National Criminal Intelligence Certification (NCIC) — Questions and Answers

Question 1: An intelligence professional who accepts gifts or meals from a confidential informant is most at risk of violating which ethical principle?

Information compartmentalization
Source validation
Independence and impartiality / conflict of interest rules (Correct answer)
Chain of custody

Correct answer: Independence and impartiality / conflict of interest rules

Accepting gifts from sources compromises independence, creates obligations, and violates conflict-of-interest standards.

Question 2: Which body has primary jurisdiction to review FBI intelligence activities for compliance with legal authorities and department policies?

The DOJ Office of the Inspector General (OIG) (Correct answer)
The Senate Intelligence Committee
The Government Accountability Office (GAO)
The President's Intelligence Advisory Board

Correct answer: The DOJ Office of the Inspector General (OIG)

The DOJ OIG has jurisdiction and authority to review FBI intelligence activities for compliance with department policies and legal mandates.

Question 3: In the context of national criminal intelligence, which principle most directly governs legal standards & information sharing practices?

Applying evidence-based methodologies with peer-reviewed support (Correct answer)
Relying exclusively on vendor-provided solutions
Following popular trends without evaluating their applicability
Using trial-and-error without systematic documentation

Correct answer: Applying evidence-based methodologies with peer-reviewed support

Applying evidence-based methodologies with peer-reviewed support is the correct approach because effective legal standards & information sharing in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 4: What is the primary function of a fusion center in the intelligence-led policing model?

A secure facility for evidence storage
A collaborative information-sharing hub integrating intelligence from multiple federal, state, local, and private sector agencies (Correct answer)
A central dispatch center for law enforcement communications
A type of forensic laboratory for evidence analysis

Correct answer: A collaborative information-sharing hub integrating intelligence from multiple federal, state, local, and private sector agencies

Fusion centers are state and major urban area information-sharing hubs that integrate intelligence from federal, state, local, and private sector partners.

Question 5: An intelligence professional who uses their access to law enforcement databases to look up information on a personal acquaintance without a legitimate work purpose is violating which ethical principle?

Source protection
Separation of duties
Chain of custody
Authorized use / least privilege (Correct answer)

Correct answer: Authorized use / least privilege

Authorized use requires that database access be limited strictly to legitimate law enforcement purposes, not personal inquiries.

Question 6: What is the primary challenge that end-to-end encryption presents for criminal intelligence collection?

It ensures that digital evidence is automatically admissible in court
It makes digital evidence easier to process in the field
It prevents unauthorized parties, including law enforcement, from accessing the content of intercepted communications (Correct answer)
It automatically flags criminal communications for analyst review

Correct answer: It prevents unauthorized parties, including law enforcement, from accessing the content of intercepted communications

End-to-end encryption ensures only communicating parties can access message content, creating a 'going dark' challenge for law enforcement attempting lawful interception.

Question 7: Which agency primarily oversees interagency intelligence collaboration in the U.S.?

Fusion Centers (Correct answer)
Occupational Safety and Health Administration
National Parks Service
Department of Education

Correct answer: Fusion Centers

Fusion centers facilitate intelligence sharing between federal, state, and local agencies, improving coordinated responses.

Question 8: Which scenario would require a national criminal intelligence professional to escalate a data collection & analytical techniques concern?

Collecting feedback only during formal review periods
Creating feedback mechanisms that encourage continuous improvement (Correct answer)
Using feedback solely for personnel evaluations
Discouraging critical feedback to maintain team morale

Correct answer: Creating feedback mechanisms that encourage continuous improvement

Creating feedback mechanisms that encourage continuous improvement is the correct approach because effective data collection & analytical techniques in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 9: Which document most directly governs federal intelligence community ethical standards and is commonly referenced in the NCIC certification framework?

The Freedom of Information Act
Intelligence Community Directive (ICD) 700 series and associated ethics frameworks (Correct answer)
The Classified Information Procedures Act
The Hatch Act

Correct answer: Intelligence Community Directive (ICD) 700 series and associated ethics frameworks

The ICD 700 series establishes core ethics, conduct, and security standards across the U.S. Intelligence Community.

Question 10: Which of the following is a key performance indicator for evaluating communication & stakeholder engagement effectiveness?

Focusing only on tasks with immediate financial implications
Addressing the most recent issue first regardless of severity
Prioritizing based on risk assessment and potential impact (Correct answer)
Treating all tasks with equal urgency regardless of impact

Correct answer: Prioritizing based on risk assessment and potential impact

Prioritizing based on risk assessment and potential impact is the correct approach because effective communication & stakeholder engagement in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 11: Which of the following is a key performance indicator for evaluating risk management & mitigation effectiveness?

Prioritizing based on risk assessment and potential impact (Correct answer)
Focusing only on tasks with immediate financial implications
Treating all tasks with equal urgency regardless of impact
Addressing the most recent issue first regardless of severity

Correct answer: Prioritizing based on risk assessment and potential impact

Prioritizing based on risk assessment and potential impact is the correct approach because effective risk management & mitigation in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 12: A criminal intelligence database record is more than five years old with no recent corroboration. Under 28 CFR Part 23 quality standards, the record should most likely be:

Evaluated for purging unless current information justifies continued retention (Correct answer)
Reclassified and transferred to a public law enforcement database
Retained indefinitely as historical reference material
Immediately forwarded to federal authorities for review

Correct answer: Evaluated for purging unless current information justifies continued retention

28 CFR Part 23's five-year review cycle requires that stale, uncorroborated records be purged unless there is current justification for retention.

Question 13: A stakeholder questions the value of professional ethics & standards initiatives. Which response best demonstrates ROI?

Distributing accountability so widely that no one is responsible
Building a culture of accountability with transparent reporting (Correct answer)
Avoiding accountability discussions to prevent conflict
Centralizing accountability with a single individual

Correct answer: Building a culture of accountability with transparent reporting

Building a culture of accountability with transparent reporting is the correct approach because effective professional ethics & standards in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 14: A national criminal intelligence professional discovers a discrepancy during risk management & mitigation review. What is the most appropriate immediate action?

