An investigator is attempting to profile a subject who is privacy-conscious. The subject uses a VPN, has disabled location services on their phone, and uses unique email addresses for each online account. Which strategy would be most effective for the investigator?

Search for the subject's unique email addresses on public databases to find linked accounts.

Focus on analyzing the subject's public social media posts for personal details and relationships.

Attempt to bypass the VPN by tracing the subject's IP address through a vulnerability in their browser.

Use a people search engine to find the subject's home address and phone number.

A security team is profiling a potential insider threat. The target's public Instagram shows frequent posts at a local gym, a public Facebook page lists them as a member of a local cycling club, and their Twitter bio mentions a specific university. The team needs to build a behavioral profile for a threat assessment. Which combination of data would be most useful?

Gym check-in times, cycling club event participation, and university alumni group memberships.

The target's phone number from a people search engine and their email address from a data breach.

The target's list of friends on Facebook and the comments they leave on gym posts.

The number of followers on each platform and the target's profile picture.

GIAC Open Source Intelligence (GOSI)

Domain 2Objective 1

Investigating People GOSI Practice Questions (Page 4)

Part of the Target Investigation and Infrastructure Analysis domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 9–14 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 16–20

16foundation · easy
Which type of data is most useful for geolocation and movement tracking of a target?
Select an answer first
17foundation · easy
A target uses a pseudonym, avoids posting personal details, and regularly deletes old posts. What is the target likely practicing?
Select an answer first
18foundation · easy
An analyst is investigating a person and has collected a social media profile, a blog post, and a forum comment that all appear to belong to the same individual. Which process is the analyst performing when they combine these separate pieces of information into a single coherent identity?
Select an answer first
19application · medium
An investigator is attempting to profile a subject who is privacy-conscious. The subject uses a VPN, has disabled location services on their phone, and uses unique email addresses for each online account. Which strategy would be most effective for the investigator?
Select an answer first
20application · medium
A security team is profiling a potential insider threat. The target's public Instagram shows frequent posts at a local gym, a public Facebook page lists them as a member of a local cycling club, and their Twitter bio mentions a specific university. The team needs to build a behavioral profile for a threat assessment. Which combination of data would be most useful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.

Investigating People GOSI Practice Questions (Page 4)

Questions 16–20

Which type of data is most useful for geolocation and movement tracking of a target?

A target uses a pseudonym, avoids posting personal details, and regularly deletes old posts. What is the target likely practicing?

An analyst is investigating a person and has collected a social media profile, a blog post, and a forum comment that all appear to belong to the same individual. Which process is the analyst performing when they combine these separate pieces of information into a single coherent identity?

An investigator is attempting to profile a subject who is privacy-conscious. The subject uses a VPN, has disabled location services on their phone, and uses unique email addresses for each online account. Which strategy would be most effective for the investigator?

Keep studying — Target Investigation and Infrastructure Analysis