Advanced Operational Techniques and Threats GSOA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of maintaining a separate browser profile or virtual machine for a fictitious identity?

   • ATo prevent cookies and browser fingerprints from linking the fictitious identity to the operator's real browsing
   • BTo allow the operator to use the same bookmarks and passwords across both identities
   • CTo make it easier to switch between the fictitious identity and the operator's real accounts
   • DTo improve the performance of the operator's main computer
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a key legal consideration when conducting wireless intelligence gathering?

   • AIt is always legal to capture any wireless signal in public
   • BYou must always obtain a warrant before using any wireless monitoring device
   • CPassive monitoring of publicly broadcast signals is generally allowed, but intercepting private communications may be illegal
   • DWireless intelligence gathering is prohibited in all countries
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An analyst is monitoring a Dark Web marketplace that accepts Monero for transactions. The analyst has identified a vendor who is selling stolen data. The analyst wants to trace the vendor's transactions to identify their real identity. The analyst has access to a Monero blockchain explorer. Which approach is MOST effective?

   • AUse a Bitcoin blockchain explorer to trace the vendor's transactions.
   • BSend a small test transaction to the vendor's address to see if it is still active.
   • CContact the marketplace administrator and request the vendor's identity.
   • DAnalyze the Monero blockchain for common input ownership heuristics and check for any public labels or law enforcement tags.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is tasked with identifying a covert Bluetooth beacon that is transmitting data from a secure building. The analyst has permission to monitor the RF spectrum but must not disrupt any legitimate wireless services. The beacon is believed to transmit only for a few seconds every hour. Which approach is most effective for detecting and identifying the beacon?

   • AUse a directional antenna and a receiver to triangulate the beacon's location, but only during the expected transmission window.
   • BUse a spectrum analyzer to watch for spikes in the 2.4 GHz band and manually note the time and frequency of each spike.
   • CUse a Bluetooth jammer to force the beacon to transmit continuously, then use a sniffer to capture its address.
   • DDeploy a network of low-cost Bluetooth sniffers in the building that continuously capture advertising packets, and analyze the captured data for anomalous MAC addresses or payloads.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is analyzing Wi-Fi traffic captured from a corporate network to identify a device that is beaconing to a known command-and-control server. The analyst has a pcap file. Which technique is most effective for identifying the beaconing device?

   • ADecrypt all WPA2 traffic in the pcap using the network's pre-shared key to reveal the device's IP address.
   • BUse a Wi-Fi analyzer to measure the signal strength of each device and locate the beacon.
   • CLook for the highest volume of traffic in the pcap and assume that device is the beacon.
   • DFilter the pcap for DNS queries to the known C2 domain and correlate the source MAC address with the times of the queries.
   Reveal Solution Discussion Select an answer first