Working independently to avoid conflicting opinions
Limiting communication to written reports only
Engaging stakeholders collaboratively to align goals and expectations (Correct answer)
Accepting all stakeholder requests without prioritization

Correct answer: Engaging stakeholders collaboratively to align goals and expectations

Engaging stakeholders collaboratively to align goals and expectations is the correct approach because effective risk management & mitigation in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 15: In ILP, what is the purpose of an 'after-action review' following an operation?

To brief media representatives on completed law enforcement operations
To process and catalog recovered criminal evidence
To evaluate operational outcomes and identify lessons learned to improve future operations (Correct answer)
To formally discipline officers who made operational mistakes

Correct answer: To evaluate operational outcomes and identify lessons learned to improve future operations

An after-action review systematically evaluates an operation's execution and outcomes to capture lessons learned and improve future planning and performance.

Question 16: What is the primary purpose of crime series analysis in ILP?

To measure public satisfaction with police services
To track individual officer productivity metrics
To identify behavioral patterns linking multiple crimes to a common offender or group (Correct answer)
To count the total number of crimes in a jurisdiction

Correct answer: To identify behavioral patterns linking multiple crimes to a common offender or group

Crime series analysis identifies behavioral patterns and modus operandi that link multiple incidents to a common offender or criminal group.

Question 17: What is the role of a 'hash value' in digital evidence verification?

To generate a unique digital fingerprint verifying that a file's content has not been altered (Correct answer)
To encrypt classified intelligence reports for secure transmission
To identify the author of an anonymous online communication
To compress large data files for more efficient storage

Correct answer: To generate a unique digital fingerprint verifying that a file's content has not been altered

A hash value is a unique alphanumeric string generated from a file's contents that verifies its integrity — any alteration to the file produces a completely different hash value.

Question 18: When intelligence sharing reveals a conflict between two agencies' priorities on the same criminal target, the BEST course of action is to:

Both agencies independently pursue their investigations without coordination
Convene a deconfliction meeting to coordinate investigative activities and avoid operational conflicts (Correct answer)
The agency with higher federal authority automatically takes precedence
Immediately notify the media to pressure a resolution

Correct answer: Convene a deconfliction meeting to coordinate investigative activities and avoid operational conflicts

Deconfliction processes exist specifically to resolve jurisdictional conflicts and prevent agencies from inadvertently interfering with each other's operations.

Question 19: Which crime prevention approach modifies the physical environment to reduce criminal opportunities and increase natural surveillance?

Crime Prevention Through Environmental Design (CPTED) (Correct answer)
Directed patrol strategy
Zero tolerance enforcement
Intelligence-driven targeting

Correct answer: Crime Prevention Through Environmental Design (CPTED)

Crime Prevention Through Environmental Design (CPTED) uses architectural and urban design principles to reduce crime opportunities and enhance natural surveillance.

Question 20: A new regulation impacts legal standards & information sharing procedures. What should a NCIC professional do first?

Complying only with regulations that have enforcement mechanisms
Ensuring compliance with current regulatory requirements and standards (Correct answer)
Delegating compliance oversight to administrative staff
Interpreting regulations loosely to allow maximum flexibility

Correct answer: Ensuring compliance with current regulatory requirements and standards

Ensuring compliance with current regulatory requirements and standards is the correct approach because effective legal standards & information sharing in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 21: Which of the following BEST describes the difference between a threat assessment and a risk assessment?

Risk assessments focus only on natural disasters; threat assessments focus on criminal activity
Threat assessments are classified; risk assessments are always unclassified
Threat assessments are conducted by federal agencies only
A threat assessment evaluates the adversary's intent and capability, while a risk assessment also incorporates vulnerability and potential consequences (Correct answer)

Correct answer: A threat assessment evaluates the adversary's intent and capability, while a risk assessment also incorporates vulnerability and potential consequences

Threat assessment examines who wants to cause harm and whether they can; risk assessment adds vulnerability analysis and impact estimation to produce an overall risk picture.

Question 22: Which analysis technique identifies the geographic center of a serial offender's activity to predict their base of operations?

Content analysis
Network analysis
Link analysis
Geographic profiling (Correct answer)

Correct answer: Geographic profiling

Geographic profiling analyzes crime scene locations to identify the most probable base of operations or anchor point for a serial offender.

Question 23: What is the significance of the 'broken windows' theory to proactive intelligence-led policing?

It provides a framework for analyzing digital cybercrimes
It explains how glass-related crime scenes are forensically processed
It describes how criminal network hierarchies are structured
It suggests that visible signs of disorder signal low social control, encouraging more serious criminal activity if unaddressed (Correct answer)

Correct answer: It suggests that visible signs of disorder signal low social control, encouraging more serious criminal activity if unaddressed

The broken windows theory by Wilson and Kelling suggests that visible signs of disorder signal low social control, encouraging escalation to more serious crime if left unaddressed.

Question 24: Which tool or methodology is most appropriate for analyzing legal standards & information sharing outcomes?

Adjusting boundaries based on individual situations without guidelines
Maintaining strict formality that inhibits collaboration
Prioritizing relationships over professional standards
Maintaining professional boundaries while building collaborative relationships (Correct answer)

Correct answer: Maintaining professional boundaries while building collaborative relationships

Maintaining professional boundaries while building collaborative relationships is the correct approach because effective legal standards & information sharing in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 25: A stakeholder questions the value of quality assurance & compliance initiatives. Which response best demonstrates ROI?

Centralizing accountability with a single individual
Avoiding accountability discussions to prevent conflict
Distributing accountability so widely that no one is responsible
Building a culture of accountability with transparent reporting (Correct answer)

Correct answer: Building a culture of accountability with transparent reporting

Building a culture of accountability with transparent reporting is the correct approach because effective quality assurance & compliance in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 26: What is the primary purpose of an 'Intelligence Requirements' document?

