Network Data and Infrastructure Analysis GOSI Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During an investigation, you find a domain that was registered three days ago. The WHOIS record shows the registrar as 'FastRegistrar' and the registrant country as 'Country X'. The domain's A record points to an IP address that is geolocated in 'Country Y'. What is the most significant investigative insight from this data?

   • AThe domain is definitely malicious because it was registered recently.
   • BThe registrant may be using a hosting provider in a different country, which is common for malicious domains.
   • CThe registrar is located in Country Y.
   • DThe domain is using a CDN because the IP is in a different country.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During a DNS analysis, you find a TXT record containing a long string that looks like a random base64 value. What is the most likely purpose of this record?

   • AIt is an SPF record that lists authorized mail servers.
   • BIt is likely a domain verification token for a third-party service such as Google Workspace or Microsoft 365.
   • CIt is a DNS security extension (DNSSEC) signature.
   • DIt is a mail exchanger record for the domain.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   You are profiling a target web server. You have identified that the server responds with a 'Server: nginx' header, but you suspect it is actually running Apache behind a reverse proxy. You need to confirm the underlying web server without triggering an alert. Which technique is most effective?

   • AUse Nmap's HTTP enumeration script to detect the server.
   • BSend a request to a non-existent page and analyze the error page's HTML for Apache-specific signatures.
   • CPerform a full TCP connect scan to identify open ports.
   • DCheck the response to an HTTP OPTIONS request for the 'Allow' header.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a WHOIS record, which field identifies the organization or individual that holds the legal ownership of the domain?

   • AName Server
   • BRegistrar
   • CRegistrant
   • DAdministrative Contact
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   You are tasked with enumerating subdomains of a target domain for a red team exercise. You have a limited time budget and want to maximize the number of subdomains discovered. You have access to certificate transparency logs, a subdomain wordlist, and a search engine. Which strategy is most efficient?

   • AOnly use search engine queries to find subdomains.
   • BRun a full brute-force with a large generic wordlist first, then check CT logs.
   • CQuery certificate transparency logs first, then use the discovered subdomains to build a custom wordlist for brute-forcing.
   • DPerform a zone transfer attempt first, and if it fails, use CT logs.
   Reveal Solution Discussion Select an answer first