GIAC Open Source Intelligence Practice Questions
Prepare for GOSI with more than an answer.
- Level
- Practitioner
Domains covered on the exam 6
- OSINT Methodology15%
- Privacy and Operational Security Fundamentals20%
- Searching, Collecting, and Processing Data20%
- Investigating People20%
- Investigating Businesses15%
- Network Data and Infrastructure Analysis10%
- 1
Which automated tool would an analyst most likely use to visually map relationships between entities (domains, IPs, emails, people) using transforms to query various data sources?
Show answer details
Correct answer: C
Maltego is the industry-standard tool for link analysis and data visualization in OSINT, using 'transforms' to query API data sources and graph the results.
- 2
Select TWO publicly accessible databases that an investigator would query to find the historical ownership of a domain name that is currently redacted by privacy protection. (Select TWO)
Show answer details
Correct answer: A, C
Whoisology maintains a large archive of historical WHOIS records, often allowing investigators to see ownership details before privacy protection was enabled.
DomainTools is a premier provider of historical domain data, specifically allowing lookups of past registrant information.
- 3
An analyst is preparing a virtual machine (VM) for an OSINT investigation. Why is it recommended to use a 'Whonix' gateway or similar architecture rather than just installing Tor Browser on a standard Windows VM?
Show answer details
Correct answer: A
Whonix uses a two-VM architecture (Gateway and Workstation). The Workstation has no knowledge of the real external IP; it only sees the Gateway. Even if malware on the Workstation gets root privileges, it cannot find the real IP to leak it, offering superior protection over a simple app-level proxy.
- 4
The 'Wayback Machine' is a critical tool for retrieving deleted content. However, an analyst finds that a target page is not available there. Which other service should the analyst check that also archives web pages and often captures on-demand snapshots?
Show answer details
Correct answer: C
archive.today is a popular alternative to the Wayback Machine. It allows users to manually trigger snapshots and often archives pages that block the Wayback Machine's crawler.
- 5
You are investigating a target who uses the handle 'ZeroCool1995'. Which command-line tool, written in Python, is specifically designed to check for the existence of this username across hundreds of social media sites simultaneously?
Show answer details
Correct answer: C
Sherlock is a popular open-source Python tool that hunts down social media accounts by username across a vast list of platforms.
- 6
A security analyst is conducting an OSINT investigation into a potential threat actor group. The analyst has completed the planning phase and identified the intelligence requirements. According to the standard Intelligence Cycle, which phase should the analyst proceed to next, and what is the primary objective of this phase?
flowchart LR A[Planning & Direction] --> B[?] B --> C[Processing] C --> D[Analysis & Production] D --> E[Dissemination]Show answer details
Correct answer: A
After Planning & Direction, the next phase is Collection. In this phase, the analyst gathers raw data from open sources (such as social media, public records, and technical databases) that addresses the specific intelligence requirements defined in the planning phase.
- 7
During an investigation, an analyst discovers a target's personal blog. To maintain operational security (OPSEC) and prevent the target from identifying the investigator's real IP address, the analyst uses a VPN. However, the analyst is concerned about WebRTC leaks exposing their true IP. Which of the following actions is the MOST effective way to mitigate WebRTC leaks while browsing?
Show answer details
Correct answer: C
WebRTC can bypass VPN tunnels and reveal the local IP address even when a VPN is active. The most effective mitigation is to disable WebRTC in the browser (e.g., media.peerconnection.enabled = false in Firefox) or use a trusted extension to block it.
- 8
Which Google search operator would an analyst use to find Excel spreadsheets containing the word 'budget' located specifically on government websites ending in .gov?
Show answer details
Correct answer: D
The 'site:gov' operator restricts results to government domains, 'filetype:xls' (or xlsx) restricts results to Excel files, and 'budget' searches for the keyword. The correct syntax combines these.
