All GIAC exams
Free GSOA practice test: 30 questions with answers
30 original questions for GIAC Strategic OSINT Analyst, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.
- Free questions
- 30
- Full bank
- 100 questions
All 30 GSOA questions with answers
The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.
Reporting and intelligence products (3 questions)
Question 1
A report recommends action on a supplier. Which section should show how confident the analyst is in the key judgements?
- AThe appendix with raw screenshots and unannotated source captures in bulk
- BThe cover page colour scheme, chosen to match the brand guidelines of the company being assessed
- CThe author biography and the analyst's prior publications on related topics
- DKey judgements, with an explicit confidence statement and the evidence behind them
Show answer and explanationHide answer
Correct answer: DKey judgements with explicit confidence and evidence let decision-makers judge the recommendation. Raw screenshots, cover colours, and author biographies do not convey confidence.
Question 2
Which two elements make an intelligence report easier to act on? (Choose two.)
- AA clear bottom line that answers the requirement
- BStated assumptions and limitations of the analysis
- CA long list of raw search results with no synthesis
- DUnsourced claims presented as facts
- EMany decorative charts without explanation
Show answer and explanationHide answer
Correct answer: A, BA clear bottom line and stated assumptions help readers act. Raw results without synthesis, unsourced claims, and decorative charts reduce usefulness and credibility.
Question 3
A strategic report must be shared with partners outside the organisation. Which control protects sensitive content?
- ASend it by an unencrypted channel, such as plain email, since partners trust it
- BPublish the report publicly on the organisation's website, so that partners and the wider public can read it
- CShare the full working file with every detail, including raw source data, draft annotations and notes
- DApply a classification and handling marking, and remove details not needed by the partners
Show answer and explanationHide answer
Correct answer: DApplying classification and minimising content protects sensitive information. Full working files, public publication, and unencrypted channels expose it.
Strategic analysis and forecasting (3 questions)
Question 4
A strategic analyst must estimate whether a competitor will enter a new market within two years. Which kind of judgement is this?
- AA list of present facts about the market, with no forecast
- BA certainty that the competitor will enter the market soon
- CA personal opinion offered with no supporting evidence or reasoning trail
- DA forecast with an explicit time horizon and probability language
Show answer and explanationHide answer
Correct answer: DA forecast with a time horizon and probability language is the appropriate form for future-oriented judgements. Certainty, current facts, and unsupported opinion do not fit.
Question 5
Which technique helps an analyst consider how a situation might develop under different conditions?
- AIgnoring uncertainty by assuming one outcome
- BScenario analysis with alternative plausible futures
- CReading one article from a single news outlet
- DCounting the number of employees on payroll
Show answer and explanationHide answer
Correct answer: BScenario analysis explores alternative plausible futures and their drivers. Single articles, employee counts, and ignoring uncertainty do not explore alternatives.
Question 6
A strategic assessment must identify early warning indicators that a market shift is beginning. Which approach is most suitable?
- ADefine indicators in advance and monitor them against thresholds that trigger review
- BTrack just the most popular news headlines using their volume of coverage as the signal of a market shift
- CMonitor a random sample of unrelated data drawn from weather, sports, and retail feeds each week
- DWait until the shift becomes obvious in published market statistics and trade press reporting
Show answer and explanationHide answer
Correct answer: APredefined indicators with thresholds provide early warning. Waiting for obviousness, headline tracking, and random unrelated data do not give early signals.
Investigation workflow (3 questions)
Question 7
An investigation has many open leads. Which practice helps the analyst prioritise effectively?
- APursue the most exciting lead regardless of relevance, and follow whichever story attracts the most attention
- BRank leads by relevance to the requirement, reliability, and the time available to pursue them
- CPursue the leads in alphabetical order by the first letter of each organisation's name, regardless of case
- DPursue every lead at once without recording progress or tracking status for each item
Show answer and explanationHide answer
Correct answer: BRanking by relevance, reliability, and time makes the investigation efficient. Alphabetical order, excitement, and unstructured pursuit waste effort.
Question 8
An analyst discovers that a key lead was based on a misidentified person. What is the best next step?