To list all classified intelligence products available within an agency
To document the legal authority under which intelligence operations are conducted
To record the mandatory training requirements for all intelligence analysts
To formally define the priority intelligence questions that guide collection and analytical efforts (Correct answer)

Correct answer: To formally define the priority intelligence questions that guide collection and analytical efforts

Intelligence Requirements documents formally define priority intelligence questions and information gaps that drive collection and analytical efforts to meet the specific needs of decision-makers.

Question 27: What type of intelligence product would be most appropriate for briefing senior leadership on a significant emerging criminal threat?

A detailed chain-of-custody document for physical evidence
A raw field observation report from a street-level officer
A surveillance authorization request form
An executive intelligence brief or senior leadership assessment (Correct answer)

Correct answer: An executive intelligence brief or senior leadership assessment

Executive intelligence briefs are tailored, concise products designed specifically for senior leadership consumption, delivering key findings and recommendations without excessive technical detail.

Question 28: An analyst rates a source as 'B-2' on an alphanumeric reliability matrix. What does this typically indicate?

The source is untested and information cannot be judged
The source is completely reliable and information is confirmed
The source is unreliable and information is improbable
The source is usually reliable and information is probably true (Correct answer)

Correct answer: The source is usually reliable and information is probably true

In the standard intelligence rating matrix, 'B' denotes a usually reliable source and '2' indicates the information is probably true.

Question 29: Which of the following is a key performance indicator for evaluating professional ethics & standards effectiveness?

Prioritizing based on risk assessment and potential impact (Correct answer)
Addressing the most recent issue first regardless of severity
Focusing only on tasks with immediate financial implications
Treating all tasks with equal urgency regardless of impact

Correct answer: Prioritizing based on risk assessment and potential impact

Prioritizing based on risk assessment and potential impact is the correct approach because effective professional ethics & standards in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 30: Which of the following best characterizes the ethical obligation of 'stewardship' in criminal intelligence?

Maintaining physical security of intelligence facilities
Mentoring junior analysts in technical skills
Acting as a responsible guardian of sensitive information, ensuring it is used lawfully and protected from unauthorized disclosure (Correct answer)
Protecting agency budget resources from misuse

Correct answer: Acting as a responsible guardian of sensitive information, ensuring it is used lawfully and protected from unauthorized disclosure

Stewardship means treating sensitive information as a trust and ensuring it is handled lawfully, securely, and for its intended purpose.

Question 31: When conducting OSINT on social media platforms, which legal principle must intelligence analysts observe?

All findings must be independently verified by two separate sources before use
All collected content must be translated into English before use as evidence
Information must only be collected from publicly accessible sources without unauthorized access or terms of service violations (Correct answer)
Social media posts cannot legally be used as criminal evidence in US courts

Correct answer: Information must only be collected from publicly accessible sources without unauthorized access or terms of service violations

Analysts must collect OSINT only from publicly accessible information without unauthorized access, as accessing private accounts without authorization can violate ECPA.

Question 32: What is the risk of sharing unvetted intelligence data?

It can result in misinformation and legal issues (Correct answer)
It streamlines workflows
It enhances cooperation
It increases analytical speed

Correct answer: It can result in misinformation and legal issues

Disseminating unverified information can lead to false accusations, operational failures, and legal consequences.

Question 33: What is the recommended frequency for reviewing and updating legal standards & information sharing protocols?

Monitoring outcomes through regular data collection and trend analysis (Correct answer)
Relying on periodic external audits as the sole evaluation method
Reviewing results only at year-end
Tracking activity volume without measuring quality

Correct answer: Monitoring outcomes through regular data collection and trend analysis

Monitoring outcomes through regular data collection and trend analysis is the correct approach because effective legal standards & information sharing in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 34: In criminal intelligence, 'collateral confirmation' refers to which of the following?

Information from a separate independent source that supports the primary intelligence (Correct answer)
Written authorization from a prosecuting attorney
Surveillance conducted by a secondary investigative unit
A supervisor's formal endorsement of an analyst's assessment

Correct answer: Information from a separate independent source that supports the primary intelligence

Collateral confirmation is independent corroboration that increases analytical confidence in the accuracy of collected intelligence.

Question 35: What is the main purpose of 28 CFR Part 23 in criminal intelligence?

It outlines training protocols for law enforcement
It governs the legality of intelligence databases (Correct answer)
It mandates open access to all intelligence records
It defines arrest procedures

Correct answer: It governs the legality of intelligence databases

28 CFR Part 23 sets guidelines for handling criminal intelligence to protect individual privacy and ensure lawful collection and sharing.

Question 36: The 28 CFR Part 23 regulation primarily governs:

Federal wiretap authorization procedures
Homeland security information sharing protocols
Operation of multijurisdictional criminal intelligence systems (Correct answer)
Confidential informant management standards

Correct answer: Operation of multijurisdictional criminal intelligence systems

28 CFR Part 23 establishes operating principles for multijurisdictional criminal intelligence systems receiving federal funding.

Question 37: What is the primary objective of risk management & mitigation within the NCIC professional framework?

Relying on informal observations and anecdotal reports
Analyzing data systematically using validated assessment tools (Correct answer)
Making assumptions based on previous experience alone
Copying approaches used by competitors without adaptation

Correct answer: Analyzing data systematically using validated assessment tools

Analyzing data systematically using validated assessment tools is the correct approach because effective risk management & mitigation in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 38: What are 'indicators of compromise' (IOCs) in cybersecurity intelligence?

Artifacts or behavioral patterns that indicate a system has been breached or targeted by malicious activity (Correct answer)
Physical evidence of computer hardware theft from an organization
Warning signs used to identify potential officer misconduct
Legal standards used to determine the admissibility of digital evidence

Correct answer: Artifacts or behavioral patterns that indicate a system has been breached or targeted by malicious activity

Indicators of compromise are forensic artifacts — such as malicious IP addresses, file hashes, or behavioral patterns — that indicate a system has been compromised by malicious activity.

Question 39: What is 'geofencing' as an investigative tool in digital intelligence?

