Free practice exam
Online Intelligence Analyst (OIA) practice questions
Practise open-source intelligence basics: the collection cycle, safe investigative set-up, social media, images, domains and reporting.
These 15 questions are separate from the real OIA final exam, so you can see every answer here. Pick an option to check yourself, and use the chapter link to revise.
Score: 0 / 0 answered · 15 questions
1. In the intelligence cycle, what normally comes immediately before collection?
Answer: B. Planning and direction (defining the requirement)
You decide what question you are answering before you start gathering material; otherwise collection has no focus.
Study this in chapter 12. Which is the best description of open-source intelligence (OSINT)?
Answer: B. Analysed information drawn from publicly available sources
OSINT uses lawfully available public sources, and it becomes intelligence only after it is evaluated and analysed.
Study this in chapter 13. Why do investigators use a separate research browser or virtual machine?
Answer: B. It keeps personal accounts, cookies and identity separate from the investigation
Separation stops personal logins and tracking data leaking into the work and reduces the chance of tipping off a subject.
Study this in chapter 24. A subject can see who viewed their profile on a platform. What is the safest choice?
Answer: B. Use a properly set-up research account or a logged-out view, following your organisation's rules
Attributable viewing can alert a subject. Use approved research identities or logged-out access within policy.
Study this in chapter 25. An account was created last week, has 40,000 followers and almost no engagement. What does this most suggest?
Answer: B. Possible bought or bot followers — a reason to look closer
New accounts with large, inactive audiences often use purchased followers. It is a signal, not proof.
Study this in chapter 36. What should you record when capturing a social media post as evidence?
Answer: B. The URL, account handle, capture date/time and a full screenshot or archive
Source URL, handle and timestamp let others verify the capture later.
Study this in chapter 37. What is a reverse image search mainly used for?
Answer: B. Finding where else an image appears online and its earliest copies
It shows other places the image is published, which helps detect stolen or recycled photos.
Study this in chapter 48. Most social media platforms strip EXIF metadata from uploaded photos. What does this mean?
Answer: B. You usually cannot rely on embedded GPS data from a platform download
Stripped metadata pushes analysts to visual clues: signs, shadows, landmarks and weather.
Study this in chapter 49. When geolocating a photo, which clue is usually most reliable?
Answer: B. Fixed features such as street signs, building shapes and landmarks
Permanent physical features can be matched against maps and street imagery; captions can be false.
Study this in chapter 410. What does a WHOIS or RDAP lookup typically show?
Answer: B. Domain registration details such as registrar and creation date (often privacy-redacted)
Registration data, especially the creation date, helps judge whether a site is newly made for a scam.
Study this in chapter 511. Several scam sites share the same hosting IP and analytics ID. What does that suggest?
Answer: B. They may be linked infrastructure worth investigating together
Shared technical identifiers are pivots that can connect sites. They need corroboration before attribution.
Study this in chapter 512. What can certificate transparency logs help you find?
Answer: B. Other domains and subdomains that were issued TLS certificates
Public certificate logs list issued certificates, revealing related or lookalike domains.
Study this in chapter 513. Why is passive observation preferred when researching scam forums or chat groups?
Answer: B. Engaging can alert targets, create legal risk, and contaminate evidence
Interacting can change the subject's behaviour and may cross legal or policy lines.
Study this in chapter 614. Which phrasing best expresses analytic confidence?
Answer: B. "We assess with moderate confidence that these accounts are linked, based on shared wallet and wording."
Good reporting states a judgement, a confidence level, and the evidence behind it.
Study this in chapter 715. What is the main danger of confirmation bias in attribution?
Answer: B. Analysts favour evidence that fits their first theory and ignore what contradicts it
Testing alternative explanations protects against blaming the wrong person.
Study this in chapter 7
Ready for the real OIA final exam?
The final uses different questions drawn from the same chapters. Track your attempts and study material in your course portal.
Authoritative sources
Independent primary sources used to check and corroborate the guidance on this page.
NIST National Initiative for Cybersecurity Education (NICE)US national framework for cybersecurity work roles and competencies.
Financial Action Task Force (FATF)Global AML/CFT standards referenced by financial-crime curricula.
FBI Internet Crime Complaint Center — Annual ReportsPrimary loss and typology data used in fraud-investigation training.
US Federal Trade Commission — Consumer Sentinel Data BookOfficial complaint statistics for teaching fraud trend analysis.