- AHide the error from the stakeholder so the briefing reads as consistent with what was already delivered
- BDelete every note about the lead, including the source record and its working file so no trace remains
- CKeep the conclusion and its supporting argument unchanged because it was already written and circulated
- DCorrect the record, re-evaluate related conclusions, and note the error in the working file
Show answer and explanationHide answer
Correct answer: DCorrecting the record and re-evaluating related conclusions keeps the analysis sound. Keeping flawed conclusions, hiding errors, and deleting notes compound the problem.
Question 9
Which practice ensures that another analyst can reproduce an investigation's findings?
- ADocument each search, source, date, and reasoning step in a working file
- BKeep the process in one analyst's memory and personal notes rather than in a shared file
- CUse screenshots and cropped images without the page URL or capture date or time zone
- DShare just the final conclusion and the headline judgement
Show answer and explanationHide answer
Correct answer: ADocumenting searches, sources, dates, and reasoning enables reproduction and review. Memory-only processes, conclusions alone, and context-free screenshots prevent reproduction.
Operational security and legal limits (3 questions)
Question 10
An analyst uses a research account for investigations. Which practice protects the analyst and the investigation?
- ASeparate research accounts and devices from personal accounts and devices
- BShare one research account across the team with the password in a public document
- CLog in with an employee's account without permission
- DUse personal accounts for all research
Show answer and explanationHide answer
Correct answer: ASeparating research from personal accounts reduces exposure and attribution risk. Personal accounts, public passwords, and unauthorised use of others' accounts are unsafe or unlawful.
Question 11
An OSINT investigation identifies personal data about private individuals who are not the subject of the inquiry. What should the analyst do?
- ACollect and publish the personal data in full, since the public interest in transparency outweighs individual expectations of privacy
- BSell the personal data to data brokers and marketing firms, who may combine it with other datasets to build detailed profiles
- CMinimise the personal data collected and handle it according to privacy rules and the investigation's purpose
- DIgnore data protection because it is public and the information was already available on open websites before the investigation began
Show answer and explanationHide answer
Correct answer: CMinimising and handling personal data according to privacy rules and purpose is required. Publishing, selling, and assuming public means no protection are unacceptable.
Question 12
An analyst is asked to use a fake identity to access a restricted online forum. What is the most appropriate response?
- AUse a colleague's real identity without consent to log in and read private threads in the forum
- BAsk the forum administrator to approve a fake identity before the account is created in writing
- CCreate the fake identity immediately and begin browsing the restricted forum without approval
- DDecline or escalate to legal and compliance, since deception may breach terms or law
Show answer and explanationHide answer
Correct answer: DDeception to access restricted areas can breach terms or law, so the request should be escalated. Creating or using identities without authority is not appropriate.
Source evaluation and reliability (2 questions)
Question 13
An analyst evaluates a website that publishes industry statistics. Which factor most affects how much weight to give the statistics?
- AThe number of advertisements and affiliate banners displayed on the page
- BThe length of the domain name and the count of its letters and digits
- CThe publisher's transparency about methods, sources, and dates
- DThe website's colour scheme and the fonts chosen for its layout grid
Show answer and explanationHide answer
Correct answer: CTransparent methods, sources, and dates let the analyst judge reliability. Colours, advertisements, and domain length are weak indicators of reliability.
Question 14
A source has a track record of accurate reporting but is reporting on a topic outside its expertise. How should the analyst treat its claims?
- AAccept them fully and without verification because the source is reliable
- BIgnore the topic and exclude every claim from the working file entirely
- CWeigh them with caution and seek corroboration from a source with relevant expertise
- DReject the source entirely and treat its earlier accurate reporting as worthless
Show answer and explanationHide answer
Correct answer: CReliability is topic-specific, so claims outside expertise need corroboration. Full acceptance, complete rejection, and ignoring the topic are not proportionate.
OSINT methodology and planning (2 questions)
Question 15
An analyst is asked to assess a rival company's expansion plans. What should the analyst define first?
- AThe intelligence requirement, including the decision it must support and the questions to answer
- BThe format of the final slide deck, including its template, colour scheme and fonts
- CThe browser extensions to install, including ad blockers, archive viewer, and a headless scraper with proxy rotation
- DThe list of social media accounts to follow, ranked by posting frequency and reach
Show answer and explanationHide answer
Correct answer: ADefining the intelligence requirement and the decision it supports focuses collection and analysis. Account lists, extensions, and slide formats come after the requirement is clear.