Mapping the territorial boundaries of rival criminal gangs
Blocking online access to criminal websites and forums
Installing physical security barriers around sensitive crime scenes
Using location data to identify devices present within a specific geographic area during a specified time period (Correct answer)

Correct answer: Using location data to identify devices present within a specific geographic area during a specified time period

Geofencing uses location data to identify all devices present within a defined geographic boundary during a specific time period, generating investigative leads.

Question 40: What is a Strategic Intelligence Assessment primarily used for?

Providing real-time tactical guidance to officers in the field
Documenting individual criminal incidents for case files
Identifying long-term trends and patterns to support policy and resource decisions (Correct answer)
Issuing immediate warnings about active threats

Correct answer: Identifying long-term trends and patterns to support policy and resource decisions

Strategic intelligence assessments analyze long-term trends and patterns to inform policy decisions and resource allocation at the organizational level.

Question 41: A stakeholder questions the value of risk management & mitigation initiatives. Which response best demonstrates ROI?

Avoiding accountability discussions to prevent conflict
Centralizing accountability with a single individual
Building a culture of accountability with transparent reporting (Correct answer)
Distributing accountability so widely that no one is responsible

Correct answer: Building a culture of accountability with transparent reporting

Building a culture of accountability with transparent reporting is the correct approach because effective risk management & mitigation in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 42: Which type of source is considered open-source intelligence (OSINT)?

Confidential informant tips
Social media posts (Correct answer)
Encrypted emails
Intercepted phone calls

Correct answer: Social media posts

Open-source intelligence includes publicly available information like newspapers, websites, and social media.

Question 43: What is 'problem-oriented policing' (POP) as it relates to ILP?

Solving previously uncleared cold cases
Managing internal department personnel conflicts
Addressing the underlying conditions that cause recurring crime problems rather than just individual incidents (Correct answer)
Focusing on investigating officer misconduct issues

Correct answer: Addressing the underlying conditions that cause recurring crime problems rather than just individual incidents

Problem-oriented policing focuses on identifying and addressing the root causes and conditions that enable recurring crime problems, not just responding to incidents.

Question 44: During a 28 CFR Part 23 compliance audit, records are discovered that lack documented reasonable suspicion. The required corrective action is to:

Purge the noncompliant records from the criminal intelligence system (Correct answer)
Transfer the records to a general law enforcement database outside the system
Add a retroactive reasonable suspicion justification signed by a supervisor
Freeze the records pending guidance from the federal grantor agency

Correct answer: Purge the noncompliant records from the criminal intelligence system

Records that cannot be justified under the reasonable suspicion standard must be purged; they cannot be retroactively legitimized through added justifications.

Question 45: What is the primary role of a designated privacy officer at a fusion center?

Ensuring center activities comply with privacy laws and civil rights and civil liberties protections (Correct answer)
Managing public communications and media relations for the center
Processing Freedom of Information Act requests submitted by the general public
Enforcing cybersecurity protocols for the center's information technology systems

Correct answer: Ensuring center activities comply with privacy laws and civil rights and civil liberties protections

Privacy officers at fusion centers ensure all intelligence activities comply with applicable privacy statutes and civil liberties protections, as mandated by DHS.

Question 46: What is a 'hot spot' in the context of crime analysis for intelligence-led policing?

A suspect with multiple outstanding warrants
A geographic area with a high concentration of criminal activity (Correct answer)
A recently solved cold case
An informant with valuable intelligence

Correct answer: A geographic area with a high concentration of criminal activity

A hot spot is a geographic location with a disproportionately high concentration of criminal incidents compared to surrounding areas.

Question 47: What is the role of an intelligence analyst in a CompStat meeting?

To conduct undercover operations
To conduct interviews with crime victims
To provide data-driven briefings on crime trends and patterns to inform command decisions (Correct answer)
To make arrests based on crime data

Correct answer: To provide data-driven briefings on crime trends and patterns to inform command decisions

In CompStat meetings, analysts present crime statistics and pattern analysis to help commanders make informed, data-driven operational decisions.

Question 48: A fusion center analyst proposes including information about a U.S. citizen's lawful political activities in an intelligence report. Under PCRCL compliance standards, this is:

Allowed only with approval from a federal judge
Acceptable to provide contextual background for the report
Permitted if the citizen is suspected of any criminal offense
Generally prohibited unless the activity is directly linked to criminal conduct (Correct answer)

Correct answer: Generally prohibited unless the activity is directly linked to criminal conduct

Collecting or retaining information about lawful political activities of U.S. persons violates First Amendment protections and civil liberties compliance requirements.

Question 49: In intelligence-led policing, what does 'scanning' refer to within the SARA problem-solving model?

Identifying and prioritizing recurring problems or crime patterns (Correct answer)
Running criminal background checks on suspects
Reviewing surveillance footage from cameras
Conducting physical surveillance of persons of interest

Correct answer: Identifying and prioritizing recurring problems or crime patterns

In the SARA model, scanning involves identifying and prioritizing recurring problems that may benefit from a problem-oriented policing response.

Question 50: Which ILP strategy uses intelligence to disrupt criminal networks by targeting key nodes rather than only individual offenders?

Directed patrol
Zero tolerance policing
Community policing
Network disruption strategy (Correct answer)

Correct answer: Network disruption strategy

Network disruption strategy uses social network analysis and intelligence to target key nodes within criminal organizations to maximize operational disruption.

Question 51: Which of the following best describes 'risk appetite' in an intelligence organization?

The percentage of budget allocated to security measures
The level and type of risk an organization is willing to accept to achieve its objectives (Correct answer)
The maximum financial loss an agency can absorb
The number of active threat cases an agency can manage simultaneously

Correct answer: The level and type of risk an organization is willing to accept to achieve its objectives

Risk appetite defines the amount and type of risk leadership is willing to tolerate while pursuing mission objectives, guiding decision-making thresholds.

Question 52: In ILP, which concept focuses resources on the small percentage of offenders responsible for the majority of crime?

