An analyst is conducting a wireless survey of a corporate campus to identify rogue access points. The analyst is using a laptop with a wireless adapter that supports monitor mode. Which approach is most effective for detecting rogue APs while staying within legal limits?

Use a deauthentication attack against all detected APs to force clients to reconnect and reveal hidden SSIDs.

Use a directional antenna to sniff traffic from a distance and attempt to decrypt WPA2 handshakes to identify the AP's owner.

Walk around the campus with a smartphone using a Wi-Fi scanner app that also sends probe requests to every channel.

Use a tool like Kismet or Aircrack-ng in monitor mode to passively capture beacon frames and probe requests, then compare the discovered BSSIDs against the organization's authorized AP list.

An analyst is investigating a ransomware payment that was sent to a Bitcoin address. The analyst has identified a cluster of addresses that appear to be controlled by the ransomware group. The group is known to use a new address for each victim. Which technique is most effective for linking multiple ransom payments to the same group?

Use a blockchain explorer to find addresses that have the same first six characters.

Search the blockchain for addresses that were created on the same day as the ransomware attack.

Analyze the spending behavior of the addresses, such as the use of the same exchange deposit addresses or the same change addresses, to cluster them together.

Look for addresses that have the same balance or transaction count.

An analyst is investigating a dark web marketplace that accepts Bitcoin. The analyst has identified a vendor who is selling stolen data. The analyst has traced the vendor's Bitcoin transactions to a cluster of addresses. The analyst wants to attribute the cluster to a specific individual. The analyst has access to a blockchain explorer and a cryptocurrency analytics platform. Which combination of techniques is MOST likely to yield a positive attribution?

Send a small test transaction to the vendor's address to see if it is still active.

Use the blockchain explorer to manually trace every transaction in the cluster and search for the addresses on social media.

Contact the marketplace administrator and request the vendor's identity.

Use the analytics platform to identify the cluster's origin and check for any public labels or law enforcement tags associated with the addresses.

An analyst is creating a fictitious identity to interact with a target on a public forum. The analyst needs the identity to be credible if the target checks the persona's social media profiles. Which action is most important for establishing credibility?

Create profiles quickly and immediately start posting on the target forum to build a presence.

Use a real person's photo and name but change the birthdate to avoid direct matches.

Create a single profile with a unique name and no personal details to avoid leaving traces.

Create profiles on multiple platforms using the same name, photo, and biographical details, and populate them with a few months of realistic posts and interactions.

Which element is most important to establish early when building a fictitious identity for long-term OSINT use?

A set of core biographical facts that remain stable and can be elaborated over time

A backstory that includes minor, believable inconsistencies

A verified email address and phone number tied to the fictitious name

A large number of social media profiles created simultaneously

GIAC Strategic OSINT Analyst

Domain 2Objective 1

Advanced Operational Techniques and Threats GSOA Practice Questions (Page 9)

Part of the Advanced OSINT Tools and Techniques domain, which makes up ~56% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~39–67 in this domain), expect 13–22 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 41–45

41application · medium
An analyst is conducting a wireless survey of a corporate campus to identify rogue access points. The analyst is using a laptop with a wireless adapter that supports monitor mode. Which approach is most effective for detecting rogue APs while staying within legal limits?
Select an answer first
42expert · hard
An analyst is investigating a ransomware payment that was sent to a Bitcoin address. The analyst has identified a cluster of addresses that appear to be controlled by the ransomware group. The group is known to use a new address for each victim. Which technique is most effective for linking multiple ransom payments to the same group?
Select an answer first
43expert · hard
An analyst is investigating a dark web marketplace that accepts Bitcoin. The analyst has identified a vendor who is selling stolen data. The analyst has traced the vendor's Bitcoin transactions to a cluster of addresses. The analyst wants to attribute the cluster to a specific individual. The analyst has access to a blockchain explorer and a cryptocurrency analytics platform. Which combination of techniques is MOST likely to yield a positive attribution?
Select an answer first
44application · medium
An analyst is creating a fictitious identity to interact with a target on a public forum. The analyst needs the identity to be credible if the target checks the persona's social media profiles. Which action is most important for establishing credibility?
Select an answer first
45foundation · easy
Which element is most important to establish early when building a fictitious identity for long-term OSINT use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.