An analyst is creating a fictitious identity for a social media investigation. The identity needs to appear as a middle-aged professional who is interested in photography. The analyst has already created an email address and a social media profile. Which additional step is MOST important to make the identity believable?

Use a profile picture of a random person found on the internet.

Set the profile to private so that only friends can see the posts.

Post photos of landscapes and everyday scenes that are consistent with the identity's stated location and interests.

Create a second email address to use for account recovery.

An analyst is monitoring a dark web forum that discusses ransomware operations. The analyst wants to collect intelligence on a specific threat actor without engaging in illegal activity. Which action is appropriate?

Read and archive the actor's public posts, noting the dates, times, and any cryptocurrency addresses mentioned.

Send the actor a private message asking for a sample of their ransomware to analyze.

Purchase a small amount of the actor's stolen data to verify their claims.

Attempt to hack into the actor's account to read private messages.

An analyst is analyzing a Bitcoin transaction where a user sent funds from an address associated with a dark web marketplace to a newly created address. The new address then sent a small amount to a known exchange. What does this pattern MOST likely indicate?

The user is attempting to break the transaction trail by using a new address before cashing out.

The user is paying a fee to the exchange for a service.

The user is making a charitable donation to the exchange.

The user is sending a tip to the exchange's support team.

An analyst has been maintaining a fictitious identity for three months to monitor a private forum. The identity has a social media presence, an email account, and a phone number. The analyst needs to post a message that includes a photo of a local park. What is the most important OPSEC consideration before posting?

Use a different phone number to post the message so the forum cannot correlate it with the identity's usual access pattern.

Ensure the photo's EXIF data has been stripped and the image is not reverse-searchable to the analyst's real accounts.

Confirm that the photo has not been previously posted by any other user on the forum.

Verify that the park is not within a reasonable distance from the fictitious identity's stated hometown.

What is a common method to extract actionable intelligence from wireless network traffic without decrypting the data?

Brute-forcing the Wi-Fi password to access the network

Analyzing packet headers and metadata, such as MAC addresses and signal strength

Deauthenticating devices to force them to reconnect and reveal their passwords

Using a packet sniffer to read the content of encrypted messages

GIAC Strategic OSINT Analyst

Domain 2Objective 1

Advanced Operational Techniques and Threats GSOA Practice Questions (Page 6)

Part of the Advanced OSINT Tools and Techniques domain, which makes up ~56% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~39–67 in this domain), expect 13–22 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 26–30

26application · medium
An analyst is creating a fictitious identity for a social media investigation. The identity needs to appear as a middle-aged professional who is interested in photography. The analyst has already created an email address and a social media profile. Which additional step is MOST important to make the identity believable?
Select an answer first
27application · medium
An analyst is monitoring a dark web forum that discusses ransomware operations. The analyst wants to collect intelligence on a specific threat actor without engaging in illegal activity. Which action is appropriate?
Select an answer first
28application · medium
An analyst is analyzing a Bitcoin transaction where a user sent funds from an address associated with a dark web marketplace to a newly created address. The new address then sent a small amount to a known exchange. What does this pattern MOST likely indicate?
Select an answer first
29application · medium
An analyst has been maintaining a fictitious identity for three months to monitor a private forum. The identity has a social media presence, an email account, and a phone number. The analyst needs to post a message that includes a photo of a local park. What is the most important OPSEC consideration before posting?
Select an answer first
30foundation · easy
What is a common method to extract actionable intelligence from wireless network traffic without decrypting the data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.