Prolific offender targeting based on the Pareto Principle (Correct answer)
Zero Tolerance Policing
Broken Windows Theory
Community Policing Model

Correct answer: Prolific offender targeting based on the Pareto Principle

Applying the Pareto Principle to criminology recognizes that a small percentage of prolific offenders account for a disproportionate share of all crimes.

Question 53: The concept of 'risk-informed decision-making' in criminal intelligence means that leaders:

Require unanimous consensus among all analysts before acting
Defer all resource allocation decisions to risk software algorithms
Use structured risk analysis as one key input while also considering mission priorities, legal constraints, and available resources (Correct answer)
Base all decisions exclusively on quantitative probability scores

Correct answer: Use structured risk analysis as one key input while also considering mission priorities, legal constraints, and available resources

Risk-informed decision-making treats risk analysis as a critical but not sole input, balancing quantitative findings with mission context, legal boundaries, and practical constraints.

Question 54: What is the primary goal of a Critical Infrastructure Protection (CIP) risk assessment in a law enforcement context?

Assessing cybersecurity budgets of private companies
Cataloging all federal buildings within a jurisdiction
Identifying which infrastructure generates the most tax revenue
Determining which assets, if attacked or disrupted, would have the greatest cascading impact on public safety and security (Correct answer)

Correct answer: Determining which assets, if attacked or disrupted, would have the greatest cascading impact on public safety and security

CIP risk assessments identify nodes whose disruption would trigger the most significant cascading failures across interdependent systems, guiding protective resource allocation.

Question 55: Under the National Incident Management System (NIMS), risk management during a critical incident is primarily coordinated through:

Media liaison officers
Individual agency risk officers acting independently
Federal Bureau of Investigation headquarters only
The Incident Command System (ICS) unified command structure (Correct answer)

Correct answer: The Incident Command System (ICS) unified command structure

NIMS establishes ICS as the standardized framework for multi-agency coordination, including risk management decisions, during critical incidents.

Question 56: During a quality assurance & compliance audit, which documentation is most critical to have readily available?

Blaming individual team members for process failures
Conducting root cause analysis to identify underlying systemic issues (Correct answer)
Addressing symptoms without investigating deeper causes
Accepting recurring problems as unavoidable

Correct answer: Conducting root cause analysis to identify underlying systemic issues

Conducting root cause analysis to identify underlying systemic issues is the correct approach because effective quality assurance & compliance in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 57: Which of the following best describes predictive policing?

Arresting individuals before they commit crimes
Profiling individuals based on physical appearance
Using statistical analysis and algorithms to forecast where and when crimes are likely to occur (Correct answer)
Increasing police presence in all neighborhoods equally

Correct answer: Using statistical analysis and algorithms to forecast where and when crimes are likely to occur

Predictive policing uses data analytics and algorithms to forecast where and when crimes are likely to occur, enabling proactive resource deployment.

Question 58: Under the Privacy Act of 1974, federal agencies maintaining records about individuals must:

Share records freely with all state and local law enforcement partners
Destroy all personally identifiable records after one year
Classify all records containing personally identifiable information
Allow individuals to access and request correction of records about themselves (Correct answer)

Correct answer: Allow individuals to access and request correction of records about themselves

The Privacy Act grants individuals the right to access records federal agencies maintain about them and to request corrections of inaccuracies.

Question 59: What is the primary objective of an internal quality assurance audit of a criminal intelligence unit?

To determine the budget allocation needed for the next fiscal year
To verify that intelligence activities comply with legal requirements and agency policies (Correct answer)
To identify analysts eligible for merit-based promotion
To evaluate the technical performance of database and IT systems

Correct answer: To verify that intelligence activities comply with legal requirements and agency policies

Internal QA audits assess whether intelligence operations adhere to applicable laws, regulations, and written agency policies.

Question 60: What is a 'finished intelligence product'?

Intercepted communications before translation or evaluation
Information that has been analyzed, evaluated, and formatted for a specific audience (Correct answer)
Raw data collected directly from surveillance operations
A classified document pending declassification review

Correct answer: Information that has been analyzed, evaluated, and formatted for a specific audience

A finished intelligence product is raw information that has been processed, analyzed, evaluated, and formatted into a usable deliverable tailored to a specific consumer audience.

Question 61: Which type of intelligence focuses on identifying long-term threats or trends?

Tactical intelligence
Operational surveillance
Criminal incident report
Strategic intelligence (Correct answer)

Correct answer: Strategic intelligence

Strategic intelligence looks at broader patterns and helps with policy formation and resource allocation.

Question 62: What is the 'dark web' as it relates to criminal intelligence analysis?

Encrypted network layers not indexed by standard search engines, often used for illicit activities (Correct answer)
Hacker forums accessible through standard web browsers
Classified law enforcement intelligence databases
Unlit sections of the internet during network outages

Correct answer: Encrypted network layers not indexed by standard search engines, often used for illicit activities

The dark web consists of encrypted, non-indexed network content accessible only through specialized tools like Tor, and is often associated with illicit marketplaces and communications.

Question 63: Which approach BEST supports effective two-way communication between a fusion center and its local law enforcement partners?

Limiting communication to formal written reports only
Centralized one-way intelligence broadcasts to all partners
Regular feedback mechanisms and Requests for Information (RFI) processes (Correct answer)
Requiring all partners to access the same classified portal daily

Correct answer: Regular feedback mechanisms and Requests for Information (RFI) processes

Two-way communication is fostered through structured feedback mechanisms and RFI processes that allow partners to request and respond to intelligence needs.

Question 64: Which model is most closely associated with intelligence-led policing as developed by Jerry Ratcliffe?

SARA Model
OODA Loop
3-i Model (Correct answer)
CompStat Model

Correct answer: 3-i Model

The 3-i Model (Interpret, Influence, Impact) developed by Ratcliffe is the framework most closely associated with intelligence-led policing.

Question 65: What is 'social network analysis' (SNA) used for in criminal intelligence?

