What is a key characteristic of the Tor network that makes it useful for anonymizing OSINT activities?

It guarantees that the user's identity is never revealed

It provides a direct, high-speed connection to the internet

It allows users to access any website without leaving any logs

It encrypts traffic and routes it through multiple relays to obscure the origin

A team of OSINT analysts is spread across different countries and needs to share findings on a high-profile case. They are concerned about interception by a sophisticated adversary. Which communication method provides the strongest confidentiality?

Use a messaging app with end-to-end encryption and verify each participant's encryption keys out-of-band.

Use a shared document in a cloud storage service with a strong password.

Use a public forum to post encrypted messages that only the team can decrypt.

Use a corporate email service with TLS encryption for all communications.

An OSINT analyst is researching a topic that involves personal data of individuals who are not the primary target. The analyst finds a public spreadsheet containing names, addresses, and phone numbers. What is the most appropriate action regarding this data?

Use the data only as leads and avoid storing or reproducing the full dataset in the final report.

Share the spreadsheet with other analysts in the team for further analysis.

Include the full spreadsheet in the report to ensure all relevant information is documented.

Delete the spreadsheet immediately and do not use any of the data.

An OSINT analyst is investigating a target who is known to use social media to share personal information. The analyst has been using a dedicated research browser with a VPN and has been careful to avoid logging into personal accounts. However, the analyst notices that the target's social media page is showing personalized advertisements that seem to match the analyst's own interests. What is the most likely cause of this data exposure?

The analyst's personal email address is being used to match the target's advertising profile.

The target's social media page is using cross-device tracking to identify the analyst's device.

The VPN provider is selling the analyst's browsing data to advertisers.

The analyst's browser fingerprint is being used to correlate the research browser with the analyst's personal browsing history.

An OSINT analyst is investigating a target who is active on a forum that requires an account to view posts. The analyst has created a covert account using a unique username and email. To further protect the analyst's identity, which additional measure is most important?

Use a different browser profile for the forum.

Disable JavaScript in the browser while using the forum.

Access the forum through a VPN or Tor to hide the analyst's IP address.

Use a strong password for the forum account.

GIAC Open Source Intelligence (GOSI)

Domain 1Objective 2

Privacy and Operational Security Fundamentals GOSI Practice Questions (Page 2)

Part of the OSINT Fundamentals and Methodology domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 6–10

6foundation · easy
What is a key characteristic of the Tor network that makes it useful for anonymizing OSINT activities?
Select an answer first
7application · medium
A team of OSINT analysts is spread across different countries and needs to share findings on a high-profile case. They are concerned about interception by a sophisticated adversary. Which communication method provides the strongest confidentiality?
Select an answer first
8application · medium
An OSINT analyst is researching a topic that involves personal data of individuals who are not the primary target. The analyst finds a public spreadsheet containing names, addresses, and phone numbers. What is the most appropriate action regarding this data?
Select an answer first
9expert · hard
An OSINT analyst is investigating a target who is known to use social media to share personal information. The analyst has been using a dedicated research browser with a VPN and has been careful to avoid logging into personal accounts. However, the analyst notices that the target's social media page is showing personalized advertisements that seem to match the analyst's own interests. What is the most likely cause of this data exposure?
Select an answer first
10application · medium
An OSINT analyst is investigating a target who is active on a forum that requires an account to view posts. The analyst has created a covert account using a unique username and email. To further protect the analyst's identity, which additional measure is most important?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.