A junior analyst is new to OSINT and asks a senior analyst how to approach a new investigation. The senior analyst explains that OSINT is not just about using search engines but involves a systematic process. Which statement best describes the OSINT methodology?

A structured approach that includes planning, collection, processing, analysis, and reporting.

A set of tools that automate the collection of publicly available data.

A collection of databases that store open source information.

A legal framework that governs the use of open source information.

An OSINT team has completed a threat assessment for a client. The team needs to deliver a report that the client's executives can use to make decisions. Which reporting approach is most aligned with the OSINT methodology?

Summarize key findings with confidence levels, source citations, and recommended actions.

Focus only on the most alarming findings to ensure the client takes immediate action.

Provide a raw data dump of all collected URLs and screenshots for transparency.

Write a lengthy technical document with all methodological details, assuming the executives are technical.

An analyst is investigating a cyberstalking case and needs to identify the suspect's online presence. The analyst has limited time and must prioritize sources. Which source category is most likely to yield the most relevant information quickly?

News articles and press releases

Public government records and property databases

Deep web forums and dark web marketplaces

Social media platforms and search engines

What is the primary purpose of corroborating OSINT information?

To ensure that the information is stored securely.

To make the information easier to read in the final report.

To reduce the number of sources needed for the investigation.

To increase confidence in the accuracy of the information.

GIAC Open Source Intelligence (GOSI)

Domain 1Objective 1

OSINT Methodology GOSI Practice Questions (Page 9)

Part of the OSINT Fundamentals and Methodology domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 41–45

41foundation · easy
Which category of OSINT sources includes platforms like Twitter, LinkedIn, and Facebook?
Select an answer first
42application · medium
A junior analyst is new to OSINT and asks a senior analyst how to approach a new investigation. The senior analyst explains that OSINT is not just about using search engines but involves a systematic process. Which statement best describes the OSINT methodology?
Select an answer first
43application · medium
An OSINT team has completed a threat assessment for a client. The team needs to deliver a report that the client's executives can use to make decisions. Which reporting approach is most aligned with the OSINT methodology?
Select an answer first
44application · medium
An analyst is investigating a cyberstalking case and needs to identify the suspect's online presence. The analyst has limited time and must prioritize sources. Which source category is most likely to yield the most relevant information quickly?
Select an answer first
45foundation · easy
What is the primary purpose of corroborating OSINT information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.