Monitoring employees' internet usage for policy compliance
Analyzing popularity metrics on crime-related social media content
Mapping relationships between individuals, organizations, or events to identify key actors in criminal networks (Correct answer)
Managing law enforcement official social media accounts

Correct answer: Mapping relationships between individuals, organizations, or events to identify key actors in criminal networks

Social network analysis maps and measures relationships between entities to identify key influencers, connectors, and vulnerabilities within criminal networks.

Question 66: Why is source reliability important in intelligence analysis?

It determines intelligence classification
It helps assess the accuracy of the information (Correct answer)
It guarantees convictions
It improves source anonymity

Correct answer: It helps assess the accuracy of the information

Evaluating the credibility of a source ensures the accuracy and usefulness of intelligence products.

Question 67: What does 'metadata' refer to in the context of digital intelligence collection?

An encrypted criminal records database
Data that describes other data, such as creation date, author, geolocation, and device information (Correct answer)
A type of malware used in cyberattacks against law enforcement
The visible text content of a digital file

Correct answer: Data that describes other data, such as creation date, author, geolocation, and device information

Metadata is information about data, including creation timestamps, geolocation coordinates, device identifiers, and authorship details embedded in digital files.

Question 68: A regional intelligence analyst receives a request from a political campaign asking for crime statistics to support campaign messaging. The analyst should:

Decline and refer the requester to publicly available data sources (Correct answer)
Provide the statistics as a public service
Provide the data but mark it as unofficial
Forward the request to the agency's legal counsel for immediate approval

Correct answer: Decline and refer the requester to publicly available data sources

Law enforcement intelligence resources cannot be used to support partisan political activities; the analyst should refer requesters to publicly available data.

Question 69: What does 'IP address geolocation' provide investigators in a digital investigation?

The confirmed identity and name of the device's owner
The precise physical street address of a computer or device
An approximate geographic location associated with an internet connection (Correct answer)
A complete record of a user's browsing history

Correct answer: An approximate geographic location associated with an internet connection

IP address geolocation provides an approximate geographic location (typically city or regional level) associated with an internet connection, useful for narrowing investigative leads.

Question 70: In the context of NCIC professional ethics, 'moral courage' most directly refers to:

Physical bravery in dangerous field operations
Persistence in completing long-term analytical projects
The courage to pursue high-profile targets
The willingness to report wrongdoing, refuse unethical orders, or deliver unwelcome analytical findings despite personal or professional risk (Correct answer)

Correct answer: The willingness to report wrongdoing, refuse unethical orders, or deliver unwelcome analytical findings despite personal or professional risk

Moral courage in intelligence ethics means acting on ethical principles even when doing so carries personal or professional consequences.

Question 71: Which indicator would MOST elevate the assessed risk level of a previously low-priority threat group?

Increased social media posts by group members
A single confidential informant report without corroboration
Acquisition of weapons, financing, or recruitment of new members with operational skills (Correct answer)
News coverage linking the group to past minor incidents

Correct answer: Acquisition of weapons, financing, or recruitment of new members with operational skills

Capability acquisition — weapons, financing, skilled operatives — directly increases a group's ability to act, requiring immediate reassessment of their risk tier.

Question 72: Which scenario would require a national criminal intelligence professional to escalate a legal standards & information sharing concern?

Collecting feedback only during formal review periods
Creating feedback mechanisms that encourage continuous improvement (Correct answer)
Using feedback solely for personnel evaluations
Discouraging critical feedback to maintain team morale

Correct answer: Creating feedback mechanisms that encourage continuous improvement

Creating feedback mechanisms that encourage continuous improvement is the correct approach because effective legal standards & information sharing in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 73: In information-sharing risk management, the 'mosaic effect' refers to:

A multi-agency fusion center display system
The process of color-coding threat levels on risk matrices
The risk that individually non-sensitive pieces of information, when combined, reveal sensitive details that expose sources or methods (Correct answer)
The visual display of geospatial intelligence data

Correct answer: The risk that individually non-sensitive pieces of information, when combined, reveal sensitive details that expose sources or methods

The mosaic effect describes how aggregating seemingly innocuous data points can produce a sensitive intelligence picture, requiring analysts to consider cumulative disclosure risk.

Question 74: What distinguishes an advanced national criminal intelligence practitioner's approach to risk management & mitigation from that of a novice?

Rotating responsibilities randomly to promote flexibility
Establishing cross-functional teams with clearly defined roles (Correct answer)
Assigning all responsibilities to a single department
Creating competition between teams to drive performance

Correct answer: Establishing cross-functional teams with clearly defined roles

Establishing cross-functional teams with clearly defined roles is the correct approach because effective risk management & mitigation in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 75: Which document outlines restrictions on how intelligence can be shared and used?

Personnel Roster
Incident Report
FOIA Request
Memorandum of Understanding (Correct answer)

Correct answer: Memorandum of Understanding

A Memorandum of Understanding (MOU) defines terms, limitations, and responsibilities regarding shared intelligence data.

Question 76: What is the most common mistake professionals make when implementing legal standards & information sharing strategies?

Responding to problems only after they occur
Transferring all risk to external partners through contracts
Creating contingency plans for every possible scenario regardless of probability
Developing contingency plans for high-probability risk scenarios (Correct answer)

Correct answer: Developing contingency plans for high-probability risk scenarios

Developing contingency plans for high-probability risk scenarios is the correct approach because effective legal standards & information sharing in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 77: Which of the following best describes 'confirmatory bias' as an ethical risk in intelligence analysis?

The tendency to seek and favor information that confirms a pre-existing hypothesis while discounting contradictory evidence (Correct answer)
The tendency to copy conclusions from previous reports without re-analysis
The tendency to share intelligence that confirms an ally's position
The tendency to over-classify information to prevent embarrassment

Correct answer: The tendency to seek and favor information that confirms a pre-existing hypothesis while discounting contradictory evidence

Confirmatory bias causes analysts to unconsciously favor evidence that supports their existing beliefs, undermining analytical objectivity.

