10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
These 10 free CSMIE questions are organized by exam domain, so you can see how each part of the Certified Social Media Intelligence Expert blueprint is tested. Reveal the answer and explanation under each question.
Several established news accounts report an explosion at a ferry terminal. A citation audit traces every report to the same anonymous post, with no additional evidence identified. The originating post has since disappeared. What does this provenance establish?
Correct answer: B - The reports represent one uncorroborated source lineage, not independent confirmation.
Which Oracle VirtualBox 7.1 adapter mode supports guest-to-guest traffic on one host without guest-to-host or external-network connectivity, assuming one adapter per guest and no added routing or forwarding?
Correct answer: C - Internal Network
Archived captures link @NorthPier to account ID 581204. The handle now resolves to ID 993117, while ID 581204 uses @PierDirect. This platform's account IDs persist through handle changes. An investigator is reconstructing the original account's history, not yet identifying its operator. Which linkage is justified?
Correct answer: C - Continue the original account timeline under ID 581204's new handle.
Three records appear in a video investigation: Upload: 2026-09-14T23:52:00-04:00. Verified incident start: 2026-09-15T03:40:00Z. Investigator's download: 2026-09-15T04:10:00Z. A draft says the video predates the incident because the upload date is September 14. Which replacement is accurate?
Correct answer: A - The upload occurred 12 minutes after the incident; the recording time remains unestablished.
A mobile-app acquisition preserves messages.db, messages.db-wal, and messages.db-shm as a coherent set. An examiner gives a viewer only messages.db and sees no messages after 21:00. With unchanged settings, the same viewer shows a committed message at 21:07 when given the complete set. Both examinations use working copies from that acquisition. What most directly explains the additional message?
Correct answer: B - The committed message remained in the WAL, awaiting checkpointing into the main database.
A case archive contains a downloaded JPEG and its verified SHA-256 digest. For a briefing, an examiner makes a copy and adds an arrow pointing to a vehicle. The saved copy has a different digest, but rechecking the archived JPEG reproduces its original digest. How should the marked copy be handled?
Correct answer: A - Retain the marked copy with its own hash and edit record, linked to the unchanged original.
A lawfully seized phone is powered on and unlocked at a secured scene. A qualified mobile examiner is present with tested radio-frequency isolation and power equipment. A colleague proposes shutting the phone down to prevent a remote wipe. Which handling plan best protects the examination opportunity?
Correct answer: D - Maintain power and preserve the current state under the examiner's verified isolation plan.
An independently reviewed collection contains 1,000 posts, of which 100 are relevant. Two searches produce these results: Search X: 72 relevant and 8 irrelevant posts. Search Y: 90 relevant and 60 irrelevant posts. The team needs at least 85% of the relevant posts, with no more than 160 results to review. Which selection meets both requirements?
Correct answer: D - Search Y: 90% recall, 150 results, within both stated constraints.
At 16:10, a U.S. school-safety analyst finds a new public post naming that evening's school concert and stating an intention to attack attendees when doors open at 16:30. Staff confirm the event, and a newly posted photograph matches the entrance currently in use. The account holder's identity remains unresolved. What takes priority?
Correct answer: C - Notify emergency services and venue security now, sharing the post and verified venue details.
A U.S. detective asks a covered provider to preserve existing account records under 18 U.S.C. § 2703(f). On day 75, the legal process needed to obtain those records is still being prepared. There is no emergency or subscriber consent. Which instruction correctly separates continued preservation from disclosure?
Correct answer: A - Renew preservation for an additional 90-day period while obtaining the separate legal process needed for disclosure.
The CSMIE exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more CSMIE questions with explanations.
Continue in the free practice test →
View plans