An analyst maintains a long-term fictitious identity used to interact with sources on both the surface web and a Tor-based forum. The identity has been active for six months. Which practice best preserves the operator's real identity while keeping the persona consistent?

Reuse the same strong password across persona accounts to simplify login and reduce the chance of forgetting it.

Change the persona's name and backstory every few months to avoid detection by forum members.

Occasionally log into the persona's email from the analyst's personal device to check for urgent messages quickly.

Use a dedicated virtual machine with a unique MAC address, a separate browser profile, and a password manager that stores only persona credentials.

Which type of wireless network metadata is most useful for identifying the physical location of a device?

The encryption type used by the network

The SSID of the connected network

The signal strength (RSSI) observed from multiple access points

When collecting OSINT from Dark Web marketplaces, which action is most consistent with legal and ethical boundaries?

Creating an account and making a small purchase to gain vendor trust

Only observing publicly accessible listings and forum posts without interacting

Downloading all marketplace data to a personal device for offline analysis

Using a vendor's real identity to negotiate a deal for intelligence purposes

An analyst is tracing a Bitcoin payment from a ransomware victim to a dark web marketplace. The analyst has identified a transaction that sends Bitcoin to an address associated with the marketplace. Which step is most useful for determining the ultimate destination of the funds?

Look at the transaction's fee and size to estimate the value of the payment.

Use a blockchain explorer to find the IP address that broadcast the transaction.

Follow the transaction graph from the marketplace address to see if the funds are moved to an exchange or another known service.

Search the marketplace's website for a list of its withdrawal addresses.

GIAC Strategic OSINT Analyst

Domain 2Objective 1

Advanced Operational Techniques and Threats GSOA Practice Questions (Page 1)

Part of the Advanced OSINT Tools and Techniques domain, which makes up ~56% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~39–67 in this domain), expect 13–22 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 1–5

1application · medium
An analyst maintains a long-term fictitious identity used to interact with sources on both the surface web and a Tor-based forum. The identity has been active for six months. Which practice best preserves the operator's real identity while keeping the persona consistent?
Select an answer first
2foundation · easy
Which type of wireless network metadata is most useful for identifying the physical location of a device?
Select an answer first
3foundation · easy
Which wireless technology is most commonly used for passive intelligence gathering to detect the presence of devices?
Select an answer first
4foundation · easy
When collecting OSINT from Dark Web marketplaces, which action is most consistent with legal and ethical boundaries?
Select an answer first
5application · medium
An analyst is tracing a Bitcoin payment from a ransomware victim to a dark web marketplace. The analyst has identified a transaction that sends Bitcoin to an address associated with the marketplace. Which step is most useful for determining the ultimate destination of the funds?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.