Privacy and Operational Security Fundamentals GOSI Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An OSINT team is monitoring a threat actor who is known to use honeypots to identify researchers. The team needs to interact with the actor's infrastructure to gather intelligence. Which approach minimizes the risk of the team being identified?

   • AUse a cloud-based virtual desktop with a VPN and a single pseudonymous account for all team members.
   • BUse the team lead's personal laptop with a VPN and a pseudonymous account for all interactions.
   • CUse a fresh VM with a new identity, VPN, and browser fingerprint for each interaction, and avoid any personal data.
   • DUse a single dedicated research VM with a VPN and a unique browser fingerprint for all interactions.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Why is privacy important for an OSINT analyst during an investigation?

   • AIt guarantees that the analyst's personal data is never stored on any server
   • BIt ensures that all collected data is legally admissible in court
   • CIt allows the analyst to bypass legal restrictions on data collection
   • DIt prevents the target from discovering the investigation and adapting their behavior
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An OSINT analyst is investigating a data breach and finds a database containing personal information of thousands of individuals. The analyst is considering whether to download the database for analysis. Which action is most appropriate from a legal and ethical standpoint?

   • ADo not download the database; instead, document the exposure and report it to the relevant authorities.
   • BDownload the database and share it with other researchers for collaborative analysis.
   • CDownload the database and use it for analysis, but anonymize the data in any reports.
   • DDownload the database and use it to notify the affected individuals.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An OSINT analyst is investigating a sophisticated adversary who is known to monitor network traffic and use advanced correlation techniques. The analyst needs to access a dark web forum that requires JavaScript to be enabled. The analyst has a limited budget and cannot afford a dedicated server. Which approach provides the best balance of anonymity and functionality?

   • AUse the Tor Browser with JavaScript enabled, but disable browser fingerprinting protections.
   • BUse the Tor Browser with JavaScript disabled and use a public Wi-Fi network.
   • CUse a VPN to connect to a public Tor bridge, then use the Tor Browser with JavaScript enabled.
   • DUse a public proxy chain and disable JavaScript in the browser.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An OSINT analyst is collaborating with a colleague via email. The analyst needs to share a list of usernames and passwords for covert accounts. Which method is most secure for sharing this sensitive information?

   • AUse a password manager's secure sharing feature.
   • BWrite the list on a piece of paper and mail it.
   • CSend the list in an email with a password-protected attachment.
   • DSend the list via a messaging app without encryption.
   Reveal Solution Discussion Select an answer first