An analyst needs to access a Dark Web forum to collect intelligence on a new ransomware group. The analyst is using Tor Browser on a dedicated laptop. Which additional step is MOST important to protect the analyst's identity before visiting the forum?

Use a VPN in addition to Tor for an extra layer of encryption.

Create a new email address to register on the forum.

Disable JavaScript in Tor Browser's security settings.

Clear the browser cache after each session.

An analyst needs to access a .onion marketplace to collect threat intelligence. The analyst's organization requires that the analyst's real IP address never be exposed to the marketplace and that the session be as isolated as possible. Which setup best meets these requirements?

Run Tor Browser on a dedicated, non-persistent virtual machine that connects through the Tor network and has JavaScript disabled by default.

Use a standard web browser with a proxy extension that routes traffic through a commercial VPN service.

Use the Tor network through a public Wi-Fi hotspot to add an extra layer of anonymity.

Download the Tor Browser bundle onto the analyst's primary workstation and use it without any additional configuration.

An analyst is tracing Bitcoin payments from a ransomware wallet. The analyst has identified a cluster of addresses that appear to belong to the same actor. Which technique is most effective for following the funds to a cryptocurrency exchange?

Use a blockchain explorer to follow the transaction graph and apply common-input-ownership heuristics to identify additional addresses controlled by the actor.

Use a cryptocurrency exchange's internal database to look up the owner of the ransomware wallet.

Look for transactions that occurred at the exact same timestamp as the ransomware payment.

Search the blockchain for addresses that have the same first four characters as the known ransomware wallet.

An OSINT analyst is creating a fictitious identity to monitor a closed social media group discussing a planned protest. The analyst has already chosen a name, a date of birth, and a hometown. To make the identity believable when the group's moderators perform a quick background check, which additional detail should the analyst establish FIRST?

A phone number registered with a VoIP service that can receive SMS verification codes.

A public cryptocurrency wallet with a small transaction history to show financial activity.

A LinkedIn profile listing a plausible employer and a university degree from the chosen hometown.

A matching email address and a social media profile that has existed for at least six months with a few organic posts.

An analyst is tracing Bitcoin payments from a dark web marketplace to a suspected money launderer. The analyst has identified a cluster of addresses that appear to be controlled by the launderer. However, the launderer is using a mixing service to obscure the flow of funds. Which approach is most likely to yield actionable intelligence despite the mixing?

Search the mixing service's website for a list of its users and their transaction histories.

Use a blockchain visualization tool to color the mixed addresses and follow the largest transaction to the launderer's exchange account.

Assume the mixing service is completely effective and abandon the trace, focusing instead on other intelligence sources.

Analyze the timing and amounts of deposits and withdrawals around the mixing service, and correlate them with known events or public statements by the launderer.

GIAC Strategic OSINT Analyst

Domain 2Objective 1

Advanced Operational Techniques and Threats GSOA Practice Questions (Page 7)

Part of the Advanced OSINT Tools and Techniques domain, which makes up ~56% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~39–67 in this domain), expect 13–22 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 31–35

31application · medium
An analyst needs to access a Dark Web forum to collect intelligence on a new ransomware group. The analyst is using Tor Browser on a dedicated laptop. Which additional step is MOST important to protect the analyst's identity before visiting the forum?
Select an answer first
32application · medium
An analyst needs to access a .onion marketplace to collect threat intelligence. The analyst's organization requires that the analyst's real IP address never be exposed to the marketplace and that the session be as isolated as possible. Which setup best meets these requirements?
Select an answer first
33application · medium
An analyst is tracing Bitcoin payments from a ransomware wallet. The analyst has identified a cluster of addresses that appear to belong to the same actor. Which technique is most effective for following the funds to a cryptocurrency exchange?
Select an answer first
34application · medium
An OSINT analyst is creating a fictitious identity to monitor a closed social media group discussing a planned protest. The analyst has already chosen a name, a date of birth, and a hometown. To make the identity believable when the group's moderators perform a quick background check, which additional detail should the analyst establish FIRST?
Select an answer first
35expert · hard
An analyst is tracing Bitcoin payments from a dark web marketplace to a suspected money launderer. The analyst has identified a cluster of addresses that appear to be controlled by the launderer. However, the launderer is using a mixing service to obscure the flow of funds. Which approach is most likely to yield actionable intelligence despite the mixing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.