10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The GOSI exam has 75 questions and runs 2 hours.
These 10 free GOSI questions are organized by exam domain, so you can see how each part of the GIAC Open Source Intelligence Certification (GOSI) blueprint is tested. Reveal the answer and explanation under each question.
Mara owns 19% of the shares and voting rights in a UK company subject to the people with significant control (PSC) regime. Its articles give her the right to appoint five of its seven directors. She holds no board seat herself. How should her control be classified?
Correct answer: C - She qualifies as a PSC because she can appoint a majority of the board.
An analyst needs three years of audited annual financial statements for an SEC-reporting foreign private issuer. Searching its CIK produces annual Forms 20-F and numerous Forms 6-K, but no Forms 10-K. The most efficient way to complete the review is to:
Correct answer: C - Review the annual Forms 20-F for each of the three fiscal years.
Three preserved GitHub API responses contain these account fields: January: login "harborline", id 42117. July: login "coastarc", id 42117. July: login "harborline", id 88742. Which records belong in the same account history?
Correct answer: B - Link the January and July records for ID 42117; track ID 88742 separately.
A post uploaded on 18 September 2026 claims to show that morning's fire at East Quay. The arrangement of cranes, warehouses, and a breakwater matches independent maps of East Quay. A reliably dated archive from May 2024 contains the same moving sequence, including the identical smoke plume and vessel movements. Which assessment accounts for both findings?
Correct answer: B - The footage supports the East Quay location, but it predates the claimed 2026 event.
A DNS note says, 'The hostname no longer exists.' Its supporting evidence is an authoritative response for an AAAA query: NOERROR, an empty answer section, and an SOA record in the authority section. There is no CNAME. Which replacement statement accurately describes this response?
Correct answer: A - No AAAA record was returned; the name may still have records of other types.
Only 203.0.113.160/27 is within the written scope of an infrastructure investigation. A passive-data export contains observations across the entire 203.0.113.0/24 block. The analyst must retain every IP-address value within the authorized prefix, including network and broadcast values if they appear. Select the inclusive range for the export filter.
Correct answer: A - 203.0.113.160 through 203.0.113.191: 32 addresses
Six news sites report that a supplier has closed its only factory. Five reproduce a trade newsletter; the sixth interviews its author, who confirms that the allegation came from one anonymous email. None obtained other evidence of the closure. In a source assessment, these reports represent:
Correct answer: C - One underlying allegation, repeated without independent confirmation of the closure.
During an authorized review of an onion service, an investigator downloads a Word document through Tor Browser and opens it in a desktop word processor inside a dedicated research virtual machine. Monitoring reveals repeated requests to an embedded image URL through the employer's Internet gateway, outside Tor. Which immediate action limits further exposure of that network address?
Correct answer: A - Disconnect the research virtual machine from the network.
A procurement investigator wants Google results restricted to PDF files on harbor.example, containing the exact phrase 'water treatment' and excluding the word 'cancelled'. Which query expresses all four restrictions?
Correct answer: D - site:harbor.example filetype:pdf "water treatment" -cancelled
Two filters are tested against the same 1,000 public posts, all independently reviewed for relevance to an investigation. Of 100 relevant posts, Filter A retrieves 80 and Filter B retrieves 95. A also retrieves 20 irrelevant posts; B retrieves 55. The team can review 160 posts and wants to miss as few relevant posts as possible. Which choice is supported by the test?
Correct answer: D - Use B: it achieves 95% recall and returns 150 posts, within the review limit.
The full bank has 1,020 more GOSI questions with explanations.
Continue in the free practice test →
View plans