GOSI Sample Questions & Answers
Operational-security best practices, search and data-collection automation, and investigating people through social media tie for the biggest weighting, alongside OSINT frameworks and standards, business-intelligence reporting, and domain and IP infrastructure analysis.
Launch the full GOSI simulator →Showing 8 of 17 free samples.
- Question 1Intermediate
Investigating Businesses · Business Intelligence and Risk Analysis
You are investigating a shell company suspected of money laundering. You have identified a website purportedly belonging to the company. Which of the following records would be MOST valuable for identifying the underlying infrastructure provider and potentially the real geographic location of the server, even if the domain uses a privacy protection service?
Show answer & explanation
Correct answer: B
The SOA record often contains the primary nameserver and the email address of the administrator (sometimes unredacted or pointing to a specific provider's pattern), which can reveal the true hosting provider or infrastructure owner even if WHOIS is redacted.
- Question 2BeginnerSelect 2
Privacy and Operational Security Fundamentals · Operational Security Best Practices
Select TWO primary reasons why an OSINT investigator would use a 'sock puppet' account during a social media investigation. (Select TWO)
Show answer & explanation
Correct answers: A, C
The primary purpose of a sock puppet is OPSEC—preventing attribution back to the investigator or their employer.
Many platforms restrict visibility of content (like friends lists or full profiles) to logged-in users or those with some connection. A sock puppet facilitates this access.
- Question 3Intermediate
Searching, Collecting, and Processing Data · Automated Data Collection
A multinational corporation has suffered a data breach. An OSINT analyst is tasked with determining if any executive credentials have been exposed on the dark web. The analyst decides to use an automated tool to search multiple paste sites and marketplaces. Which of the following is the MOST critical technical constraint the analyst must configure to avoid being blocked by these services?
Show answer & explanation
Correct answer: B
Automated scrapers that send requests too quickly will trigger Web Application Firewalls (WAFs) or anti-bot defenses. Configuring appropriate delays (throttling) is essential for sustained collection.
- Question 4Beginner
Network Data and Infrastructure Analysis · Domain, IP, and Network Intelligence
True or False: When conducting a 'passive' OSINT investigation on a target organization's network infrastructure, sending packets directly to the target's firewall to banner grab is considered an acceptable passive technique.
Show answer & explanation
Correct answer: B
This is False. Sending packets directly to a target (Active Scanning) generates logs on their systems and alerts them to the investigation. Passive OSINT relies on third-party sources (like Shodan, Censys, or WHOIS) where the investigator does not touch the target infrastructure directly.
- Question 5Advanced
Investigating Businesses · Business Intelligence and Risk Analysis
Case Study:
Scenario:
You are an OSINT analyst for a financial institution. You are investigating 'TechVibe Solutions', a startup requesting a large loan. They claim to be a 5-year-old company with 50+ employees and a robust proprietary technology stack. You need to verify their claims using only public data.Findings:
- Domain 'techvibe-solutions.com' was registered 3 months ago via a privacy service.
- The 'Team' page lists 5 people with stock photos that reverse image search to multiple other sites.
- LinkedIn shows only 2 employees, both created last month.
- BuiltWith scan of their site shows a generic WordPress template with no custom applications.
Based on these findings, what is the MOST likely conclusion regarding TechVibe Solutions' legitimacy?
Show answer & explanation
Correct answer: C
The discrepancy between the claimed age (5 years) and domain registration (3 months), combined with stock photos for staff and lack of employee presence on LinkedIn, are classic indicators of a synthetic business or fraud.
- Question 6Advanced
Privacy and Operational Security Fundamentals · Operational Security Best Practices
Which of the following browser fingerprinting attributes provides the highest entropy (uniqueness) for identifying a specific device, making it a critical factor to mask during an OSINT investigation?
Show answer & explanation
Correct answer: B
Canvas fingerprinting relies on the unique way a device's GPU and graphics driver render 2D graphics. This varies highly between devices and is difficult to spoof perfectly without breaking functionality, providing high entropy for tracking.
- Question 7Intermediate
Searching, Collecting, and Processing Data · Search Engine Techniques and Data Collection
An analyst needs to verify if a specific image found on a target's social media profile originated from an older source or is original content. Which reverse image search engine is widely considered most effective for identifying faces and social media profiles specifically, due to its facial recognition capabilities?
Show answer & explanation
Correct answer: C
PimEyes is a specialized search engine that uses facial recognition AI to find faces across the web, making it far more effective for identifying people than standard reverse image search engines like Google Images.
- Question 8Intermediate
OSINT Methodology · Open Source Intelligence Fundamentals
When documenting an OSINT investigation for potential legal proceedings, what is the primary purpose of calculating and recording the cryptographic hash (e.g., SHA-256) of a downloaded evidence file?
Show answer & explanation
Correct answer: A
A cryptographic hash acts as a digital fingerprint. If even a single bit of the file changes, the hash changes completely. Recording this at the time of collection proves that the evidence presented later is identical to what was originally found.
Ready for the real thing?
The full GOSI simulator has every exam-style question, timed mode, and instant scoring.