OSINT Methodology GOSI Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard · select all that apply

   An OSINT analyst is investigating a cyber threat actor. They have identified several potential sources of information. Which of the following are appropriate OSINT sources for this investigation? Select all that apply.

   • AInformation from a password-protected forum accessed without authorization.
   • BGovernment-published threat reports.
   • CPrivate email communications obtained from a hacker.
   • DPublic court records.
   • EPublicly available social media profiles.
   Check answers Discussion Select an answer first
2. 17expert · hard

   An OSINT team is tasked with monitoring a protest movement for potential security threats. The team has collected a large volume of social media posts. The team must provide daily briefings to law enforcement. However, the team is concerned about privacy and legal issues. What is the best approach?

   • ACollect and report all posts, including those from private accounts, to be thorough.
   • BUse automated tools to scrape all data without human review.
   • CAnalyze only public posts and aggregate trends without identifying individuals.
   • DFocus only on posts that mention specific keywords, ignoring context.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst is investigating a data breach and finds a pastebin post containing what appears to be stolen credentials. To verify the authenticity, the analyst decides to test one of the credentials against the company's public-facing login portal. Which ethical or legal issue does this action raise?

   • AThe analyst should have obtained written permission from the company first.
   • BIt is a standard OSINT technique to validate leaked data.
   • CIt is acceptable because the credentials are publicly available.
   • DTesting credentials against a live system may constitute unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is compiling a report on a company's cybersecurity posture. The analyst finds a blog post claiming the company was breached, but the company's official website has no such announcement. What should the analyst do to validate the claim?

   • AContact the blog author to ask for proof of the breach.
   • BDismiss the blog post entirely because the company has not confirmed it.
   • CInclude the blog post in the report as evidence because it is publicly available.
   • DTreat the blog post as unverified and search for corroborating evidence from multiple independent sources.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An OSINT team is preparing a report for a law enforcement client. The report must be admissible in court. Which element is most important to include?

   • AA list of all tools used, without context.
   • BA summary of the analyst's personal opinions.
   • CDetailed source citations and methodology notes.
   • DOnly the most incriminating findings.
   Reveal Solution Discussion Select an answer first