ASIO Intelligence Officer Online Cognitive/Psychometric Assessment

A security briefing states: 'Foreign espionage activities targeting national research facilities have increased. However, this trend is only observed in facilities receiving federal grants.' Which of the following can be logically inferred from the statement?

• ANational research facilities that do not receive federal grants have not experienced an i…
• BFederal grants directly attract foreign espionage activities to research facilities.
• COnly facilities that receive federal grants are targeted by foreign espionage activities.
• DAll national research facilities receiving federal grants have experienced espionage.

Consider the following argument: 'If a cyber threat actor uses custom-built malware, they must possess significant financial backing. Actor Omega uses public, open-source penetration tools. Therefore, Actor Omega does not possess significant financial backing.' What is the logical flaw in this argument?

• AIt assumes that custom-built malware is the only indicator of significant financial backi…
• BIt conflates open-source penetration tools with malware.
• CIt assumes Actor Omega has no other cyber capabilities.
• DIt assumes that financial backing is required to obtain open-source tools.

A department policy states: 'All intelligence reports containing satellite imagery must be classified as Confidential unless they originate from a partner agency, in which case they must be classified as Secret.' An officer is reviewing a report that is classified as Confidential. Which of the following must be true?

• AThe report contains satellite imagery and does not originate from a partner agency.
• BIf the report contains satellite imagery, it does not originate from a partner agency.
• CThe report does not contain satellite imagery.
• DIf the report originates from a partner agency, it does not contain satellite imagery.

An analyst writes: 'We have seen a reduction in encrypted communications from Group X since the implementation of the new metadata tracking program. This proves the tracking program has deterred Group X from communicating.' Which of the following, if true, most seriously weakens the analyst's conclusion?

• AGroup X has migrated their communications to offline, physically secured couriers.
• BOther groups have increased their encrypted communications during the same period.
• CThe metadata tracking program is more expensive than originally budgeted.
• DGroup X continues to use encryption for 20% of their operational messages.

An intelligence assessment states: 'Most state-sponsored cyber attacks are designed to steal intellectual property, but some are purely disruptive. Attacks that target critical infrastructure are always purely disruptive.' If the statements above are true, which of the following must also be true?

• ANo state-sponsored cyber attacks targeting critical infrastructure are designed to steal…
• BSome disruptive state-sponsored cyber attacks do not target critical infrastructure.
• CAny state-sponsored cyber attack not targeting critical infrastructure is designed to ste…
• DSome state-sponsored cyber attacks that target critical infrastructure are also designed…

An internal report notes: 'All field operations in Region A require prior approval from the Director-General. Some operations in Region A involve active surveillance. No surveillance operation in Region B requires prior approval from the Director-General.' If these statements are true, which of the following cannot be true?

• AA field operation involving active surveillance in Region A was conducted without the Dir…
• BAn operation in Region B involving active surveillance was approved by the Director-Gener…
• CSome operations in Region A that do not involve active surveillance received approval.
• DNo operation in Region B is a field operation.

According to the travel security guide: 'Employees travelling to high-risk zones must log their itinerary daily. Employees travelling to low-risk zones are only required to report weekly.' If an employee did not report weekly, which of the following is true?

• AThey travelled to a high-risk zone.
• BThey did not travel to a low-risk zone.
• CIf they travelled to a low-risk zone, they did not meet its weekly reporting requirement.
• DThey travelled to a high-risk zone and logged their itinerary daily.

Evaluate the statement: 'Every time we intercept messages from Source Alpha, we observe a concurrent threat level escalation. This proves Source Alpha's messages are causing the escalations.' What is the primary analytical bias or error in this reasoning?

• ACorrelation is mistaken for causation.
• BConfirmation bias by only looking at Source Alpha.
• CAssuming Source Alpha has hostile intent.
• DOver-reliance on interception technology.

A protocol guide states: 'To maintain operational security, officers must either encrypt their communication logs or store them in a secure safe. If an officer chooses to encrypt their logs, they must use a government-approved algorithm.' If an officer stored their logs in a secure safe, which of the following is true?

• AThey did not encrypt their communication logs.
• BThey used a government-approved encryption algorithm.
• CThey complied with the protocol guide's requirements for maintaining operational security.
• DThey did not comply with the protocol guide because they did not use encryption.

