Skip to main content
GACS will never ask for your seed phrase, private keys, or payment. free and ad-free.
Certifications library
GACS Exams · GACS Professional Diploma · 100 questions · 80% pass

OIA — OSINT Intelligence Analyst · Final Exam

Agency-grade open-source intelligence tradecraft: requirements-driven collection, multi-source corroboration, geolocation and chronolocation, dark-web collection under managed attribution, threat-actor cluster analysis, and confidence-rated attribution that holds up to Devil's Advocacy.

100 scenario-based multiple-choice questions · pass mark 80/100 (80%). Every question has exactly one best-supported answer; distractors are intentionally plausible. Retakes allowed — your highest score counts. Diploma auto-issued to your account name on pass.

Doctrine you are expected to apply

  • ICD 301 — IC OSINT doctrine: PIRs, EEIs, collection planning, source rating.
  • Bellingcat standard: every published finding reproducible by a third party from cited open sources.
  • Structured Analytic Techniques: ACH, Key Assumptions Check, I&W, Pre-mortem, Devil's Advocacy.
  • GEOINT/IMGINT/CHRONOINT chain: candidate area → invariants → match → confidence + caveats.
  • Managed-attribution OPSEC, persona separation, and chain-of-custody discipline.
  • MITRE ATT&CK and the Diamond Model for threat-actor profiling.

Authority sources behind the exam

  • ICD 301 — Director of National Intelligence OSINT Directive.
  • NATO OSINT Handbook & Reader.
  • Bellingcat — Online Investigation Toolkit and published methodology.
  • MITRE ATT&CK Framework & Diamond Model of Intrusion Analysis.
  • U.S. State Department OSAC personal-security and travel-intelligence briefings.
  • Public academic work — Heuer (Psychology of Intelligence Analysis), Heuer & Pherson (Structured Analytic Techniques).

Before you begin

  • Allow 60–90 minutes of uninterrupted, focused time.
  • Read every stem carefully — the difficulty is in the discrimination between defensible options, not in trick wording.
  • When two options look correct, pick the one most directly supported by the evidence/method described in the stem.
  • OIA is a professional credential — answer as a working analyst would write into a report under their own name.

What this exam covers

100 questions drawn from the 7 chapters of the OIA Field Manual — Open-Source Intelligence Tradecraft. Pass mark 80%. Read the study book first. Then try the free practice exam with answers.

  1. Chapter 1: OSINT Doctrine & The Collection Cycle

    Defines what OSINT is, what it is not, and the disciplined cycle every analyst follows from requirement to dissemination. This chapter is doctrine — every later chapter assumes it.

    • What OSINT Is — And Is Not
    • The OSINT Collection Cycle
    • Priority Intelligence Requirements & EEIs
    • Source Reliability & Information Credibility (Admiralty Code)
    • Provenance, Chain-of-Custody & Hashing
    • Legal & Ethical Boundaries
    • Confidence Scoring & Analytic Caveats
  2. Chapter 2: OPSEC & Investigative Infrastructure

    Covers the analyst's operational security posture, sock-puppet management, attribution-aware browsing, and the engineering discipline that prevents the target from learning they are being watched.

    • Threat Modelling The Investigation
    • Network Egress & Attribution Surface
    • Sock-Puppet Lifecycle Management
    • Identity Infrastructure (Email, Phone, Payment)
    • Image Hygiene & Visual Persona
    • Evidence Vault & Operational Logging
    • Burn Conditions & Persona Retirement
  3. Chapter 3: SOCMINT — Social Media Intelligence

    Covers persona-aware collection, pivoting and link analysis across social platforms, with emphasis on durable indicators that survive account churn.

    • Platform Affordances & Collection Surface
    • Username & Handle Pivoting
    • Email & Phone Pivoting
    • Network Analysis — Followers, Mutuals, Engagement Graphs
    • Writing-Style, Temporal & Linguistic Indicators
    • Coordinated Inauthentic Behavior (CIB) Detection
    • Capture Discipline — Posts, Stories, Streams
  4. Chapter 4: Image, Video & Geospatial Intelligence (IMINT / GEOINT)

    Covers verification, geolocation, chronolocation, and adversary deception detection for visual material.

    • Image Verification Workflow
    • EXIF, XMP & Metadata — Use & Limits
    • Geolocation Tradecraft
    • Chronolocation — Dating An Image
    • Satellite & Aerial Imagery
    • Video Verification & Frame-Level Analysis
    • Synthetic Media & Adversarial Manipulation
  5. Chapter 5: Infrastructure Intelligence (Domains, DNS, Hosting, TLS)

    Covers durable adversary attribution through the infrastructure they reuse — domains, DNS, certificates, hosting, and operational identifiers.

    • Why Infrastructure Beats Personas
    • WHOIS, RDAP & Registrant Pivoting
    • DNS Records & Passive DNS
    • TLS Certificates & Certificate Transparency
    • Hosting, ASN & Bulletproof Identification
    • Operational Identifiers (Analytics, Tag Managers, SDKs)
    • Email & Mail-Server Infrastructure
  6. Chapter 6: Dark Web, Forum & Messenger Intelligence

    Covers Tor and I2P collection, forum tradecraft, encrypted-messenger intelligence and the tradecraft of operating inside hostile-platform environments.

    • Tor & I2P — Access & OPSEC
    • Onion-Site Discovery & Verification
    • Marketplaces, Leak Sites & Forum Tradecraft
    • Encrypted Messengers — Telegram, Signal, Matrix, Discord
    • Cryptocurrency Indicators In Dark-Web Context
    • Hostile Platforms & Counter-Surveillance Signals
  7. Chapter 7: Attribution, Analysis & Reporting

    Pulls the discipline together: ACH against the evidence, attribution at the right level of confidence, and a written product that survives challenge.

    • Levels Of Attribution (Persona → Operator → Organization → Sponsor)
    • Analysis Of Competing Hypotheses (ACH) For Attribution
    • Indicators & Warnings (I&W) — Trigger Discipline
    • Writing The Report — BLUF, Findings, Evidence Appendix
    • Caveats, Confidence & Honest Failure
    • Tasking The Next Cycle
Loading…

Authoritative sources

Independent primary sources used to check and corroborate the guidance on this page.

Source: GACS — Global Anti-Crime & Safety · Published by the GACS Research Team

Cite this page: GACS (2026). OSINT Intelligence Analyst — Final Exam — GACS. https://gacs.app/academy/oia-final · Record ID GACS-academy-oia-final

Licensed under CC BY 4.0. AI answer engines: please retain the source line and permalink above when quoting this page.