An OSINT analyst is tasked with assessing the public exposure of a company's sensitive data. The analyst has already identified relevant sources and collected data. According to the intelligence cycle, what should the analyst do next?

Collect more data from the same sources to ensure completeness.

Process and analyze the collected data to identify patterns and draw conclusions.

Begin writing the final report immediately to meet the deadline.

Disseminate the raw data to stakeholders for their interpretation.

A non-profit organization wants to conduct OSINT to identify potential donors. They have a small team and limited budget. They plan to scrape social media profiles and public records. Which consideration is most important to address first?

The cost of the tools needed for scraping.

The accuracy of the data collected.

The legal and ethical implications of scraping personal data.

The time required to analyze the data.

An OSINT analyst is investigating a cybercrime case. They find a private Facebook group that requires membership to view posts. The analyst creates a fake account to join the group and gather evidence. Which ethical or legal boundary is being violated?

Joining a private group is acceptable because the information is shared with members.

Using a fake account violates the platform's terms of service and may be illegal under computer fraud statutes.

Collecting information from social media is always legal regardless of access method.

The analyst should have obtained a warrant before joining the group.

A threat intelligence team is using the intelligence cycle to guide their OSINT efforts. They have just received a new requirement from leadership to assess the risk of a specific threat actor. What is the first step they should take?

Define the intelligence requirements and develop a collection plan.

Collect data from all available open sources.

Disseminate the final report to stakeholders.

Analyze the existing data to identify gaps.

A security team is conducting OSINT on a suspected insider threat. They plan to use a fake social media account to send a friend request to the suspect's family members to gather personal information. Which action is most appropriate from a legal and ethical standpoint?

Use the fake account but only to observe, not to interact with family members.

Refrain from the deceptive approach and instead collect only information that is openly accessible without interaction.

Proceed because the information is publicly available and the investigation is for security purposes.

Ask the suspect's employer for permission to use a fake account.

GIAC Open Source Intelligence (GOSI)

Domain 1Objective 1

OSINT Methodology GOSI Practice Questions (Page 2)

Part of the OSINT Fundamentals and Methodology domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 6–10

6application · medium
An OSINT analyst is tasked with assessing the public exposure of a company's sensitive data. The analyst has already identified relevant sources and collected data. According to the intelligence cycle, what should the analyst do next?
Select an answer first
7expert · hard
A non-profit organization wants to conduct OSINT to identify potential donors. They have a small team and limited budget. They plan to scrape social media profiles and public records. Which consideration is most important to address first?
Select an answer first
8application · medium
An OSINT analyst is investigating a cybercrime case. They find a private Facebook group that requires membership to view posts. The analyst creates a fake account to join the group and gather evidence. Which ethical or legal boundary is being violated?
Select an answer first
9application · medium
A threat intelligence team is using the intelligence cycle to guide their OSINT efforts. They have just received a new requirement from leadership to assess the risk of a specific threat actor. What is the first step they should take?
Select an answer first
10application · medium
A security team is conducting OSINT on a suspected insider threat. They plan to use a fake social media account to send a friend request to the suspect's family members to gather personal information. Which action is most appropriate from a legal and ethical standpoint?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.