Free SMIA Practice Questions

Question 1

A video captioned "Explosion at the freight terminal this morning" spreads across three social networks. An analyst matches the complete scene to a transport authority video published two years earlier, including the same vehicle movements and smoke pattern. No independent evidence of today's alleged explosion has been found. Which conclusion is justified by the match?

Accepted Answer

The video is recycled and does not substantiate an explosion there today.

Answer

The earlier video disproves today's report of a terminal explosion.

Answer

Its circulation on three networks independently corroborates the current incident.

Answer

The current uploader deliberately fabricated the incident, as demonstrated by the reused footage.

Question 2

Two alert filters are tested on the same 1,000 public posts, of which independent review identifies 60 as relevant threats. Filter P flags 180 posts and captures 57 of the 60 threats. Filter Q flags 90 posts and captures 54 of the 60 threats. Before a monitored pilot, the team requires at least 85% recall and no more than 120 posts requiring review in this test. What recommendation follows from these results?

Accepted Answer

Pilot Q: 90% recall and a 90-post review queue meet both pilot requirements.

Answer

Pilot P: its higher recall compensates for exceeding the review limit.

Answer

Reject Q: its 60% recall fails the required detection target.

Answer

Pilot either: both capture enough relevant posts to meet the requirements.

Question 3

An EU corporate-security team has documented a valid GDPR lawful basis for a narrowly scoped investigation. It replaces account names with random codes and keeps the re-identification key separately under access controls. The team can still reconnect each code to a person. How does this affect the handling of the coded dataset?

Accepted Answer

It is pseudonymized personal data, so applicable GDPR safeguards still apply.

Answer

It is anonymous if the separate lookup key is encrypted.

Answer

Further analysis must wait for individual consent because re-identification remains possible.

Answer

The team may drop retention limits when analytical exports omit the lookup key.

Question 4

The conference director asks, "Do we need to move registration before doors open at 14:00?" Public posts discuss blocking the south entrance, but some may refer to last month's protest. Registration is currently planned for that entrance. With two hours available for an authorized review of public material, which intelligence requirement should guide collection?

Accepted Answer

Assess whether a credible blockade is planned for the south entrance before today's opening.

Answer

Measure the month's total negative mentions of the conference and rank platforms by posting volume.

Answer

Identify the most-followed account discussing the conference and summarize its recent online activity.

Answer

Map accounts involved in previous protests and estimate which users have the widest online reach.

Question 5

A romance-fraud complainant provides her original phone and a newly linked tablet for an authorized examination. Telegram Cloud Chats appear on both devices. The disputed payment demands remain visible in a Secret Chat on the phone but are absent from the tablet; the examiner verifies that both devices use the same account. What best explains the discrepancy?

Accepted Answer

Secret Chats are device-specific rather than part of Telegram's cloud synchronization.

Answer

The phone holds a cached remnant of a chat deleted from Telegram's cloud.

Answer

Secret Chat history synchronizes separately after the tablet retrieves the phone's encryption keys.

Answer

Telegram synchronizes Secret Chats only from the moment an additional device is linked.

Question 6

The platform being examined keeps an account's numeric ID unchanged when its handle changes. On 12 June, ID 48172 uses @CivicMonitor. On 29 June, ID 48172 uses @CivicArchive, while ID 90518 now uses @CivicMonitor. The profile photographs also differ. When reconciling these captures, the analyst should:

Accepted Answer

Record a handle change for ID 48172 and keep ID 90518 separate.

Answer

Assign the 12 June posts to ID 90518 because it now holds the handle shown on those posts.

Answer

Treat the changed handle and photograph on ID 48172 as evidence that a replacement account was created.

Answer

Merge IDs 48172 and 90518 as one operator because both have used the same distinctive handle.

Question 7

On an Intel-based Mac, an analyst is configuring two Oracle VirtualBox 7.1 guests to exchange synthetic test data. Neither guest should have a network path to the host, physical LAN, or internet. Each guest has one enabled adapter, and no additional routing or firewall rules will be used. Which arrangement meets the network requirement?

Accepted Answer

Use a shared Internal Network for both guests.

Answer

Use Host-Only Networking on both guests.

Answer

Use one NAT Network without port forwarding.

Answer

Bridge each guest to the Mac's physical network adapter.

Question 8

A covered U.S. service provider tells a federal investigator that records for an identified account are scheduled for deletion in 48 hours. The investigator is preparing the legal process needed to obtain the records; no danger of death or serious physical injury is involved. Which immediate step can preserve existing records without itself authorizing their disclosure?

Accepted Answer

Send a §2703(f) preservation request while pursuing appropriate disclosure process.

Answer

Await the warrant before requesting any retention.

Answer

Seek emergency disclosure under §2702 solely because the records face deletion.

Answer

Request basic subscriber data, assuming this also preserves the account's message content.

Question 9

A previously unassessed account reports that a courthouse entrance has closed. Independently obtained live-camera footage and an access-control log confirm the closure; neither depends on the post. No information establishes the account's past reliability. Assign the source-reliability/information-credibility rating using the Admiralty A-F/1-6 system.

Accepted Answer

F1

Answer

A1

Answer

E1

Answer

F6

Question 10

An allegation says a public post warned of a theft before it occurred. The verified post-creation timestamp is 2026-06-14T23:50:00-04:00; the synchronized warehouse log places the theft at 2026-06-15T03:20:00Z. Both records are accurate to the minute, and neither is a later edit or collection timestamp. Which timeline finding addresses the allegation?

Accepted Answer

The post followed the theft by 30 minutes and does not establish advance warning.

Answer

The post preceded the theft by 3 hours 30 minutes.

Answer

The post followed the theft by 30 minutes, proving its author had no advance knowledge.

Answer

The post preceded the theft by 7 hours 30 minutes.

Free SMIA Practice Questions

Domain 2: The intelligence cycle

Question 1

Question 2

Domain 4: Secure research environments

Question 3

Domain 5: Social media investigations

Question 4

Domain 6: Advanced platform research

Question 5

Question 6

Domain 7: Mobile forensics

Question 7

Question 8

Domain 9: Legal fundamentals

Question 9

Domain 10: Investigative case-file preparation

Question 10

The rest of the SMIA blueprint

That's 10 of 1,030