An analysis states: 'All intelligence targets using encryption software Beta are foreign actors. No local residents use encryption software Beta.' If these statements are true, which of the following must also be true?

• AIf an intelligence target is a local resident, they do not use encryption software Beta.
• BNo foreign actors are local residents.
• CAll foreign actors use encryption software Beta.
• DIf an intelligence target is not a local resident, they use encryption software Beta.

A press release states: 'The cyber security initiative is successful because it has reduced network security incidents by 40% compared to last year.' Which of the following is an unstated assumption of the argument?

• AThe number of security incidents would not have decreased without the initiative.
• BA 40% reduction is the maximum possible improvement.
• CThe initiative cost less than the damage caused by the security incidents.
• DNetwork security incidents are the only threat to national cyber security.

An agency directive reads: 'Laptops containing restricted materials must not be connected to public Wi-Fi networks.' An officer connects their work laptop to a public Wi-Fi network. What can be logically concluded?

• AThe officer violated the agency directive.
• BThe laptop does not contain restricted materials.
• CIf the officer is in compliance with the directive, the laptop does not contain restricte…
• DThe officer is travelling overseas.

A summary states: 'Most targets under active surveillance communicate via alias accounts. Some targets under active surveillance are domestic citizens.' Which of the following must be true based on the summary?

• ASome domestic citizens under active surveillance communicate via alias accounts.
• BSome targets who communicate via alias accounts are domestic citizens.
• CIt is possible that no domestic citizens under active surveillance communicate via alias…
• DAll targets communicating via alias accounts are under active surveillance.

Consider the statement: 'If we do not increase funding for cyber defence, we will inevitably suffer a catastrophic infrastructure failure.' Which logical fallacy is most prominent in this statement?

• AFalse dilemma (either/or fallacy).
• BAd hominem.
• CCircular reasoning.
• DAppeal to authority.

A protocol states: 'Secure facilities must be locked at all times. Authorized staff can enter only if they present a valid badge.' An auditor finds that a secure facility was left unlocked for two hours. What can be concluded?

• AUnauthorized staff entered the facility.
• BThe protocol was violated.
• CAuthorized staff entered without badges.
• DThe badges of the staff were invalid.

An intelligence report notes: 'Suspect X was seen in Sydney on Monday. On Tuesday, they were seen in Melbourne. Suspect X only travels by train.' Which of the following is an assumption required by the report's details?

• AIt is possible to travel between Sydney and Melbourne by train within 24 hours.
• BSuspect X travelled by train between Sydney and Melbourne.
• CSuspect X did not stop in any other cities.
• DSuspect X was conducting operational activity.

A counter-intelligence guide says: 'If a foreign agent is active, they will attempt to contact their handler. If they contact their handler, our signal intelligence will detect it.' Signal intelligence did not detect any contacts. Which of the following is logically valid?

• ANo foreign agent is active.
• BIf a foreign agent is active, signal intelligence failed.
• CForeign agents are active but communicating through other means.
• DIf a foreign agent is active, they did not attempt to contact their handler.

An officer notes: 'Most personnel in Section 4 have access to Top Secret documents. Some personnel in Section 4 are contractors.' Which of the following is a possible scenario?

• ANo contractors in Section 4 have access to Top Secret documents.
• BAll contractors in Section 4 have access to Top Secret documents.
• CSome contractors in Section 4 have access to Top Secret documents.
• DAll of the options are possible scenarios.

An analysis reports: 'We observed a spike in network traffic at 03:00. This spike occurred shortly after a system update. Therefore, the system update caused the network spike.' What error is present in this deduction?

• AIt assumes temporal sequence implies a causal relationship.
• BIt assumes system updates always increase traffic.
• CIt ignores the possibility of network traffic spikes at other times.
• DIt conflates system updates with external cyber attacks.

An analyst writes: 'Either we monitor the target's financial transactions, or we monitor their phone records. If we monitor their phone records, we will obtain contact logs but not location data. We need location data.' Which of the following is a logically valid conclusion?

• AWe must monitor the target's financial transactions.
• BWe must monitor both phone records and financial transactions.
• CMonitoring financial transactions will guarantee location data.
• DWe should not monitor the target's phone records.

A protocol states: 'All intelligence assessments must be peer-reviewed before publication. If an assessment is fast-tracked, it must be approved by the Section Head.' If an intelligence assessment was published without approval from the Section Head, which of the following is true?

