A security team is using a secret-scanning tool to monitor public GitHub repositories for exposed credentials. The tool has been flagging many false positives because it detects strings that look like API keys but are actually test placeholders. The team wants to reduce false positives without missing real secrets. Which configuration is most appropriate?

Add allowlist rules for known test patterns and use entropy detection to filter out low-entropy strings.

Disable entropy detection and rely solely on regex patterns for known secret formats.

Manually review every alert and ignore the tool's automated filtering.

Increase the minimum length of detected secrets to 30 characters.

An analyst is setting up a monitoring dashboard to track discussions about a new product launch. The product name is a common English word, causing many irrelevant results. The analyst wants to reduce noise while still capturing legitimate mentions that may use variations like abbreviations or misspellings. Which configuration is most effective?

Use only the product name as a single keyword without any filters or modifiers.

Set up alerts for the product name but only check them once a week to reduce volume.

Monitor only one social media platform to limit the number of mentions.

Use exact-match phrases with quotation marks, add negative keywords for unrelated contexts, and enable fuzzy matching for common misspellings.

A security team is concerned about credentials exposed in public code repositories. They want to automate scanning of their own GitHub organization's repositories, but they also want to monitor for any new commits that might contain secrets. Which approach is most effective?

Perform a one-time manual review of all repositories.

Use a web scraper to periodically download all repositories and search for 'password' strings.

Use a secret-scanning tool that integrates with GitHub and runs on every commit, with alerts to the security team.

Rely on GitHub's built-in secret scanning for public repositories only.

An analyst is researching a target's potential travel patterns by examining open-source transportation information. The analyst wants to identify which airports the target is likely to use based on flight schedules and the target's known residence. Which combination of open-source data would be most useful?

Flight tracking websites and airport departure boards for nearby airports.

Social media posts about the target's favorite restaurants.

The target's public resume listing job titles and employers.

Satellite imagery of the target's neighborhood.

GIAC Strategic OSINT Analyst

Domain 1Objective 2

Sector-Specific and Practical OSINT GSOA Practice Questions (Page 7)

Part of the OSINT Fundamentals and Global Context domain, which makes up ~44% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~31–53 in this domain), expect 16–27 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 31–35

31expert · hard
A security team is using a secret-scanning tool to monitor public GitHub repositories for exposed credentials. The tool has been flagging many false positives because it detects strings that look like API keys but are actually test placeholders. The team wants to reduce false positives without missing real secrets. Which configuration is most appropriate?
Select an answer first
32application · medium
An analyst is setting up a monitoring dashboard to track discussions about a new product launch. The product name is a common English word, causing many irrelevant results. The analyst wants to reduce noise while still capturing legitimate mentions that may use variations like abbreviations or misspellings. Which configuration is most effective?
Select an answer first
33expert · hard
A security team is concerned about credentials exposed in public code repositories. They want to automate scanning of their own GitHub organization's repositories, but they also want to monitor for any new commits that might contain secrets. Which approach is most effective?
Select an answer first
34foundation · easy
When configuring a monitoring tool to track a topic, which parameter is most useful for narrowing results to a specific geographic region?
Select an answer first
35application · medium
An analyst is researching a target's potential travel patterns by examining open-source transportation information. The analyst wants to identify which airports the target is likely to use based on flight schedules and the target's known residence. Which combination of open-source data would be most useful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.

Sector-Specific and Practical OSINT GSOA Practice Questions (Page 7)

Questions 31–35

A security team is concerned about credentials exposed in public code repositories. They want to automate scanning of their own GitHub organization's repositories, but they also want to monitor for any new commits that might contain secrets. Which approach is most effective?

When configuring a monitoring tool to track a topic, which parameter is most useful for narrowing results to a specific geographic region?

Keep studying — OSINT Fundamentals and Global Context