Question 78: What is open-source intelligence (OSINT) in the context of digital criminal investigations?

Data obtained through court-authorized wiretaps
Information gathered from publicly available sources such as websites, social media, and public records (Correct answer)
Intelligence gathered exclusively from confidential informants
Intelligence collected from classified government databases

Correct answer: Information gathered from publicly available sources such as websites, social media, and public records

OSINT refers to intelligence collected from publicly available sources including websites, social media platforms, news outlets, and public government records.

Question 79: Why is safeguarding civil liberties important in intelligence work?

It maintains trust and legal compliance (Correct answer)
It prevents legal action against analysts
It ensures operational secrecy
It speeds up investigations

Correct answer: It maintains trust and legal compliance

Maintaining civil liberties protects individual rights and ensures intelligence activities do not violate constitutional protections.

Question 80: What is a 'target profile' in intelligence-led policing?

A wanted poster distributed to the general public
A performance evaluation for individual officers
A statistical crime report for a geographic area
A comprehensive intelligence document about a specific person of interest or criminal target (Correct answer)

Correct answer: A comprehensive intelligence document about a specific person of interest or criminal target

A target profile is a detailed intelligence document compiling information from multiple sources about a specific individual or group that is the focus of an investigation.

Question 81: What is the most common mistake professionals make when implementing threat assessment & strategic reporting strategies?

Developing contingency plans for high-probability risk scenarios (Correct answer)
Responding to problems only after they occur
Transferring all risk to external partners through contracts
Creating contingency plans for every possible scenario regardless of probability

Correct answer: Developing contingency plans for high-probability risk scenarios

Developing contingency plans for high-probability risk scenarios is the correct approach because effective threat assessment & strategic reporting in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 82: Establishing a formal consumer feedback mechanism where recipients rate intelligence products primarily serves which quality assurance purpose?

It satisfies mandatory reporting requirements under 28 CFR Part 23
It fulfills Freedom of Information Act disclosure obligations to the public
It protects analysts from personal liability when intelligence proves inaccurate
It provides data to continuously improve products based on end-user needs and accuracy assessments (Correct answer)

Correct answer: It provides data to continuously improve products based on end-user needs and accuracy assessments

Consumer feedback closes the quality loop by revealing whether products met operational needs and where accuracy, relevance, or timeliness can be improved.

Question 83: A new regulation impacts data collection & analytical techniques procedures. What should a NCIC professional do first?

Interpreting regulations loosely to allow maximum flexibility
Delegating compliance oversight to administrative staff
Complying only with regulations that have enforcement mechanisms
Ensuring compliance with current regulatory requirements and standards (Correct answer)

Correct answer: Ensuring compliance with current regulatory requirements and standards

Ensuring compliance with current regulatory requirements and standards is the correct approach because effective data collection & analytical techniques in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 84: What is a key legal requirement when sharing criminal intelligence data?

Data must be relevant and legally obtained (Correct answer)
Data must be encrypted
Data must be deleted within 24 hours
Data must be publicly available

Correct answer: Data must be relevant and legally obtained

Shared data must be relevant to a criminal investigation and comply with privacy regulations to avoid misuse.

Question 85: What is the primary goal of intelligence-led policing (ILP)?

To increase arrest quotas
To use information and analysis to guide police operations and resource allocation (Correct answer)
To replace community policing strategies
To focus solely on reactive investigations

Correct answer: To use information and analysis to guide police operations and resource allocation

Intelligence-led policing uses analyzed information to guide operational decisions and allocate law enforcement resources more effectively.

Question 86: What is 'phishing' in the context of cyber threats that criminal intelligence analysts must understand?

A social engineering attack using deceptive emails or messages to obtain sensitive information or install malware (Correct answer)
A digital forensics method for recovering deleted files
A recreational activity used as cover for criminal meetings
A law enforcement technique for tracking criminal networks online

Correct answer: A social engineering attack using deceptive emails or messages to obtain sensitive information or install malware

Phishing is a social engineering attack where deceptive emails or messages trick recipients into revealing sensitive information or downloading malicious software.

Question 87: Under 28 CFR Part 23, criminal intelligence systems are required to mitigate the risk of civil liberties violations primarily by:

Encrypting all stored data with federal-standard algorithms
Prohibiting the collection of any personal identifiable information
Ensuring reasonable suspicion exists before including individuals in a criminal intelligence system and requiring periodic purge reviews (Correct answer)
Limiting system access to federal agencies only

Correct answer: Ensuring reasonable suspicion exists before including individuals in a criminal intelligence system and requiring periodic purge reviews

28 CFR Part 23 mandates that entries require documented reasonable suspicion of criminal activity and that records be reviewed and purged periodically to protect civil liberties.

Question 88: Which element is MOST critical when preparing a written intelligence product for multi-agency distribution?

Clear sourcing, classification markings, and handling instructions (Correct answer)
Inclusion of raw data to support the analysis
Length and formatting consistency
Use of law enforcement jargon familiar to all recipients

Correct answer: Clear sourcing, classification markings, and handling instructions

Proper sourcing, classification markings, and handling instructions ensure recipients know how to protect and use the product appropriately.

Question 89: A national criminal intelligence professional discovers a discrepancy during professional ethics & standards review. What is the most appropriate immediate action?

Accepting all stakeholder requests without prioritization
Engaging stakeholders collaboratively to align goals and expectations (Correct answer)
Working independently to avoid conflicting opinions
Limiting communication to written reports only

Correct answer: Engaging stakeholders collaboratively to align goals and expectations

Engaging stakeholders collaboratively to align goals and expectations is the correct approach because effective professional ethics & standards in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 90: What is 'predictive cyber intelligence' used for in law enforcement operations?

Predicting which law enforcement officers are at risk of misconduct
Estimating the probability of specific outcomes in future criminal trials
Using threat data and behavioral analysis to anticipate and prevent cyber attacks before they occur (Correct answer)
Forecasting weather patterns that may affect street crime rates

Correct answer: Using threat data and behavioral analysis to anticipate and prevent cyber attacks before they occur

Predictive cyber intelligence uses historical threat data, behavioral patterns, and advanced analytics to anticipate and prevent cyber attacks before they materialize.

