Identifying OSINT Usage in Security Activities

SY0-701 By islever Editorial Last updated

Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

A Social engineering testing utilizes OSINT to gather publicly available information about targets for reconnaissance and attack preparation.

Question

Which of the following activities uses OSINT?
  1. Social engineering testing Correct Answer
  2. Data analysis of logs
  3. Collecting evidence of malicious activity
  4. Producing IOC for malicious artifacts

Key Takeaways

The core trap is confusing active evidence collection or log analysis with passive intelligence gathering from open sources used for social engineering.

This question tests the application of Open-Source Intelligence (OSINT) to identify which security activity primarily relies on publicly available information gathering.

Common mistake: Many learners select 'Collecting evidence of malicious activity' because they associate OSINT with threat hunting, but OSINT is most distinctively characterized by its use in pre-attack reconnaissance and social engineering testing.

Expert Analysis

Why the Answer Is Correct

Open-Source Intelligence (OSINT) refers to the collection and analysis of information gathered from public sources such as social media, websites, and public records. Social engineering testing heavily relies on this phase to gather personal details about targets (e.g., employee names, roles, relationships) to craft convincing phishing campaigns or pretexting scenarios. Therefore, using OSINT is a fundamental part of social engineering testing.

Why the Other Options Are Wrong

Data analysis of logs (B) typically involves internal systems like SIEMs, not public sources. Collecting evidence of malicious activity (C) often involves forensic analysis of internal artifacts or private threat feeds, though it can use OSINT, it is not the primary definition. Producing IOC for malicious artifacts (D) is an output of analysis, not necessarily a data-gathering activity from open sources.

Community Comment Notes

Community consensus strongly supports A, noting that hackers use OSINT to find victim info before attacking. One commenter highlighted how LinkedIn and company websites are used for employee data gathering. Another user incorrectly argued for C, but the majority correctly identified the link between public info gathering and social engineering.

Exam Strategy

When you see 'publicly available information' or 'open sources', immediately think OSINT. Then, determine which activity uses that info: Reconnaissance and Social Engineering are the top two candidates.

Frequently Asked Questions

Why isn't collecting evidence of malicious activity the best answer?

While OSINT can support threat hunting, 'collecting evidence' is a broad term often involving internal forensics. Social engineering testing is explicitly defined by its reliance on public data gathering.

What are common OSINT sources for social engineering?

Common sources include LinkedIn for professional connections, company websites for org charts, and public social media posts for personal interests.

More SY0-701 FAQ →

Community Votes

A
75%
C
25%

75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. 9149f41 👍 2 Answered A
    Hacker collect finds the target victim, and it's info in the open sources, eventually attacking. OSINT for Social Engineering Testing: Information Gathering: Employee names from LinkedIn Company structure from websites Email formats from public posts Phone numbers from directories Office locations from Google Maps
  2. Anyio 👍 1 Answered A
    Answer: A. Social engineering testing Open Source Intelligence (OSINT) involves gathering information from publicly available sources. Social engineering testing often uses OSINT to collect data about individuals or organizations to craft convincing phishing attacks or other social engineering tactics. Why the other options are not correct: C. Collecting evidence of malicious activity Collecting evidence of malicious activity typically involves forensic analysis of compromised systems or networks, which relies on internal data and artifacts rather than publicly available information. D. Producing IOCs for malicious artifacts Producing Indicators of Compromise (IOCs) involves analyzing malware or attack patterns to create signatures or identifiers. This process is based on technical analysis of malicious artifacts, not on publicly available information.
  3. Kesha 👍 1 Answered C
    OSINT (Open-Source Intelligence) refers to gathering publicly available information from sources like websites, social media, forums, and public records. Collecting evidence of malicious activity often involves analyzing public threat reports, leaked data, or attacker footprints found in open sources.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide