You are investigating a malicious IP address. You have confirmed that the IP is assigned to a cloud provider and that the IP's PTR record resolves to a hostname containing the provider's domain. You want to determine whether the IP is currently used by a specific customer of that cloud provider. Which additional data source would be most useful?

WHOIS records for the IP address to see the assigned organization and netname.

Geolocation databases to identify the physical datacenter location.

Passive DNS databases to see which domains have historically resolved to that IP.

Reverse DNS lookups for the IP to see if the PTR record reveals a customer-specific hostname.

Which of the following is a common purpose of visualizing infrastructure relationships during an investigation?

To identify hidden connections and support analytical conclusions

To automate the data collection process

To replace the need for further investigation

To make the investigation report more visually appealing

You have collected a large dataset of domains, IPs, and hosting providers related to a phishing campaign. You need to present the relationships in a way that highlights clusters of infrastructure and supports your conclusion that multiple domains are controlled by the same actor. Which visualization approach is most effective?

Create a pie chart of domain registrars.

Create a bar chart showing the number of domains per hosting provider.

Create a link graph with nodes for domains, IPs, and hosting providers, and edges representing DNS resolutions and WHOIS relationships.

Create a timeline of domain registration dates.

GIAC Open Source Intelligence (GOSI)

Domain 2Objective 3

Network Data and Infrastructure Analysis GOSI Practice Questions (Page 2)

Part of the Target Investigation and Infrastructure Analysis domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 9–14 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 6–10

6application · medium
You are investigating a malicious IP address. You have confirmed that the IP is assigned to a cloud provider and that the IP's PTR record resolves to a hostname containing the provider's domain. You want to determine whether the IP is currently used by a specific customer of that cloud provider. Which additional data source would be most useful?
Select an answer first
7foundation · easy
Which of the following is a common purpose of visualizing infrastructure relationships during an investigation?
Select an answer first
8expert · hard
You have collected a large dataset of domains, IPs, and hosting providers related to a phishing campaign. You need to present the relationships in a way that highlights clusters of infrastructure and supports your conclusion that multiple domains are controlled by the same actor. Which visualization approach is most effective?
Select an answer first
9foundation · easy
An analyst wants to determine the approximate geographic location of a server hosting a target website. Which type of data would provide this information?
Select an answer first
10foundation · easy
Which of the following tools is specifically designed to identify technologies and services running on a target website by analyzing HTTP responses, cookies, and other indicators?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.

Network Data and Infrastructure Analysis GOSI Practice Questions (Page 2)

Questions 6–10

Which of the following is a common purpose of visualizing infrastructure relationships during an investigation?

An analyst wants to determine the approximate geographic location of a server hosting a target website. Which type of data would provide this information?

Which of the following tools is specifically designed to identify technologies and services running on a target website by analyzing HTTP responses, cookies, and other indicators?

Keep studying — Target Investigation and Infrastructure Analysis