During an OSINT investigation, an analyst obtains a password-protected ZIP file from a public forum. The file may contain evidence related to a threat actor. The analyst has a list of common passwords from previous breaches. What is the most appropriate technical method to attempt access?

Use a password-cracking tool with a dictionary attack using the breached password list.

Use a brute-force attack that tries every possible character combination up to 10 characters.

Try to open the file with a hex editor and manually remove the password flag.

Ask the forum administrator for the password.

An analyst is tasked with monitoring for mentions of a company's new product across multiple forums and social media. The product name is also a common term. The analyst wants to set up alerts that minimize false positives while capturing relevant discussions, including misspellings. Which configuration is most effective?

Use exact-phrase matching with negative keywords and enable fuzzy matching for common misspellings.

Use only the product name as a keyword without any filters.

Monitor only one platform to reduce volume.

Set up alerts for the product name but only check them once a day.

A company wants to continuously monitor for any of its employees' credentials appearing in public data breaches. They have a list of corporate email addresses and want automated alerts. Which approach is most appropriate?

Manually check breach databases periodically using a web browser.

Set up a honeypot email account to attract phishing attempts.

Subscribe to a breach-monitoring service that scans public breach databases and sends alerts for matching emails.

Use a password-cracking tool to test employee passwords against common lists.

An analyst has a password-protected Excel file that contains a list of usernames and hashes. The analyst knows the password is a variation of a common word with a number appended. Which method is most efficient to attempt to open the file?

Use a brute-force attack that tries all combinations of letters and numbers up to 10 characters.

Try to open the file in a text editor and read the raw data.

Search the internet for the file's filename to find a password.

Use a rule-based dictionary attack that appends common numbers to words from a wordlist.

A non-profit organization wants to monitor public sentiment about their cause across multiple platforms. They have a small team and need a cost-effective solution that provides a unified dashboard and email alerts. Which approach is most suitable?

Build a custom monitoring system from scratch using open-source software.

Use a free or low-cost third-party social media monitoring tool that supports multiple platforms, custom dashboards, and alerts.

Use a single-platform monitoring tool that only tracks one social network.

Hire a full-time analyst to manually monitor all platforms and compile reports.

GIAC Strategic OSINT Analyst

Domain 1Objective 2

Sector-Specific and Practical OSINT GSOA Practice Questions (Page 4)

Part of the OSINT Fundamentals and Global Context domain, which makes up ~44% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~31–53 in this domain), expect 16–27 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 16–20

16application · medium
During an OSINT investigation, an analyst obtains a password-protected ZIP file from a public forum. The file may contain evidence related to a threat actor. The analyst has a list of common passwords from previous breaches. What is the most appropriate technical method to attempt access?
Select an answer first
17application · medium
An analyst is tasked with monitoring for mentions of a company's new product across multiple forums and social media. The product name is also a common term. The analyst wants to set up alerts that minimize false positives while capturing relevant discussions, including misspellings. Which configuration is most effective?
Select an answer first
18application · medium
A company wants to continuously monitor for any of its employees' credentials appearing in public data breaches. They have a list of corporate email addresses and want automated alerts. Which approach is most appropriate?
Select an answer first
19application · medium
An analyst has a password-protected Excel file that contains a list of usernames and hashes. The analyst knows the password is a variation of a common word with a number appended. Which method is most efficient to attempt to open the file?
Select an answer first
20application · medium
A non-profit organization wants to monitor public sentiment about their cause across multiple platforms. They have a small team and need a cost-effective solution that provides a unified dashboard and email alerts. Which approach is most suitable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.