Question 16
Which concept describes the cycle of planning, collection, processing, analysis, and dissemination used in intelligence work?
- AThe intelligence cycle
- BThe billing cycle
- CThe software development lifecycle
- DThe patch cycle only
Show answer and explanationHide answer
Correct answer: AThe intelligence cycle structures intelligence work from requirements through dissemination. The other cycles describe different domains.
Sources and collection (2 questions)
Question 17
Which type of source is typically described as openly available information that does not require special access or deception to obtain?
- AOpen-source intelligence
- BStolen credentials
- CClassified signals intelligence
- DPrivate medical records
Show answer and explanationHide answer
Correct answer: AOpen-source intelligence is publicly available information obtained lawfully and ethically. Classified signals, stolen credentials, and private records are not open sources.
Question 18
An analyst wants to find historical versions of a web page that has since been changed. Which resource is most useful?
- AAsking the page owner for the old version
- BWeb archives that store past captures of pages
- CA search engine's cached snippet from yesterday only
- DThe page's current source code only
Show answer and explanationHide answer
Correct answer: BWeb archives store historical captures of pages, which reveal earlier content. Current code and recent snippets do not show the past, and asking the owner may not be possible or appropriate.
Verification and analysis (2 questions)
Question 19
An image circulating online is claimed to show an event at a specific location. Which verification step is most useful first?
- ACount the pixels in the image and compare the total with the claimed camera's sensor output resolution
- BAsk the person who posted it to confirm and accept their reply as verification of the location
- CCheck the image's metadata and perform a reverse image search to find earlier versions
- DAccept the claim because the image looks convincing and its sharp focus and lighting look authentic
Show answer and explanationHide answer
Correct answer: CMetadata and reverse image search can reveal the original and context, which tests the claim. Appearance, pixel counts, and self-confirmation do not verify the image.
Question 20
Geolocation of a photo is being attempted by an analyst. Which combination of clues is strongest?
- AA single shadow alone cast across a flat surface at an unknown time of day
- BThe photo's colour balance alone, which reflects camera white-balance settings
- CThe posting time alone recorded by the platform in a different time zone
- DMultiple independent clues such as signage, terrain, and shadows that agree on one location
Show answer and explanationHide answer
Correct answer: DSeveral independent clues that agree give stronger geolocation confidence. A single clue, colour balance, or posting time alone is weak evidence.
Geospatial and imagery analysis (2 questions)
Question 21
An analyst wants to compare satellite imagery of a facility over several months to detect changes. Which practice is most important?
- ACompare just the colour balance of the images, since hue shifts reflect real changes
- BUse images with consistent resolution, angle, and timing so that differences reflect real change
- CRely on the image caption alone, since captions summarise what the scene shows accurately
- DUse an image from whichever season, since seasonal variation rarely alters findings
Show answer and explanationHide answer
Correct answer: BConsistent resolution, angle, and timing separate real change from artefacts of collection. Mixed seasons, colour-only comparisons, and captions do not establish change reliably.
Question 22
An analyst notices a change in a satellite image that could be a new construction site or seasonal vegetation change. What should the analyst do?
- APublish the finding right away, since the change is visible and comparison adds little
- BIgnore the change, since a single unconfirmed image is too weak to justify follow-up
- CConclude it is construction immediately, since disturbed ground matches a building pad
- DCompare additional images from different dates and consider seasonal patterns before concluding
Show answer and explanationHide answer
Correct answer: DAdditional dates and seasonal consideration distinguish construction from vegetation change. Immediate conclusions, ignoring, and unverified publication are unsound.
Threat and adversary intelligence (2 questions)
Question 23
An analyst is tracking a threat group's public communications and tooling references. Which product is most valuable for decision-makers?
- AA raw list of every post from the group, sorted by date, with each post's full text and metadata
- BA copy of the group's malware samples, unpacked and archived with their hashes and build IDs
- CAn assessment of the group's likely intent and capability, with confidence levels and indicators to watch
- DA map with no context, showing mainly plotted points, colour-coded by year of activity, produced from unverified coordinate data
Show answer and explanationHide answer
Correct answer: CAn assessment with intent, capability, confidence, and indicators is actionable. Raw posts, malware copies, and context-free maps do not support decisions.
