When evaluating the credibility of an OSINT source, which factor is most important?

The source's position in search engine results.

The source's website design and visual appeal.

The source's reputation and track record for accuracy.

The source's popularity on social media.

An analyst is compiling a profile of a person of interest for a fraud investigation. A blog post claims the person was arrested in 2015, but the analyst cannot find any court record. A social media post from the same year shows the person at a company award ceremony. Which action best aligns with the OSINT methodology?

Discard the blog post because social media contradicts it.

Report the arrest as fact because the blog is a public source.

Cross-reference the blog claim with court records and news archives before drawing a conclusion.

Include the blog claim in the report but note it as unverified.

A junior analyst is tasked with gathering OSINT on a company's public exposure. They start by searching social media, then move to public records, and finally review news articles. Which aspect of the OSINT methodology is missing from this approach?

The validation of the sources after collection.

The inclusion of human intelligence sources.

The use of automated tools to speed up the process.

A systematic plan that defines the intelligence requirements and collection strategy.

A cybersecurity firm is conducting OSINT on a ransomware group. The team has collected data from various sources, including social media, dark web forums, and news reports. The team must produce a threat intelligence report for a client. However, some data from dark web forums is unverified and may be misinformation. The client needs the report within 48 hours. What is the best course of action?

Include all data without labels to provide a complete picture.

Delay the report until all data is verified.

Exclude all dark web forum data because it is unverified.

Prioritize verified sources and clearly label unverified information as such in the report.

An analyst is compiling a profile of a person of interest for a fraud investigation. The analyst finds a social media post claiming the person works at a specific company, and a public record showing a home address. Before including these in the final report, the analyst wants to ensure the information is reliable. Which action best aligns with the OSINT methodology?

Exclude both pieces of information because open source data cannot be trusted for investigations.

Cross-reference the social media claim with the company's official website and LinkedIn page, and verify the address against a second public record source.

Use only the social media post because it is more current than public records.

Include both pieces of information as-is, since they come from open sources and are therefore considered public and reliable.

GIAC Open Source Intelligence (GOSI)

Domain 1Objective 1

OSINT Methodology GOSI Practice Questions (Page 3)

Part of the OSINT Fundamentals and Methodology domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 11–15

11foundation · easy
When evaluating the credibility of an OSINT source, which factor is most important?
Select an answer first
12application · medium
An analyst is compiling a profile of a person of interest for a fraud investigation. A blog post claims the person was arrested in 2015, but the analyst cannot find any court record. A social media post from the same year shows the person at a company award ceremony. Which action best aligns with the OSINT methodology?
Select an answer first
13application · medium
A junior analyst is tasked with gathering OSINT on a company's public exposure. They start by searching social media, then move to public records, and finally review news articles. Which aspect of the OSINT methodology is missing from this approach?
Select an answer first
14expert · hard
A cybersecurity firm is conducting OSINT on a ransomware group. The team has collected data from various sources, including social media, dark web forums, and news reports. The team must produce a threat intelligence report for a client. However, some data from dark web forums is unverified and may be misinformation. The client needs the report within 48 hours. What is the best course of action?
Select an answer first
15application · medium
An analyst is compiling a profile of a person of interest for a fraud investigation. The analyst finds a social media post claiming the person works at a specific company, and a public record showing a home address. Before including these in the final report, the analyst wants to ensure the information is reliable. Which action best aligns with the OSINT methodology?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.

OSINT Methodology GOSI Practice Questions (Page 3)

Questions 11–15

When evaluating the credibility of an OSINT source, which factor is most important?

A junior analyst is tasked with gathering OSINT on a company's public exposure. They start by searching social media, then move to public records, and finally review news articles. Which aspect of the OSINT methodology is missing from this approach?

Keep studying — OSINT Fundamentals and Methodology