• AIt was not peer-reviewed.
• BIt was not fast-tracked.
• CIt violated the protocol guide.
• DIt was peer-reviewed and was not fast-tracked.

A review of a briefing notes: 'The presenter argued that foreign interference is rising because the number of investigations has doubled. This ignores the fact that the agency's budget and investigator headcount also doubled.' What is the logical flaw in the presenter's argument?

• AConflating investigations with actual incidents of interference.
• BAssuming budget increases cause foreign interference.
• CAssuming that all foreign interference leads to an investigation.
• DIgnoring the impact of new investigation technologies.

An instruction reads: 'Any visitor to the operations room must be accompanied by an escort. Escorts must be Class 1 officers.' If a visitor is in the operations room accompanied by a Class 2 officer, which of the following is true?

• AThe visitor is not allowed in the operations room.
• BThe Class 2 officer is violating the instruction.
• CThe operations room visitor policy has been breached.
• DThe Class 2 officer is acting as a Class 1 officer.

A regional threat review states: 'Threat Level High is declared only if there is a credible threat of violence. There is a credible threat of violence in Region C.' What can be concluded?

• ARegion C is at Threat Level High.
• BRegion C is not at Threat Level High.
• CThreat Level High may be declared in Region C.
• DA credible threat of violence always results in Threat Level High.

An officer states: 'All intelligence leaks must originate from either a staff member or a hack by an external actor. Our audit proved there was no external hack. Therefore, the leak originated from a staff member.' What is the unstated assumption of this argument?

• AThe audit was 100% accurate in detecting hacks.
• BStaff members are more likely to leak than external hackers.
• CThe leak could not have originated from an accidental disclosure by a partner agency.
• DBoth the audit accuracy and the completeness of the leak sources are assumed.

A cyber response team tracks the hourly frequency of unauthorized login attempts. On Day 1, they record: 08:00 (12 attempts), 09:00 (15 attempts), 10:00 (45 attempts), 11:00 (60 attempts), 12:00 (20 attempts). If the baseline hourly attempts are 10, which hour represents the highest percentage increase over the baseline?

• A10:00
• B11:00
• C12:00
• D09:00

An operational budget of $5,000,000 is split among four surveillance teams: Team Alpha receives 30%, Team Beta receives 25%, Team Gamma receives 20%, and Team Delta receives the remainder. How much funding does Team Delta receive?

• A$1,000,000
• B$1,250,000
• C$1,500,000
• D$750,000

A threat analyst studies the relationship between target visits to specific websites and subsequent data exfiltration events. Over 30 days, they compile: 15 visits to Site A resulted in 3 exfiltrations; 10 visits to Site B resulted in 5 exfiltrations; 20 visits to Site C resulted in 2 exfiltrations; 5 visits to Site D resulted in 1 exfiltration. Which site has the highest probability of resulting in exfiltration upon a visit?

• ASite A
• BSite B
• CSite C
• DSite D

A cryptographic shift code uses a pattern: the first character is shifted by +1, the second by -2, the third by +3, the fourth by -4, and so on. If the encoded message is 'J Z R O', what was the original four-letter word? (Note: A=1, B=2, ..., Z=26, wrapping around if necessary).

• AI B O S
• BK X O S
• CI B O R
• DK Y P T

The national threat level index is determined by averaging the indicators of three sectors: Aviation, Cyber, and Infrastructure. The ratings are scored from 1 (Low) to 5 (Critical). If Aviation is 4.0 and Cyber is 3.5, what minimum score must Infrastructure have to push the average threat level to at least 4.0?

• A4.0
• B4.5
• C5.0
• D3.5

A server network log shows the following payload sizes (in KB) for outgoing packets: 120, 125, 122, 980, 118, 124, 121. What is the median payload size, and does the data suggest an anomaly?

• A122 KB; Yes, 980 KB is a significant anomaly.
• B121 KB; No, all values are within normal limits.
• C122 KB; No, the mean is not affected by outliers.
• D124 KB; Yes, 118 KB is a significant anomaly.

An officer traces target contacts over a timeline: Contact A (09:15), Contact B (09:45), Contact C (10:30), Contact D (11:30). If the interval between contacts increases by 15 minutes each time, at what time should Contact E be expected?

