OSINT and International Environment GSOA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is monitoring a separatist movement that has a history of peaceful protests but recently began using more aggressive language online. The movement's leaders have started calling for 'direct action' against government buildings, and some members have posted photos of themselves with weapons. Which factor most strongly indicates an increased risk of violence?

   • AThe movement's history of peaceful protests.
   • BThe movement's focus on government buildings as targets.
   • CThe movement's use of aggressive language online.
   • DThe leaders' calls for 'direct action' combined with members' display of weapons.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A corporate security team is assessing a journalist who has been critical of the company's operations in a foreign country. The journalist's public posts show they recently attended a protest against the company, and they have shared documents that appear to be internal company emails. The emails have not been verified. What is the most appropriate next step for the analyst?

   • AAssess the journalist's credibility and the authenticity of the emails before making any judgments about risk.
   • BTreat the journalist as a high-risk individual because they attended a protest and shared internal documents.
   • CImmediately report the journalist to local authorities for leaking internal documents.
   • DIgnore the journalist's posts because they are a public figure and their actions are protected by free speech.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst is preparing a report on a protest group. The analyst has found a blog post that claims the group is planning a violent action, but the blog is known for sensationalism and has no byline. How should the analyst treat this information?

   • ATreat it as unverified and seek corroboration from multiple independent sources before including it.
   • BInclude it as a warning because the potential for violence outweighs the need for verification.
   • CIgnore it entirely because the blog is sensationalist and therefore always false.
   • DUse it as the primary source because it is the only one discussing the group's plans.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is investigating a coordinated disinformation campaign that uses deepfake videos of a political candidate. The analyst has identified a network of accounts that share the videos, but the origin of the videos is unclear. The analyst must decide whether to focus on tracing the video origin or on analyzing the network's behavior. Which choice is more likely to yield actionable intelligence?

   • AAnalyze the network's behavior to identify patterns of coordination and potential attribution clues.
   • BIgnore the network and focus on the content of the videos to understand the narrative.
   • CReport the videos to social media platforms and wait for them to take action.
   • DFocus on deepfake forensics to identify the exact software used, which will reveal the creator.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which pattern is a common tactic used in disinformation campaigns to create the illusion of widespread support or opposition?

   • APublishing corrections after factual errors are identified
   • BCoordinated inauthentic behavior, such as bot networks posting identical messages
   • CEngaging in direct conversations with opposing viewpoints
   • DUsing verified accounts to share personal opinions
   Reveal Solution Discussion Select an answer first