Searching, Collecting, and Processing Data GOSI Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An intelligence analyst is tasked with identifying the real identity behind a pseudonymous social media account that has been posting extremist content. The analyst has limited time and must decide between two approaches: (A) conduct a deep manual search across multiple platforms, or (B) use an automated tool that aggregates social media data. Which approach is most appropriate given the need for accuracy and legal compliance?

   • AConduct a manual search because it allows for careful evaluation of source reliability and legal considerations.
   • BUse the automated tool because it is faster and can cover more sources.
   • CUse both approaches in parallel, with the automated tool for broad collection and manual analysis for verification.
   • DRely solely on the automated tool's output because it is unbiased.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is evaluating sources for a report on a recent cyber incident. The analyst has the following sources: a blog post by an unknown researcher, a statement from the affected company, a news article from a reputable outlet, and a tweet from a self-proclaimed hacker. Which source should be considered the most reliable for factual details about the incident?

   • AThe tweet, because it is real-time information.
   • BThe news article, because it is from a reputable outlet.
   • CThe company statement, because it is the affected organization's official communication.
   • DThe blog post, because it provides technical details.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An analyst has collected data from multiple sources about a cybercriminal. The data includes usernames, email addresses, IP addresses, and timestamps from different forums and logs. The analyst needs to create a timeline of the criminal's activities. What is the most important step in processing this data?

   • ASort the data by username to group activities by person.
   • BRemove any duplicate entries to reduce data volume.
   • CNormalize all timestamps to a single timezone and standard format.
   • DConvert all IP addresses to a consistent format.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is evaluating sources for a report on a recent data breach. They find a tweet from a self-proclaimed security researcher, a blog post from a well-known cybersecurity firm, and a forum post from an anonymous user. Which source should be given the most weight in the report?

   • AThe blog post from the well-known cybersecurity firm, because it is likely to be more reliable and vetted.
   • BThe forum post from the anonymous user, because it provides a different perspective.
   • CAll sources equally, because they all provide information about the breach.
   • DThe tweet from the self-proclaimed researcher, because it was posted first.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An investigator is searching for information about a specific individual who has a common name. The investigator knows the person's profession (engineer) and city (Austin). They want to find the person's social media profiles but exclude results from other people with the same name. Which search strategy would be most effective?

   • AUse a people-search website that aggregates public records and social media profiles.
   • BSearch for the person's name in quotes along with 'engineer' and 'Austin' on a general search engine.
   • CSearch for the person's name without quotes and browse through all results.
   • DUse site-specific searches on social media platforms (e.g., site:twitter.com "John Smith" engineer Austin) and Boolean operators to refine results.
   Reveal Solution Discussion Select an answer first