• A12:45
• B12:30
• C13:00
• D12:15

A security grid covers a coordinate map. Target X moves from grid location (3, 4) to (6, 8). What is the straight-line distance (Euclidean distance) travelled by Target X on the grid?

• A7 units
• B5 units
• C12 units
• D25 units

A threat vulnerability matrix assigns risk scores based on Likelihood (1-5) multiplied by Impact (1-5). A vulnerability is rated 'Critical' if the score is 16 or higher. If a system has 4 vulnerabilities with the following (Likelihood, Impact) ratings: V1(4, 3), V2(3, 5), V3(5, 4), V4(2, 5), how many vulnerabilities are classified as Critical?

• A1
• B2
• C3
• D4

A sequence of secure access codes is generated: 11, 13, 17, 25, 41, X. What is the next number in this sequence?

• A57
• B73
• C65
• D82

An intelligence center tracks active cases across three states. NSW has 120 cases, VIC has 90 cases, and QLD has 60 cases. If the total analyst pool is 27, and analysts are distributed proportionally to the case counts, how many analysts should be assigned to NSW?

• A12
• B10
• C15
• D13

A tracking log records signal strengths from a transmitter over five test points: Pt 1 (-70 dBm), Pt 2 (-75 dBm), Pt 3 (-85 dBm), Pt 4 (-80 dBm), Pt 5 (-95 dBm). If signal strength decreases as distance increases, between which two consecutive test points did the transmitter move closest to the receiver?

• APt 2 and Pt 3
• BPt 3 and Pt 4
• CPt 4 and Pt 5
• DPt 1 and Pt 2

Three intercept stations detect the same radio frequency. Station X detects it 60% of the time, Station Y detects it 50% of the time, and Station Z detects it 40% of the time. If the detections are independent, what is the probability that at least one station detects the frequency at any given moment?

• A88%
• B92%
• C75%
• D95%

An intelligence storage facility uses cabinet groupings. Cabinet A holds 150 files, Cabinet B holds 120 files, and Cabinet C holds 90 files. If 20% of files from Cabinet A, 25% from Cabinet B, and 30% from Cabinet C are classified as Top Secret, how many Top Secret files are there in total?

• A87
• B75
• C93
• D102

A cryptographic parity key requires that every 8-bit block contains an even number of 1s (even parity). Which of the following blocks violates the parity rule?

• A10110011
• B11001100
• C01111000
• D11111111

A server tracks traffic volume (GB) over a week: Mon (5), Tue (6), Wed (15), Thu (5), Fri (6). What is the mean daily traffic, and which day represents the furthest deviation from this mean?

• A7.4 GB; Wednesday
• B6.0 GB; Wednesday
• C7.4 GB; Monday
• D8.0 GB; Friday

A surveillance aircraft has a range of 800 km on a full tank of fuel. If it consumes fuel at a rate of 12% per hour of flight, what is the maximum duration it can fly before it must return with a 10% fuel reserve?

• A7.5 hours
• B6.5 hours
• C8.3 hours
• D5.0 hours

An encryption pattern maps alphabet characters to numbers by their position, then adds a constant value K. If 'A' becomes 8, and 'E' becomes 12, what does the word 'CAB' become?

• A10, 8, 9
• B11, 8, 9
• C10, 8, 11
• D9, 8, 10

A department has two target watchlists: List 1 has 40 targets, List 2 has 30 targets. There are 15 targets that appear on both lists. How many unique targets are on the watchlists in total?

• A55
• B70
• C45
• D60

An officer compares average response times (in minutes) to emergency threat alerts across four units: Unit A (12 mins), Unit B (8 mins), Unit C (15 mins), Unit D (10 mins). What is the average response time across all four units?

• A11.25 minutes
• B12.00 minutes
• C10.50 minutes
• D11.50 minutes

A threat level probability matrix yields: P(cyber attack) = 0.30, and P(espionage attempt) = 0.50. If these events are mutually exclusive, what is the probability that either a cyber attack or an espionage attempt occurs?

• A0.80
• B0.15
• C0.65
• D0.50

A tracking beacon emits pings in a pattern: 3 seconds, 6 seconds, 12 seconds, 24 seconds. If the pattern continues, what is the total elapsed time after 6 pings have been emitted (including the first ping at 0 seconds)?

• A93 seconds
• B45 seconds
• C63 seconds
• D57 seconds