An analyst is investigating a ransomware payment that was made to a Bitcoin address. The analyst has identified a cluster of addresses that all sent funds to the same exchange. The analyst wants to attribute the cluster to a specific individual. The analyst has access to a blockchain explorer and a cryptocurrency analytics platform. Which combination of techniques is MOST likely to yield a positive attribution?

Use the analytics platform to identify the cluster's origin and check for any public labels or law enforcement tags associated with the addresses.

Contact the exchange and request the account details for the cluster.

Use the blockchain explorer to manually trace every transaction in the cluster and search for the addresses on social media.

Send a small test transaction to the cluster to see if it is still active.

An OSINT analyst is creating a fictitious identity to monitor a closed cybercrime forum. The identity must appear credible if a forum member searches the person's name, email, and social media. The analyst has already chosen a name and a backstory. Which additional step is most important to make the identity believable and protect the real operator?

Generate a realistic profile photo using an AI image generator and post it on all platforms immediately.

Use a VPN and a dedicated browser profile for all persona activity, but keep the social media accounts empty to avoid leaving traces.

Register the email and social media accounts using the fictitious name, then populate them with a few months of consistent, low-activity posts and connections.

Create the accounts with the fictitious name but use the analyst's real phone number for verification to save time.

What is the purpose of clustering in cryptocurrency attribution analysis?

To encrypt transaction data to protect privacy

To create new cryptocurrency addresses for anonymity

To group multiple addresses that are likely controlled by the same entity

To speed up transaction confirmation times

Which tool is commonly used to trace cryptocurrency transactions on a public blockchain?

Blockchain explorer such as Blockchair or Etherscan

What is the primary characteristic of public blockchain transactions that enables OSINT tracking?

They are encrypted and can only be viewed by the sender and receiver

They are recorded on a public ledger with pseudonymous addresses

They are stored only on the user's device and not shared

They are anonymized by default and cannot be traced

GIAC Strategic OSINT Analyst

Domain 2Objective 1

Advanced Operational Techniques and Threats GSOA Practice Questions (Page 8)

Part of the Advanced OSINT Tools and Techniques domain, which makes up ~56% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~39–67 in this domain), expect 13–22 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 36–40

36expert · hard
An analyst is investigating a ransomware payment that was made to a Bitcoin address. The analyst has identified a cluster of addresses that all sent funds to the same exchange. The analyst wants to attribute the cluster to a specific individual. The analyst has access to a blockchain explorer and a cryptocurrency analytics platform. Which combination of techniques is MOST likely to yield a positive attribution?
Select an answer first
37application · medium
An OSINT analyst is creating a fictitious identity to monitor a closed cybercrime forum. The identity must appear credible if a forum member searches the person's name, email, and social media. The analyst has already chosen a name and a backstory. Which additional step is most important to make the identity believable and protect the real operator?
Select an answer first
38foundation · easy
What is the purpose of clustering in cryptocurrency attribution analysis?
Select an answer first
39foundation · easy
Which tool is commonly used to trace cryptocurrency transactions on a public blockchain?
Select an answer first
40foundation · easy
What is the primary characteristic of public blockchain transactions that enables OSINT tracking?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.