A company wants to scan its public-facing GitHub repositories for accidentally committed AWS access keys. They want to automate this scan to run weekly and send a report to the security team. Which approach is most appropriate?

Set up a Google Alert for 'AWS access key' in the repository name.

Manually download the repositories and run a local scan each week.

Use GitHub's built-in secret scanning, which automatically alerts on known patterns.

Use a GitHub Actions workflow that runs a secret-scanning tool like TruffleHog and posts the results to a Slack channel.

An analyst is tracking a vessel that has turned off its AIS transponder. The analyst needs to estimate its likely destination and route. Which combination of open-source information would be most useful?

Satellite imagery of the entire ocean and weather forecasts.

Other vessels' AIS data in the same region and maritime traffic separation schemes.

Social media posts from the crew and news reports about the vessel.

Historical AIS data from before the transponder was turned off, port schedules, and analysis of typical routes for that vessel type.

A corporate security team needs to monitor public web mentions of their CEO's name, the company's product names, and common phishing lures that impersonate the brand. They want a low-effort solution that sends alerts only when multiple brand-related terms appear together, and they need a shared dashboard for the team. Which approach best meets these requirements?

Configure a Google Alerts query for each brand term separately and have each analyst maintain a personal spreadsheet of results.

Set up a Talkwalker Alerts query using Boolean operators (e.g., CEO name AND product name) and share the dashboard with the team.

Create a custom RSS feed from a news aggregator and subscribe to it in a personal feed reader.

Use a manual search on social media platforms each morning and copy results into a team email.

During an OSINT investigation, an analyst obtains a password-protected ZIP file that is believed to contain leaked credentials. The analyst has a dictionary file of common passwords and a GPU workstation. The ZIP file uses AES-256 encryption. The analyst needs to extract the contents within 24 hours. Which approach is most appropriate?

Contact the file's owner and ask for the password.

Use a dictionary attack with hashcat against the ZIP file's password hash, leveraging the GPU for speed.

Use a brute-force attack that tries every possible combination of characters up to 10 characters long.

Try to bypass the encryption by using a hex editor to modify the ZIP file's header flags.

An analyst is using a third-party web monitoring tool to track discussions about a new product launch. The analyst wants to receive daily digests and also be able to filter out posts from competitors. Which feature should the analyst configure?

Set up real-time alerts for every mention and manually ignore competitor posts.

Set up a daily email digest and add negative keywords for competitor names.

Use the tool's default settings without any customization.

Create a separate dashboard for each competitor and review them all manually.

GIAC Strategic OSINT Analyst

Domain 1Objective 2

Sector-Specific and Practical OSINT GSOA Practice Questions (Page 3)

Part of the OSINT Fundamentals and Global Context domain, which makes up ~44% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~31–53 in this domain), expect 16–27 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 11–15

11application · medium
A company wants to scan its public-facing GitHub repositories for accidentally committed AWS access keys. They want to automate this scan to run weekly and send a report to the security team. Which approach is most appropriate?
Select an answer first
12expert · hard
An analyst is tracking a vessel that has turned off its AIS transponder. The analyst needs to estimate its likely destination and route. Which combination of open-source information would be most useful?
Select an answer first
13application · medium
A corporate security team needs to monitor public web mentions of their CEO's name, the company's product names, and common phishing lures that impersonate the brand. They want a low-effort solution that sends alerts only when multiple brand-related terms appear together, and they need a shared dashboard for the team. Which approach best meets these requirements?
Select an answer first
14expert · hard
During an OSINT investigation, an analyst obtains a password-protected ZIP file that is believed to contain leaked credentials. The analyst has a dictionary file of common passwords and a GPU workstation. The ZIP file uses AES-256 encryption. The analyst needs to extract the contents within 24 hours. Which approach is most appropriate?
Select an answer first
15application · medium
An analyst is using a third-party web monitoring tool to track discussions about a new product launch. The analyst wants to receive daily digests and also be able to filter out posts from competitors. Which feature should the analyst configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.