Question 24
A security team asks whether a claimed threat actor is really linked to a known group. What should the analyst provide?
- AA guess based on the group's name, since naming conventions usually indicate a shared origin
- BAn attribution assessment with the evidence, alternative explanations, and a confidence level
- CA refusal to answer, since attribution is inherently uncertain and speculative
- DA definite answer stated with full certainty, without citing supporting evidence
Show answer and explanationHide answer
Correct answer: BAttribution requires evidence, alternatives, and confidence to be useful and honest. Definite answers without evidence, name-based guesses, and refusal are not appropriate.
Social media and people research (2 questions)
Question 25
An analyst wants to know whether a social media account belongs to a specific person. Which approach gives the strongest evidence?
- AAssume the account belongs to them because the name matches and the photo looks similar to them
- BCorroborate the account with independent sources such as the person's verified profiles or public statements
- CCount the followers, since a large follower total shows that the account is authentic and widely trusted within the subject's field
- DAccept the profile photo as proof, since the picture is hosted on the platform and matches the face of the account holder
Show answer and explanationHide answer
Correct answer: BIndependent corroboration is the strongest approach. Profile photos, follower counts, and name matches alone are weak and can be faked or coincidental.
Question 26
A social media campaign appears to be coordinated, with many accounts posting similar messages within minutes. Which indicator is most useful?
- ATiming and content similarity across accounts, assessed against normal behaviour
- BThe accounts' profile backgrounds and banner artwork, which may look alike
- CThe accounts' favourite colours in their theme settings, which vary
- DThe number of emojis used in each post, which varies by topic and tone
Show answer and explanationHide answer
Correct answer: ATiming and content similarity relative to normal behaviour indicate coordination. Colours, emojis, and backgrounds are weak or irrelevant signals.
Stakeholders and requirements (2 questions)
Question 27
An executive asks for intelligence on a topic that the organisation does not need to decide anything about. What should the analyst do?
- ASend a generic report covering the topic broadly to the executive without confirming its use
- BClarify the decision the information would support before spending effort on collection
- CCollect as much material as possible anyway from open sources and sort it later
- DRefuse the request outright without asking what the executive needs to know or why
Show answer and explanationHide answer
Correct answer: BClarifying the decision ensures effort is useful and relevant. Collecting everything, refusing without dialogue, and generic reports do not serve the requirement.
Question 28
A stakeholder wants intelligence delivered in a format they can use in a board meeting. Which practice is most important?
- ASend the raw data dump with every table and export, unedited
- BUse the analyst's own preferred template regardless of audience
- CInclude every finding in full without prioritisation or ranking
- DTailor the length, format, and key messages to the audience and the decision
Show answer and explanationHide answer
Correct answer: DTailoring length, format, and messages to the audience and decision makes intelligence usable. Raw dumps, personal templates, and unprioritised findings reduce usability.
Financial and corporate intelligence (2 questions)
Question 29
An analyst wants to understand who controls a company. Which source type is most useful?
- AA customer's personal blog post describing how they chose the product and enjoy using it
- BA list of office plants kept on each floor, along with their weekly watering schedules
- CCorporate filings that list officers, directors, and major shareholders
- DA company's advertising slogan, which was tested with focus groups before its launch
Show answer and explanationHide answer
Correct answer: CFilings list officers, directors, and major shareholders, which reveal control. Slogans, personal blogs, and plant lists do not reveal control.
Question 30
An analyst finds that several shell companies share the same registered address and director. What might this indicate?
- AThe companies are well run, since shared addresses and directors usually reflect good management
- BNothing of interest, because shared registered addresses and directors are routine in corporate filings
- CA possible link between entities that should be investigated, without assuming wrongdoing
- DProof of fraud, since a shared address and director clearly establish concealment
Show answer and explanationHide answer
Correct answer: CShared addresses and directors are a lead for investigation, not proof of wrongdoing. Declaring fraud, dismissing the link, and assuming good management are unsupported.