Which type of Dark Web content is generally considered acceptable for OSINT collection without crossing legal or ethical lines?

Exploit kits offered for sale on a hacking forum

Illegal marketplace listings for controlled substances

Stolen credit card data shared in a private channel

Publicly posted forum discussions about security topics

Which heuristic is commonly used to link a cryptocurrency address to a real-world identity?

The address has a high transaction volume

The address is stored in a hardware wallet

The address has been active for more than one year

The address was used to transact with a known exchange that requires KYC

An analyst is conducting a wireless survey of a public area to identify Bluetooth devices that may be associated with a suspect. The analyst is using a Bluetooth scanner on a laptop. Which additional step is MOST important to ensure the survey is effective and legal?

Change the laptop's MAC address to avoid detection.

Confirm that the analyst has the legal authority to conduct the survey in the public area.

Use a high-gain antenna to capture Bluetooth signals from as far away as possible.

Deauthenticate all Bluetooth devices to force them to reconnect and reveal their presence.

An analyst is investigating a suspected insider who is using a personal Bluetooth device to exfiltrate data from a secure facility. The analyst has permission to monitor the facility's wireless spectrum. Which technique is most useful for identifying the Bluetooth device and its activity?

Use a Bluetooth jammer to disrupt the device and force it to reconnect, revealing its address.

Use a Bluetooth sniffer to capture inquiry scans and advertising packets, then correlate the device's MAC address with the times the insider is present.

Use a Wi-Fi analyzer to look for Bluetooth signals because they share the 2.4 GHz band.

Use a spectrum analyzer to measure the exact frequency of the Bluetooth transmission and calculate the data being sent.

An analyst maintains a fictitious identity that is used to interact with sources on both surface web and dark web platforms. The analyst notices that the persona's email account has received a phishing email that appears to be from a forum moderator. Which action best protects the persona and the operator?

Reply to the email asking for more information, but do not provide any personal details.

Click the link to see where it leads, but use a VPN to hide the operator's IP address.

Do not click any links in the email, and verify the moderator's request through a separate, known-good communication channel.

Forward the email to the analyst's personal email account for further analysis.

GIAC Strategic OSINT Analyst

Domain 2Objective 1

Advanced Operational Techniques and Threats GSOA Practice Questions (Page 4)

Part of the Advanced OSINT Tools and Techniques domain, which makes up ~56% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~39–67 in this domain), expect 13–22 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 16–20

16foundation · easy
Which type of Dark Web content is generally considered acceptable for OSINT collection without crossing legal or ethical lines?
Select an answer first
17foundation · easy
Which heuristic is commonly used to link a cryptocurrency address to a real-world identity?
Select an answer first
18application · medium
An analyst is conducting a wireless survey of a public area to identify Bluetooth devices that may be associated with a suspect. The analyst is using a Bluetooth scanner on a laptop. Which additional step is MOST important to ensure the survey is effective and legal?
Select an answer first
19application · medium
An analyst is investigating a suspected insider who is using a personal Bluetooth device to exfiltrate data from a secure facility. The analyst has permission to monitor the facility's wireless spectrum. Which technique is most useful for identifying the Bluetooth device and its activity?
Select an answer first
20application · medium
An analyst maintains a fictitious identity that is used to interact with sources on both surface web and dark web platforms. The analyst notices that the persona's email account has received a phishing email that appears to be from a forum moderator. Which action best protects the persona and the operator?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.