An OSINT analyst is investigating a leaked image that appears to show a confidential document on a desk. The image's metadata is stripped, but the analyst notices the reflection in a nearby window shows a building that does not match the claimed location. The analyst has limited time and must decide the most efficient next step. What should the analyst do?

Check the image's file size and resolution to determine if it was edited.

Perform a detailed shadow analysis to determine the time of day the image was taken.

Use an AI tool to analyze the image for deepfake artifacts.

Use a reverse image search to find the original image and compare the reflection with known buildings.

An analyst is investigating a leaked audio recording that allegedly captures a politician making a controversial statement. The recording has no metadata. The analyst wants to verify if the recording is authentic or edited. Which combination of techniques is most appropriate?

Search for the audio on social media to see if others have posted it.

Perform spectral analysis to look for splicing artifacts and cross-reference the voice with known recordings.

Check the file size and bitrate to determine if it is a high-quality original.

Run the audio through an AI transcription service to check if the words are coherent.

During a protest investigation, an analyst receives a video claiming to show police using excessive force. The video has no metadata, and the analyst cannot find the same footage elsewhere. What is the most reliable next step to verify the video's authenticity?

Accept the video as authentic because the lack of metadata is common after social media uploads.

Use AI-based deepfake detection software to determine if the video is synthetic.

Compare the video with satellite imagery of the location to confirm the scene.

Analyze the video for compression artifacts and check for frame duplication.

Which method is commonly used to detect manipulation in a video by analyzing inconsistencies in compression artifacts across frames?

Forensic analysis of compression artifacts

Metadata timestamp verification

Reverse image search of keyframes

GIAC Strategic OSINT Analyst

Domain 2Objective 2

Multimedia and AI in OSINT GSOA Practice Questions (Page 1)

Part of the Advanced OSINT Tools and Techniques domain, which makes up ~56% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~39–67 in this domain), expect 13–22 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

Questions 1–5

1expert · hard
An OSINT analyst is investigating a leaked image that appears to show a confidential document on a desk. The image's metadata is stripped, but the analyst notices the reflection in a nearby window shows a building that does not match the claimed location. The analyst has limited time and must decide the most efficient next step. What should the analyst do?
Select an answer first
2foundation · easy
Which image verification technique is most appropriate for determining whether an image has been previously published on the internet and locating the earliest known instance?
Select an answer first
3application · medium
An analyst is investigating a leaked audio recording that allegedly captures a politician making a controversial statement. The recording has no metadata. The analyst wants to verify if the recording is authentic or edited. Which combination of techniques is most appropriate?
Select an answer first
4application · medium
During a protest investigation, an analyst receives a video claiming to show police using excessive force. The video has no metadata, and the analyst cannot find the same footage elsewhere. What is the most reliable next step to verify the video's authenticity?
Select an answer first
5foundation · easy
Which method is commonly used to detect manipulation in a video by analyzing inconsistencies in compression artifacts across frames?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.

Multimedia and AI in OSINT GSOA Practice Questions (Page 1)

Questions 1–5

Which image verification technique is most appropriate for determining whether an image has been previously published on the internet and locating the earliest known instance?

An analyst is investigating a leaked audio recording that allegedly captures a politician making a controversial statement. The recording has no metadata. The analyst wants to verify if the recording is authentic or edited. Which combination of techniques is most appropriate?

During a protest investigation, an analyst receives a video claiming to show police using excessive force. The video has no metadata, and the analyst cannot find the same footage elsewhere. What is the most reliable next step to verify the video's authenticity?

Which method is commonly used to detect manipulation in a video by analyzing inconsistencies in compression artifacts across frames?

Keep studying — Advanced OSINT Tools and Techniques