An analyst has collected a large dataset of usernames, email addresses, and phone numbers from various public sources. The analyst notices that the same person appears with different username formats (e.g., 'john.doe', 'jdoe', 'john_doe'). What is the best way to handle this during data processing?

Delete all records that do not have a verified email address.

Create a separate record for each username variation to preserve all data.

Manually review each record and decide which username is the 'correct' one.

Standardize usernames by removing punctuation and converting to lowercase, then link records that match on other identifiers.

An OSINT team is tasked with monitoring a protest movement on social media. They need to collect a large volume of posts, images, and videos, but they have limited storage and must comply with privacy regulations. Which approach best balances data collection, storage constraints, and legal compliance?

Collect all data in real-time and store it in a cloud storage service with unlimited capacity.

Collect only metadata (timestamps, usernames, locations) and discard the content.

Define specific collection criteria aligned with the intelligence requirement, store only relevant data, and apply retention limits.

Use a third-party service that archives all social media data and provides access on demand.

An analyst is investigating a suspected cybercriminal's online alias. They find a blog post claiming the alias is linked to a specific email address. The blog is anonymous and has no author credentials. What should the analyst do to assess the reliability of this source?

Treat the blog as a primary source because it directly mentions the alias and email.

Ignore the blog entirely because it is anonymous, as anonymous sources are never useful.

Use the blog as the sole basis for the investigation because it is the only source found.

Corroborate the claim with at least one independent source, such as a forum post or public breach database, and check the blog's publication date.

An analyst has collected usernames from various forums and social media sites. The data includes variations like 'JohnDoe', 'john_doe', and 'j.doe'. To correlate these as potentially the same person, what is the first step in data processing?

Store the usernames exactly as collected and rely on manual review.

Create a separate spreadsheet for each username variation.

Delete any usernames that are not identical to each other.

Normalize the usernames by converting to lowercase and removing punctuation and spaces.

An analyst is investigating a phishing campaign that uses a specific domain name. The analyst needs to find all subdomains and related domains that may be part of the infrastructure. Which search strategy is most effective?

Search for the domain name on social media to find mentions of related infrastructure.

Use certificate transparency logs and DNS enumeration tools to discover subdomains and related domains.

Use a search engine query: site:example.com -www

Use a reverse WHOIS lookup to find other domains registered by the same person.

GIAC Open Source Intelligence (GOSI)

Domain 1Objective 3

Searching, Collecting, and Processing Data GOSI Practice Questions (Page 3)

Part of the OSINT Fundamentals and Methodology domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 11–15

11application · medium
An analyst has collected a large dataset of usernames, email addresses, and phone numbers from various public sources. The analyst notices that the same person appears with different username formats (e.g., 'john.doe', 'jdoe', 'john_doe'). What is the best way to handle this during data processing?
Select an answer first
12expert · hard
An OSINT team is tasked with monitoring a protest movement on social media. They need to collect a large volume of posts, images, and videos, but they have limited storage and must comply with privacy regulations. Which approach best balances data collection, storage constraints, and legal compliance?
Select an answer first
13application · medium
An analyst is investigating a suspected cybercriminal's online alias. They find a blog post claiming the alias is linked to a specific email address. The blog is anonymous and has no author credentials. What should the analyst do to assess the reliability of this source?
Select an answer first
14application · medium
An analyst has collected usernames from various forums and social media sites. The data includes variations like 'JohnDoe', 'john_doe', and 'j.doe'. To correlate these as potentially the same person, what is the first step in data processing?
Select an answer first
15expert · hard
An analyst is investigating a phishing campaign that uses a specific domain name. The analyst needs to find all subdomains and related domains that may be part of the infrastructure. Which search strategy is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.