Advanced Operational Techniques and Threats GSOA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is trying to attribute a Bitcoin address to a specific individual. The analyst has access to public blockchain data and open-source intelligence. Which combination of techniques is most likely to yield a successful attribution?

   • ACluster the address with known exchange deposit addresses and correlate the timing of transactions with public statements or forum posts by the suspect.
   • BUse the address's balance and transaction count to estimate the individual's wealth and spending habits.
   • CSearch the blockchain for addresses that have the same color in a blockchain visualization tool.
   • DLook for addresses that were created on the same day as the suspect's birthday.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An analyst is tasked with creating a fictitious identity to infiltrate a Dark Web forum that requires new members to have a verified email address and a history of posting on other forums. The analyst has a budget for a VPS and a domain. The analyst needs to create a believable identity that can pass the forum's scrutiny. What is the MOST effective approach?

   • APurchase a pre-aged domain and email account from a dark web service to save time.
   • BCreate a new identity on the target forum using a temporary email service and a VPN.
   • CSet up a VPS with a mail server, register a domain that matches the identity's name, and create a few posts on public forums over several weeks before joining the target forum.
   • DUse a free email service and create a social media profile with a few posts, then immediately join the target forum.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which operational security practice is most critical when maintaining a fictitious identity over time?

   • ASharing the identity's credentials with a trusted colleague for backup
   • BRegularly logging in from the same device and IP address to appear consistent
   • CUsing the same password across all accounts to simplify management
   • DSeparating the fictitious identity's accounts and activities from the operator's real identity
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst needs to access a .onion site that is only reachable through Tor. The analyst's organization has a strict policy that all internet traffic must go through a corporate proxy. Which action best complies with the policy while allowing the analyst to access the .onion site?

   • ABypass the corporate proxy by using a personal hotspot to connect to the internet.
   • BAsk the IT department to disable the proxy for the analyst's workstation.
   • CUse a VPN to tunnel Tor traffic outside the corporate network, avoiding the proxy.
   • DUse Tor Browser with a bridge that is configured to connect through the corporate proxy.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is monitoring a Dark Web marketplace that sells stolen credentials. The analyst has found a listing that appears to contain credentials for the analyst's own organization. What is the MOST appropriate action?

   • APurchase the credentials to verify they are valid and then inform the organization.
   • BContact the marketplace administrator to request the listing be removed.
   • CDocument the listing, capture the relevant details, and report it to the organization's incident response team without making a purchase.
   • DIgnore the listing because the organization's security team should handle it.
   Reveal Solution Discussion Select an answer first