GIAC GOSI Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Open Source Intelligence (GOSI) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GOSI certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GOSI Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Open Source Intelligence (GOSI) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Open Source Intelligence exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GOSI Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GOSI Sample Questions:
01. During an authorized subdomain brute-force of example.net, every candidate name returns the address 192.0.2.50, including a random test string such as qz7x0v1.example.net.
What does this indicate?
a) The names point at a released cloud resource open to takeover
b) A wildcard record is answering for any name
c) The client runs hundreds of live subdomains on a single server
d) The resolver is returning a stale cached answer for the domain
02. Before running a collection script against a public website, an analyst reads the site's robots.txt file. What does this file tell the analyst?
a) Which pages the site has listed for search-engine indexing
b) Which directories the web server blocks from all visitors
c) The license terms for reusing the site's content
d) Which paths the site operator asks automated crawlers not to request
03. For an exposure review, an analyst needs every indexed PDF on a client's many subdomains. The query site:example.com filetype:pdf reports about 48,000 results, but the engine stops serving new result pages long before that many have been listed.
How should the analyst collect as much of the set as possible?
a) Report the 48,000 estimate to the client as the size of the exposure
b) Split it into narrower queries by subdomain or date range, then merge and de-duplicate the results
c) Increase the results-per-page setting to its maximum and page through until the reported total is reached
d) Repeat the same query on successive days and merge each day's results
04. For a vendor-risk report, an analyst checks who directs a supplier. The national company registry entry, last updated eleven months ago, lists one director. A trade-press article from three weeks ago reports that a different person was appointed director last month, quoting the supplier's own announcement.
How should the analyst handle the conflict in the report?
a) Report the newly appointed director, since the article is the more recent source
b) Leave the directorship out of the report until both sources agree, and mention the gap in the scope notes
c) Report both with their dates, note the registry may lag the change and look for a newer filing
d) Report the registry's director alone, since an official government record outranks press coverage
05. To save time, an investigator verified two unrelated research personas on the same platform with the same prepaid phone number. Neither the number nor either persona has ever been connected to the investigator's personal details.
What is the main OPSEC risk of this shortcut?
a) Phone verification reports the persona's VPN exit address to the mobile carrier
b) The platform can link the personas, so exposing one exposes both
c) Codes for one persona could arrive during the other's session
d) Anyone can search the carrier's records to find who bought the prepaid number
06. People-search and data-broker sites build profiles by compiling public and commercial records automatically. Which error is most characteristic of these compiled profiles?
a) Phone numbers left off whenever the subscriber has an unlisted line
b) Court and property records excluded from the compiled profile
c) Only information the subject chose to post about themselves
d) Records of different people who share a name merged into one profile
07. While observing a subject's public channel, an investigator's research persona receives a message from the subject: "Who are you and why do you keep viewing my posts?" The same persona is also in use on two related cases.
What is the best response?
a) Stop using the persona on this and the related cases, and record in the persona log why it was retired
b) Change the persona's name and photo, then continue observing the channel
c) Keep the persona on the related cases but move it to a new VPN exit address
d) Reply with a friendly cover story and keep observing the subject's posts
08. A research persona presents itself as a nurse living in a country seven hours ahead of the investigator. Every post, comment and login from the persona happens between 09:00 and 17:00 in the investigator's own time zone, which is the middle of the night where the persona claims to live.
Which change best removes this attribution signal?
a) Set the research VM's clock to the persona's time zone
b) Post less often so the timing pattern rests on fewer data points
c) Route all of the persona's traffic through a VPN exit in its claimed home country
d) Schedule the persona's activity for plausible hours in its claimed time zone
09. Early in an investigation, an analyst concluded that a leaked internal memo came from a disgruntled contractor. Every later finding has been read as support for that view, and the report is due next week.
Which two steps best test the conclusion against the analyst's own bias?
(Choose two.)
a) Have a colleague outside the case argue the strongest alternative explanation
b) List competing explanations and score each finding against every one of them
c) Rank the current findings by how strongly each one supports the contractor theory
d) Gather further findings about the contractor to strengthen the existing case
10. Two days after an extremist forum's members noticed that researchers were quoting their posts, a new account posts a "leaked" spreadsheet naming the forum's administrator as a specific local teacher, with his workplace and photo. It is the first identifying lead the investigation has found.
How should the investigator treat the spreadsheet?
a) As possible bait for investigators, to test before naming anyone
b) As reportable once the teacher's workplace and photo match his public profiles
c) As unusable, and delete it so unverified personal data is not retained
d) As a strong lead, since leaks from inside a group are usually genuine
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: d |
Question: 03 Answer: b |
Question: 04 Answer: c |
Question: 05 Answer: a |
|
Question: 06 Answer: d |
Question: 07 Answer: a |
Question: 08 Answer: d |
Question: 09 Answer: a, b |
Question: 10 Answer: a |
Note: For any error in GIAC Open Source Intelligence (GOSI) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
