You are profiling a web server that hosts a target application. You need to determine the web server software, its version, and the operating system, but you want to avoid sending malformed packets that could trigger an IDS. Which technique is most appropriate?

Use a tool like Nmap with OS detection enabled (-O) against the server.

Perform a full TCP connect scan on all 65535 ports to identify services.

Connect to port 22 and read the SSH banner.

Send a standard HTTP GET request and analyze the 'Server' header in the response.

You are analyzing the DNS records of 'example.com' and notice a TXT record containing 'v=spf1 include:_spf.example.net ~all'. What does this indicate?

The domain is using a third-party email service like Google Workspace.

The domain authorizes the mail servers listed in '_spf.example.net' to send email on its behalf.

The domain has a subdomain named '_spf.example.net' that hosts a website.

The domain's name servers are located at 'example.net'.

An analyst is mapping a target's external infrastructure. They have a single known domain and want to quickly identify additional subdomains and mail servers without sending any traffic to the target. Which approach best meets this requirement?

Perform a zone transfer attempt against the domain's authoritative DNS servers.

Use a search engine to look for the domain in indexed pages and extract subdomains from URLs.

Query certificate transparency logs for the domain and inspect DNS MX records via a passive DNS service.

Run a subdomain brute-force tool against the domain using a common wordlist.

An analyst is investigating a suspected phishing campaign. They have a single malicious domain and want to identify all IP addresses that the domain has resolved to over the past year, including historical records. Which data source is most appropriate?

Search engine cache of the domain's homepage.

Passive DNS databases that record historical resolution data.

Current DNS A record lookup for the domain.

GIAC Open Source Intelligence (GOSI)

Domain 2Objective 3

Network Data and Infrastructure Analysis GOSI Practice Questions (Page 3)

Part of the Target Investigation and Infrastructure Analysis domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 9–14 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 11–15

11application · medium
You are profiling a web server that hosts a target application. You need to determine the web server software, its version, and the operating system, but you want to avoid sending malformed packets that could trigger an IDS. Which technique is most appropriate?
Select an answer first
12application · medium
You are analyzing the DNS records of 'example.com' and notice a TXT record containing 'v=spf1 include:_spf.example.net ~all'. What does this indicate?
Select an answer first
13application · medium
An analyst is mapping a target's external infrastructure. They have a single known domain and want to quickly identify additional subdomains and mail servers without sending any traffic to the target. Which approach best meets this requirement?
Select an answer first
14application · medium
An analyst is investigating a suspected phishing campaign. They have a single malicious domain and want to identify all IP addresses that the domain has resolved to over the past year, including historical records. Which data source is most appropriate?
Select an answer first
15foundation · easy
Which DNS record type is used to perform a reverse DNS lookup, mapping an IP address back to a hostname?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.