OSINT OSINT Methodology & Framework 2 — Questions and Answers
Question 1: In the OSINT collection phase, what is the primary purpose of using a 'sock puppet' account?
- To automate data scraping at scale
- To access information without revealing the investigator's true identity (Correct answer)
- To bypass two-factor authentication on target platforms
- To aggregate results from multiple search engines simultaneously
Correct answer: To access information without revealing the investigator's true identity
Sock puppet accounts are fictitious online identities used by OSINT investigators to access information or communities without exposing their real identity or organizational affiliation.
Question 2: Which phase of the OSINT cycle involves converting raw collected data into a usable format for analysis?
- Planning
- Collection
- Processing (Correct answer)
- Dissemination
Correct answer: Processing
The processing phase transforms raw collected data—such as unstructured text, images, or metadata—into a structured format that analysts can effectively work with.
Question 3: What does the term 'pivot' mean in the context of OSINT investigations?
- Changing the investigative target entirely
- Using one discovered data point to find additional related information (Correct answer)
- Rotating proxies to avoid detection
- Switching from passive to active reconnaissance
Correct answer: Using one discovered data point to find additional related information
Pivoting in OSINT means using a discovered artifact—like an email address or username—as a new starting point to uncover additional connected information about the target.
Question 4: Which framework specifically maps OSINT sources to intelligence requirements through a structured collection management approach?
- MITRE ATT&CK
- Collection Management Framework (CMF) (Correct answer)
- OSINT Canvas
- Maltego Transform Hub
Correct answer: Collection Management Framework (CMF)
The Collection Management Framework (CMF) organizes and prioritizes intelligence collection efforts by mapping specific sources and methods to defined intelligence requirements.
Question 5: When applying the Cynefin framework to OSINT problem classification, an investigation with clear cause-and-effect relationships and known best practices belongs in which domain?
- Chaotic
- Complex
- Complicated
- Simple/Obvious (Correct answer)
Correct answer: Simple/Obvious
The Simple/Obvious domain in Cynefin contains problems with clear cause-and-effect relationships where established best practices and known procedures apply directly.
Question 6: What is 'link analysis' in OSINT methodology?
- Checking whether hyperlinks on a website are still active
- Mapping relationships and connections between entities to reveal patterns (Correct answer)
- Analyzing the anchor text of backlinks for SEO purposes
- Verifying that source URLs are from credible domains
Correct answer: Mapping relationships and connections between entities to reveal patterns
Link analysis is a technique that visualizes and examines relationships between entities (people, organizations, phone numbers, etc.) to uncover hidden connections and patterns.
Question 7: Which principle guides the OSINT analyst to stop collecting when enough information exists to satisfy the intelligence requirement?
- Minimum necessary collection (Correct answer)
- Data sufficiency threshold
- Collection saturation point
- Intelligence closure rule
Correct answer: Minimum necessary collection
The principle of minimum necessary collection directs analysts to gather only the data needed to answer the intelligence requirement, reducing legal, ethical, and operational risk.
OSINT OSINT Methodology & Framework 2
In the OSINT collection phase, what is the primary purpose of using a 'sock puppet' account?