An OSINT team is planning an investigation that involves accessing a hostile forum. Which threat is most relevant to consider in their threat model?

The forum's user interface being difficult to navigate

The forum's server being located in a different country

The risk of the analyst's identity being exposed by forum administrators or members

The cost of accessing the forum's premium content

Which of the following is an example of operational data exposure in an OSINT investigation?

Using a personal email address to register for a forum

Using a dedicated browser for the investigation

Encrypting the analyst's hard drive

Documenting findings in a password-protected file

Which of the following is a primary purpose of using a VPN in OSINT investigations?

To bypass all legal restrictions on data access

To hide the analyst's IP address from the websites they visit

To encrypt all data on the analyst's hard drive

To increase the speed of internet connections

An analyst is conducting OSINT on a subject who is known to use advanced tracking techniques. The analyst needs to visit a website that uses JavaScript-based fingerprinting. The analyst's goal is to avoid being identified as the same person across multiple visits. Which approach is most effective?

Use a different browser profile for each visit, with JavaScript disabled and a unique user agent.

Use Tor Browser with a new identity for each visit, ensuring JavaScript is disabled or using the safest security level.

Use a commercial VPN and access the site through a different server for each visit.

Use the same browser but clear cookies and cache after each visit.

An analyst is investigating a person of interest and finds a social media profile that appears to belong to the target. The profile is private, but the analyst has a personal account that could send a friend request. What is the most appropriate action?

Use a colleague's account to send a friend request, as it is not the analyst's personal identity.

Do not send a friend request; rely on publicly available information and document the profile's existence.

Create a fake persona and send a friend request to gain access to the private profile.

Attempt to access the profile through a third-party service that claims to view private profiles.

GIAC Open Source Intelligence (GOSI)

Domain 1Objective 2

Privacy and Operational Security Fundamentals GOSI Practice Questions (Page 7)

Part of the OSINT Fundamentals and Methodology domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 31–35

31foundation · easy
An OSINT team is planning an investigation that involves accessing a hostile forum. Which threat is most relevant to consider in their threat model?
Select an answer first
32foundation · easy
Which of the following is an example of operational data exposure in an OSINT investigation?
Select an answer first
33foundation · easy
Which of the following is a primary purpose of using a VPN in OSINT investigations?
Select an answer first
34expert · hard
An analyst is conducting OSINT on a subject who is known to use advanced tracking techniques. The analyst needs to visit a website that uses JavaScript-based fingerprinting. The analyst's goal is to avoid being identified as the same person across multiple visits. Which approach is most effective?
Select an answer first
35application · medium
An analyst is investigating a person of interest and finds a social media profile that appears to belong to the target. The profile is private, but the analyst has a personal account that could send a friend request. What is the most appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.