An analyst has been maintaining a fictitious identity for six months to monitor a private forum. The identity has a social media presence, an email account, and a phone number. The analyst needs to access the forum from a new location while traveling. The analyst is concerned that the new location's IP address may be flagged. Which approach is MOST effective to maintain the identity's OPSEC?

Create a new identity for the new location and abandon the current one.

Access the forum from a public Wi-Fi network to mask the IP address.

Use a different browser and clear all cookies before accessing the forum.

Use a VPN that connects to a server in the identity's usual location to maintain a consistent IP address.

An analyst is reviewing a pcap file from a wireless network and needs to identify which devices are using WPA2 encryption. The analyst has captured the 4-way handshake for some devices. Which information in the pcap will help the analyst identify the encrypted devices?

The presence of probe requests from the devices.

The presence of EAPOL frames in the pcap.

The presence of data frames with a high signal strength.

The presence of beacon frames from the access point.

When creating a fictitious identity for OSINT operations, which practice is most essential for making the identity believable across multiple online platforms?

Using a real person's photo and basic information to add authenticity

Creating profiles only on platforms that do not require email verification

Maintaining consistent biographical details, such as name, birthdate, and location, across all profiles

Using a unique, memorable username that stands out on each platform

An analyst is conducting a wireless survey in a dense urban environment to identify all Wi-Fi networks that could be used by a suspect. The analyst has a limited time window and must cover a large area. Which approach is most efficient for collecting the necessary data?

Use a smartphone app that lists nearby Wi-Fi networks but does not log GPS coordinates.

Use a Wi-Fi jammer to force all devices to disconnect, then capture the probe requests to identify networks.

Set up a stationary high-gain antenna on a rooftop and capture all Wi-Fi traffic in the area for the entire time window.

Drive or walk through the area with a laptop in monitor mode and a GPS-enabled wardriving tool that logs BSSIDs, SSIDs, and GPS coordinates.

GIAC Strategic OSINT Analyst

Domain 2Objective 1

Advanced Operational Techniques and Threats GSOA Practice Questions (Page 2)

Part of the Advanced OSINT Tools and Techniques domain, which makes up ~56% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~39–67 in this domain), expect 13–22 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 6–10

6foundation · easy
Which technology is specifically designed to provide anonymous access to the Dark Web by routing traffic through a volunteer network of relays?
Select an answer first
7expert · hard
An analyst has been maintaining a fictitious identity for six months to monitor a private forum. The identity has a social media presence, an email account, and a phone number. The analyst needs to access the forum from a new location while traveling. The analyst is concerned that the new location's IP address may be flagged. Which approach is MOST effective to maintain the identity's OPSEC?
Select an answer first
8application · medium
An analyst is reviewing a pcap file from a wireless network and needs to identify which devices are using WPA2 encryption. The analyst has captured the 4-way handshake for some devices. Which information in the pcap will help the analyst identify the encrypted devices?
Select an answer first
9foundation · easy
When creating a fictitious identity for OSINT operations, which practice is most essential for making the identity believable across multiple online platforms?
Select an answer first
10expert · hard
An analyst is conducting a wireless survey in a dense urban environment to identify all Wi-Fi networks that could be used by a suspect. The analyst has a limited time window and must cover a large area. Which approach is most efficient for collecting the necessary data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.