An OSINT analyst is examining a photo that supposedly shows a military vehicle in a restricted area. The photo's metadata indicates it was taken with a specific camera model, but the analyst finds that the camera model was discontinued years before the timestamp. What should the analyst conclude?

The photo is definitely authentic because the metadata is consistent.

The camera model was likely re-released under the same name.

The timestamp is likely incorrect because the camera model is old.

The metadata may have been altered or the photo could be a composite.

A video shows a building collapsing, but the analyst cannot find any news reports of such an event. The video metadata shows it was recorded on a smartphone. What is the most appropriate next step to verify the video?

Check if the building in the video matches known landmarks using reverse image search on key frames.

Check the video's file size to see if it is consistent with a smartphone recording.

Analyze the video's audio for background noise that matches the location.

Assume the video is fake because there are no news reports.

When verifying a video, which technique involves examining the video file's embedded information such as creation date, software used, and device model?

Frame-by-frame visual inspection

A video of a political rally is being shared widely. The analyst notices that the video's frame rate is inconsistent and there are jumps in the audio. What is the most appropriate conclusion?

The video is a deepfake because AI-generated videos often have these artifacts.

The video is authentic because the analyst cannot prove it is edited.

The video is authentic because these issues are common in smartphone recordings.

The video is likely edited because frame rate inconsistencies and audio jumps are signs of manipulation.

GIAC Strategic OSINT Analyst

Domain 2Objective 2

Multimedia and AI in OSINT GSOA Practice Questions (Page 4)

Part of the Advanced OSINT Tools and Techniques domain, which makes up ~56% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~39–67 in this domain), expect 13–22 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

Questions 16–20

16application · medium
An OSINT analyst is examining a photo that supposedly shows a military vehicle in a restricted area. The photo's metadata indicates it was taken with a specific camera model, but the analyst finds that the camera model was discontinued years before the timestamp. What should the analyst conclude?
Select an answer first
17expert · hard
A video shows a building collapsing, but the analyst cannot find any news reports of such an event. The video metadata shows it was recorded on a smartphone. What is the most appropriate next step to verify the video?
Select an answer first
18foundation · easy
Which AI technique is commonly used in OSINT to automatically extract named entities such as people, organizations, and locations from unstructured text data?
Select an answer first
19foundation · easy
When verifying a video, which technique involves examining the video file's embedded information such as creation date, software used, and device model?
Select an answer first
20application · medium
A video of a political rally is being shared widely. The analyst notices that the video's frame rate is inconsistent and there are jumps in the audio. What is the most appropriate conclusion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOA” is a trademark of its owner, used for identification only.