An OSINT analyst is investigating a person who is a public figure. The analyst finds a private social media post that was shared by a friend of the target. The post contains personal information that is not publicly available. What is the most appropriate action?

Use the information but anonymize the source in the final report.

Use the information in the investigation, as it was shared by the target's friend and is now in the public domain.

Do not use the information, as it was shared in a private context and may not be legally obtained.

Contact the friend who shared the post and ask for permission to use the information.

An OSINT analyst is writing a report that includes screenshots of social media posts from a private individual. The analyst plans to share the report within the company. Which practice best respects the individual's privacy while still fulfilling the investigation's purpose?

Share the report only verbally, without any written documentation.

Include full screenshots with all visible information for completeness.

Redact any personal information that is not directly relevant to the investigation.

Use a pseudonym for the individual in the report.

An OSINT analyst is investigating a target who is known to use social media extensively. The analyst has been using a dedicated research browser with a VPN and has been careful to avoid logging into personal accounts. However, the analyst notices that the target's social media page is showing personalized advertisements that seem to match the analyst's own interests. What is the most likely cause of this data exposure?

The analyst's browser fingerprint is being used to correlate the research browser with the analyst's personal browsing history.

The target's social media page is using cross-device tracking to identify the analyst's device.

The analyst's personal email address is being used to match the target's advertising profile.

The VPN provider is selling the analyst's browsing data to advertisers.

An analyst is using a VPN to access a website for OSINT purposes. The analyst notices that the website is showing a different language and currency, indicating that the VPN exit node is in a different country. What is the most likely implication of this?

The website is detecting the VPN and blocking access, so the analyst should disable the VPN.

The VPN is not working correctly, and the analyst should switch to a different VPN provider.

The analyst's real IP address is still visible to the website, and the VPN is not providing anonymity.

The website may serve different content based on the exit node's location, which could affect the data collected.

Which of the following is a secure communication method for OSINT collaboration?

Sending unencrypted emails to team members

Posting updates on a public forum

Using a messaging app with end-to-end encryption

Using standard SMS text messages

GIAC Open Source Intelligence (GOSI)

Domain 1Objective 2

Privacy and Operational Security Fundamentals GOSI Practice Questions (Page 6)

Part of the OSINT Fundamentals and Methodology domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 26–30

26application · medium
An OSINT analyst is investigating a person who is a public figure. The analyst finds a private social media post that was shared by a friend of the target. The post contains personal information that is not publicly available. What is the most appropriate action?
Select an answer first
27application · medium
An OSINT analyst is writing a report that includes screenshots of social media posts from a private individual. The analyst plans to share the report within the company. Which practice best respects the individual's privacy while still fulfilling the investigation's purpose?
Select an answer first
28expert · hard
An OSINT analyst is investigating a target who is known to use social media extensively. The analyst has been using a dedicated research browser with a VPN and has been careful to avoid logging into personal accounts. However, the analyst notices that the target's social media page is showing personalized advertisements that seem to match the analyst's own interests. What is the most likely cause of this data exposure?
Select an answer first
29application · medium
An analyst is using a VPN to access a website for OSINT purposes. The analyst notices that the website is showing a different language and currency, indicating that the VPN exit node is in a different country. What is the most likely implication of this?
Select an answer first
30foundation · easy
Which of the following is a secure communication method for OSINT collaboration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.