An investigator is trying to locate a subject who has a common name and has moved three times in the past five years. The investigator has the subject's current phone number but no current address. The subject's social media is private. Which approach is most likely to produce a current address?

Use the Wayback Machine to find the subject's old address from a previous website.

Use a people search engine that aggregates utility records and property records, and cross-reference with the phone number.

Search public court records for the subject's name to find a current address.

Search the subject's phone number on social media platforms to find a public profile with an address.

An investigator has a phone number that is associated with a subject's social media account, but the account is private. The investigator also finds the same phone number in a data breach associated with an email address. The email address is used on a public forum where the subject posts under a pseudonym. Which conclusion is most defensible?

The forum pseudonym is definitely the subject's because the email address is in a breach.

The private social media account is definitely the subject's because it is linked to the phone number.

The phone number links the private social media account to the email address and the forum pseudonym, establishing a chain of identity.

The phone number is useless because the social media account is private.

An investigator is profiling a subject who is highly privacy-conscious. The subject uses a pseudonym, a VPN, and encrypted messaging apps. The subject has a public blog where they post about technology. The investigator has the subject's pseudonym and the blog URL. Which approach would be most effective in uncovering the subject's real identity?

Use a reverse image search on the blog's profile picture to find other accounts using the same image.

Search for the pseudonym on a username aggregator to find other accounts that use the same handle.

Combine analysis of the blog's metadata, searches for the pseudonym on other platforms, and reverse image searches on any images used.

Analyze the blog's metadata, such as the CMS used, the hosting provider, and any embedded content, to find clues about the subject's identity.

Which of the following is an example of a counter-OSINT technique that could hinder an investigation?

Sharing the same email address across multiple accounts

Using a unique username on every platform

Using a common name that is easy to search

Posting frequent geotagged updates

GIAC Open Source Intelligence (GOSI)

Domain 2Objective 1

Investigating People GOSI Practice Questions (Page 6)

Part of the Target Investigation and Infrastructure Analysis domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 9–14 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 26–30

26expert · hard
An investigator is trying to locate a subject who has a common name and has moved three times in the past five years. The investigator has the subject's current phone number but no current address. The subject's social media is private. Which approach is most likely to produce a current address?
Select an answer first
27expert · hard
An investigator has a phone number that is associated with a subject's social media account, but the account is private. The investigator also finds the same phone number in a data breach associated with an email address. The email address is used on a public forum where the subject posts under a pseudonym. Which conclusion is most defensible?
Select an answer first
28expert · hard
An investigator is profiling a subject who is highly privacy-conscious. The subject uses a pseudonym, a VPN, and encrypted messaging apps. The subject has a public blog where they post about technology. The investigator has the subject's pseudonym and the blog URL. Which approach would be most effective in uncovering the subject's real identity?
Select an answer first
29foundation · easy
Which of the following is an example of a counter-OSINT technique that could hinder an investigation?
Select an answer first
30foundation · easy
An analyst wants to view a version of a website as it appeared five years ago. Which resource is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.

Investigating People GOSI Practice Questions (Page 6)

Questions 26–30

An investigator is trying to locate a subject who has a common name and has moved three times in the past five years. The investigator has the subject's current phone number but no current address. The subject's social media is private. Which approach is most likely to produce a current address?

Which of the following is an example of a counter-OSINT technique that could hinder an investigation?

An analyst wants to view a version of a website as it appeared five years ago. Which resource is most appropriate for this task?

Keep studying — Target Investigation and Infrastructure Analysis