Question 91: Which of the following is a key performance indicator for evaluating quality assurance & compliance effectiveness?

Focusing only on tasks with immediate financial implications
Treating all tasks with equal urgency regardless of impact
Prioritizing based on risk assessment and potential impact (Correct answer)
Addressing the most recent issue first regardless of severity

Correct answer: Prioritizing based on risk assessment and potential impact

Prioritizing based on risk assessment and potential impact is the correct approach because effective quality assurance & compliance in the national criminal intelligence field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 92: What key consideration must analysts address when collecting digital intelligence to ensure its admissibility as evidence?

Proper legal authority must be obtained, methods documented, and evidence integrity maintained throughout collection (Correct answer)
Digital evidence must be printed on paper to be admissible in court
The intelligence must be collected only during business hours
Intelligence must be collected only by sworn law enforcement officers, not civilian analysts

Correct answer: Proper legal authority must be obtained, methods documented, and evidence integrity maintained throughout collection

Admissible digital intelligence requires proper legal authority for collection, thorough documentation of methods, and demonstrated integrity of the evidence throughout the collection process.

Question 93: What is a 'cybercrime fusion center' specifically designed to accomplish?

Provide broadband internet access to rural law enforcement agencies
Integrate cyber threat intelligence from multiple sources to support coordinated law enforcement response to cybercrime (Correct answer)
Manage and archive digital evidence for court proceedings
Test and certify cybersecurity software products for law enforcement use

Correct answer: Integrate cyber threat intelligence from multiple sources to support coordinated law enforcement response to cybercrime

Cybercrime fusion centers integrate cyber threat intelligence from government, private sector, and law enforcement sources to support coordinated responses to cyber threats.

Question 94: What is a 'Tactical Intelligence Package' in intelligence-led policing?

A compiled report containing actionable intelligence to support specific law enforcement operations (Correct answer)
A public awareness bulletin for crime prevention
A training manual for new recruits
A software program for data entry

Correct answer: A compiled report containing actionable intelligence to support specific law enforcement operations

A Tactical Intelligence Package is a compiled set of actionable intelligence products designed to support specific operational law enforcement activities.

Question 95: Which federal law primarily governs law enforcement access to electronic communications and stored digital data?

The Computer Fraud and Abuse Act (CFAA)
The Electronic Communications Privacy Act (ECPA) (Correct answer)
The Homeland Security Act
The Freedom of Information Act (FOIA)

Correct answer: The Electronic Communications Privacy Act (ECPA)

The Electronic Communications Privacy Act (ECPA) establishes the legal standards for law enforcement access to electronic communications and stored electronic data.

Question 96: What role does cryptocurrency play in criminal intelligence analysis?

It provides a digital signature system for court documents
It enables relatively anonymous financial transactions used in money laundering and illicit commerce (Correct answer)
It is a law enforcement-controlled digital currency for evidence seizures
It is exclusively used by government agencies for secure transactions

Correct answer: It enables relatively anonymous financial transactions used in money laundering and illicit commerce

Cryptocurrency's decentralized nature facilitates relatively anonymous financial transactions, making it attractive for criminal money laundering and illicit marketplace activity.

Question 97: What is a 'digital footprint' in the context of criminal investigations?

A law enforcement database record identifier
The trail of data left by an individual's online activities across digital platforms (Correct answer)
Physical evidence of a computer device found at a crime scene
A suspect's fingerprint recovered from a digital device

Correct answer: The trail of data left by an individual's online activities across digital platforms

A digital footprint is the collection of data traces left by an individual's online activities, including browsing history, social media posts, and transaction records.

Question 98: What does 'deconfliction' mean in the context of intelligence-led policing operations?

Resolving interpersonal conflicts between officers
Removing outdated information from criminal databases
Identifying overlapping investigations to prevent interference and enhance multi-agency coordination (Correct answer)
Declassifying intelligence documents for public release

Correct answer: Identifying overlapping investigations to prevent interference and enhance multi-agency coordination

Deconfliction identifies when multiple agencies or units are investigating the same subject or location to prevent operational conflicts and improve coordination.

Question 99: The 'red team' methodology in intelligence risk management is used to:

Conduct internal audits of financial expenditures
Train new analysts in basic intelligence techniques
Rapidly deploy field agents to high-risk areas
Simulate adversary thinking to identify vulnerabilities in plans or systems (Correct answer)

Correct answer: Simulate adversary thinking to identify vulnerabilities in plans or systems

Red teaming places analysts or teams in the role of the adversary to stress-test plans, expose blind spots, and uncover exploitable weaknesses before a real attack does.

Question 100: What is 'chain of custody' as it applies to digital evidence in criminal investigations?

The technical sequence of steps in a cyberattack incident
The documented chronological record tracking who handled digital evidence and what actions were taken with it (Correct answer)
A list of digital crime suspects linked to a specific investigation
The hierarchy of command authority in law enforcement agencies

Correct answer: The documented chronological record tracking who handled digital evidence and what actions were taken with it

Chain of custody is a documented record of every person who handled digital evidence and every action taken with it, ensuring its integrity and legal admissibility.

Question 101: What is a key element of effective strategic reporting?

Clarity and relevance to stakeholders (Correct answer)
Extensive legal citations
Inclusion of all raw data
Use of technical jargon

Correct answer: Clarity and relevance to stakeholders

Clarity and relevance ensure that strategic reports are easily understood and directly applicable to decision-making.

National Criminal Intelligence Certification (NCIC)

The National Criminal Intelligence Certification (NCIC) validates law enforcement professionals' knowledge of criminal intelligence fundamentals, legal and information-sharing standards, cybersecurity, and intelligence-led policing. It is designed for analysts and officers responsible for gathering, analyzing, and sharing criminal intelligence within law enforcement agencies.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds