a case that involves a foreign government's activities. The analyst discovers that some of the required data is located on a website that is illegal to access in the analyst's jurisdiction. What is the most appropriate course of action?

   • AUse a public computer at a library to access the website, as it is not linked to the analyst's identity.
   • BAccess the website using Tor to bypass the legal restriction and collect the data.
   • CAsk a colleague in a different jurisdiction to access the website and share the data.
   • DDo not access the website; document the need for the data and seek legal advice from the organization's counsel.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A corporate OSINT team is collaborating on a sensitive investigation. They use a shared document repository and a group chat. Which practice most effectively reduces the risk of operational data leakage?

   • AUse end-to-end encrypted messaging and a repository with granular access controls and audit logging.
   • BRely on the corporate VPN for all communications and store files in a shared network drive.
   • CUse personal email accounts for quick updates and store final reports in a public cloud folder.
   • DCommunicate via a public social media direct message and use a shared USB drive for files.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An OSINT analyst is investigating a person of interest for a corporate background check. The analyst finds a social media profile that appears to belong to the person but is set to 'private'. The analyst is considering using a fake account to send a friend request to view the profile. Which action is most appropriate from a legal and ethical standpoint?

   • AUse a fake account with a plausible persona to send a friend request, as it is a common OSINT technique.
   • BDo not use a fake account; instead, rely only on publicly available information.
   • CContact the person directly and ask for access to their private profile.
   • DUse a third-party service that claims to provide access to private profiles.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An OSINT analyst is preparing to conduct an investigation on a sensitive topic. The analyst wants to ensure that their own personal information is not exposed during the investigation. Which practice is most effective in minimizing the analyst's personal data exposure?

   • AUse a dedicated research identity with a unique name, email, and phone number.
   • BUse a public computer at a library for all investigation activities.
   • CUse a VPN but keep the analyst's personal email for account registrations.
   • DUse the analyst's personal accounts but with strong passwords.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst needs to perform OSINT on a subject who is active on a social media platform that requires a phone number for verification. The analyst wants to avoid linking their real identity to the account. Which approach is most effective?

   • ASkip the phone verification and use a different platform that does not require a phone number.
   • BUse a virtual phone number service that provides a disposable number for account verification.
   • CUse the analyst's personal phone number but enable two-factor authentication for the account.
   • DBorrow a colleague's phone number for the verification process.
   Reveal Solution Discussion Select an answer first