You are investigating a domain that was registered recently and is being used for malicious activity. The WHOIS record shows the registrar as 'Example Registrar Inc.' and the creation date as 3 months ago. You want to determine if the registrant has registered other domains. Which approach is most effective?

Check the domain's DNS records for other domains hosted on the same IP.

Use a search engine to find other domains with the same content.

Perform a reverse WHOIS search using the registrant's name or email address.

Query the registrar's website for a list of all domains they host.

An analyst is mapping the infrastructure of a target organization and wants to identify which hosting provider is used for a specific IP address. Which type of data would directly provide this information?

Netblock ownership records from WHOIS

An analyst is investigating a suspicious IP address that appears to be hosting a command-and-control server. The analyst wants to determine the hosting provider and the physical location of the server. Which combination of data sources would provide the most reliable information?

Reverse DNS lookup and a search engine query for the IP address.

Banner grabbing on port 80 and a traceroute to the IP address.

WHOIS record for the IP address and a geolocation database lookup.

DNS A record lookup and a ping to the IP address.

During a penetration test, you are asked to enumerate subdomains of 'target.com' to identify potential attack surface. You have already used certificate transparency logs and search engines. Which additional technique would most effectively complement your existing results?

Perform a DNS zone transfer against the target's name servers.

Brute-force subdomains using a large wordlist of common names and patterns.

Query the target's WHOIS record for subdomain information.

Use a network scanner to scan the target's IP range for open ports.

GIAC Open Source Intelligence (GOSI)

Domain 2Objective 3

Network Data and Infrastructure Analysis GOSI Practice Questions (Page 5)

Part of the Target Investigation and Infrastructure Analysis domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 9–14 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 21–25

21foundation · easy
An analyst connects to a web server on port 80 and sends a simple HTTP request to read the response headers. The goal is to identify the web server software and version. Which technique is being used?
Select an answer first
22application · medium
You are investigating a domain that was registered recently and is being used for malicious activity. The WHOIS record shows the registrar as 'Example Registrar Inc.' and the creation date as 3 months ago. You want to determine if the registrant has registered other domains. Which approach is most effective?
Select an answer first
23foundation · easy
An analyst is mapping the infrastructure of a target organization and wants to identify which hosting provider is used for a specific IP address. Which type of data would directly provide this information?
Select an answer first
24application · medium
An analyst is investigating a suspicious IP address that appears to be hosting a command-and-control server. The analyst wants to determine the hosting provider and the physical location of the server. Which combination of data sources would provide the most reliable information?
Select an answer first
25application · medium
During a penetration test, you are asked to enumerate subdomains of 'target.com' to identify potential attack surface. You have already used certificate transparency logs and search engines. Which additional technique would most effectively complement your existing results?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.