Which of the Following Is True of Compressed URLs?

The answer

Among the usual multiple-choice options, the correct statement is: compressed URLs may be used to mask malicious intent. A compressed URL is simply a long web address shortened by a redirection service (TinyURL, bit.ly, t.co, goo.gl-style links). The short form is convenient, but it also hides the real destination, and that concealment is exactly what attackers exploit.

When you cannot see where a link actually points, you lose your best early warning signal. A link that displays as tinyurl.com/x8k2p could resolve to a legitimate news article, or to a credential-harvesting page dressed up to look like your bank. The short URL itself gives you no way to tell the difference, which is why the DoD Cyber Awareness training treats them as a phishing and malware risk.

Why the other options are wrong

Typical distractors claim things like:

• "They are always safe because a trusted company created the short link." False. The shortening service is neutral infrastructure; it does not vet the destination. Anyone can shorten a malicious link.
• "They cannot hide the destination." False. Hiding the destination is the entire mechanism, that is what makes them risky.
• "They improve security by encrypting the address." False. Shortening is redirection, not encryption. The link may point to an http (unencrypted) or malicious https site just as easily.

Only the statement about masking malicious intent survives scrutiny.

How to handle a compressed URL safely

The practical defense is to expand and preview the link before you click:

1. Use the service's own preview feature. TinyURL lets you type preview.tinyurl.com/... or add a special prefix to see the destination first. Many shorteners support this.
2. Use a trusted URL-expander/checker. Independent tools and security scanners will resolve the short link and show the full destination plus a reputation rating without you visiting it.
3. Hover, do not click. On a desktop, hovering over the link shows the target in the status bar, though for a shortened link this only reveals the shortener domain, not the final page, so a preview tool is still safer.
4. Verify the source and context. Was the link expected? Does it come from a known sender through a legitimate channel? Unsolicited shortened links in email, texts, or DMs deserve extra suspicion.
5. When in doubt, do not click. Navigate directly to the organization's known website instead of trusting the link.

The bigger picture

Compressed URLs are not inherently evil; they solve real problems on character-limited platforms and in printed materials. The security lesson is about loss of transparency: any technique that hides a destination shifts trust away from you and toward whoever created the link. Treat that opacity as a prompt to verify, not as a reason to panic, and build the habit of expanding before clicking so a masked malicious link never gets a free pass.