An analyst is tracking a cargo ship's journey using open-source data. The analyst wants to know the ship's current location and its planned route. Which combination of open-source sources would provide this information?

The shipping company's annual report and press releases.

Marine traffic websites and the ship's AIS data.

Weather forecasts for the ocean region.

Port authority websites showing dock schedules.

A security team wants to automatically scan public code repositories for accidentally exposed API keys and passwords. They need a tool that can be integrated into their CI/CD pipeline and provide alerts when new secrets are found. Which tool is best suited for this task?

A manual review of all new commits by a security analyst.

Google Alerts for the company's GitHub organization name.

TruffleHog, configured to scan repositories and send alerts to a Slack channel.

A custom script that searches for the string 'password' in all files.

Which technique is commonly used to gain access to a password-protected file when the password is unknown?

Scanning public repositories for credentials

Analyzing transportation schedules

Setting up a web monitoring alert

A company wants to proactively identify if any of its employees' corporate email addresses or passwords have been exposed in public data breaches. They want an automated solution that continuously monitors and alerts them. Which approach is most effective?

Set up a Google Alert for the company's domain name.

Use a network scanner to scan the company's internal servers for password files.

Manually search Google for the company's domain name and 'password'.

Use a breach monitoring service that scans public breach databases and sends alerts for matching domains.

An analyst is monitoring social media for signs of a planned protest at a transportation hub. The hub has multiple names (e.g., 'Central Station' and 'Main Terminal'). The analyst must capture all relevant posts, including those with misspellings, while excluding posts about other 'central' topics. The monitoring tool supports Boolean operators, negative keywords, and fuzzy matching. Which configuration is most effective?

Use fuzzy matching only, without Boolean operators or negative keywords.

Set up separate alerts for each name but do not use negative keywords.

Use only 'Central Station' as a keyword without any filters.

Use a Boolean query like ('Central Station' OR 'Main Terminal') AND protest, with negative keywords like 'computer' or 'mall', and enable fuzzy matching.

GIAC Strategic OSINT Analyst

Domain 1Objective 2

Sector-Specific and Practical OSINT GSOA Practice Questions (Page 2)

Part of the OSINT Fundamentals and Global Context domain, which makes up ~44% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~31–53 in this domain), expect 16–27 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 6–10

6application · medium
An analyst is tracking a cargo ship's journey using open-source data. The analyst wants to know the ship's current location and its planned route. Which combination of open-source sources would provide this information?
Select an answer first
7application · medium
A security team wants to automatically scan public code repositories for accidentally exposed API keys and passwords. They need a tool that can be integrated into their CI/CD pipeline and provide alerts when new secrets are found. Which tool is best suited for this task?
Select an answer first
8foundation · easy
Which technique is commonly used to gain access to a password-protected file when the password is unknown?
Select an answer first
9application · medium
A company wants to proactively identify if any of its employees' corporate email addresses or passwords have been exposed in public data breaches. They want an automated solution that continuously monitors and alerts them. Which approach is most effective?
Select an answer first
10expert · hard
An analyst is monitoring social media for signs of a planned protest at a transportation hub. The hub has multiple names (e.g., 'Central Station' and 'Main Terminal'). The analyst must capture all relevant posts, including those with misspellings, while excluding posts about other 'central' topics. The monitoring tool supports Boolean operators, negative keywords, and fuzzy matching. Which configuration is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.