You have collected a large amount of network data for an investigation: multiple domains, IP addresses, WHOIS records, and SSL certificate details. You need to present the relationships between these entities to a non-technical stakeholder. Which approach is most effective?

Create a link analysis diagram showing domains, IPs, and certificates as nodes with edges representing relationships.

Write a detailed technical report with all the data in tables.

Use a timeline of when each domain was registered.

Provide a spreadsheet with all the raw data and let the stakeholder analyze it.

You have collected network data for an investigation and need to produce a report that shows the relationships between domains, IPs, and certificates. You have a large dataset with many-to-many relationships. You want to identify clusters of infrastructure that are likely controlled by the same actor. Which visualization or analysis technique is most appropriate?

Create a simple table listing all domains and their IPs.

Use a graph database and community detection algorithms to identify clusters.

Use a timeline chart of registration dates.

Plot IP addresses on a map based on geolocation.

You are mapping the infrastructure of a target organization. You have identified a primary domain and several subdomains. You notice that two subdomains resolve to the same IP address, but the WHOIS records for the subdomains show different registrants. What is the most likely explanation?

The subdomains are actually the same domain.

The IP address is a load balancer that routes to different servers.

The subdomains are hosted on the same server, which is common in shared hosting environments.

The WHOIS records are incorrect because subdomains cannot have separate WHOIS records.

GIAC Open Source Intelligence (GOSI)

Domain 2Objective 3

Network Data and Infrastructure Analysis GOSI Practice Questions (Page 6)

Part of the Target Investigation and Infrastructure Analysis domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 9–14 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 26–30

26application · medium
You have collected a large amount of network data for an investigation: multiple domains, IP addresses, WHOIS records, and SSL certificate details. You need to present the relationships between these entities to a non-technical stakeholder. Which approach is most effective?
Select an answer first
27foundation · easy
An analyst is examining DNS records for a domain and wants to identify the mail servers responsible for handling email for that domain. Which type of DNS record should the analyst query?
Select an answer first
28expert · hard
You have collected network data for an investigation and need to produce a report that shows the relationships between domains, IPs, and certificates. You have a large dataset with many-to-many relationships. You want to identify clusters of infrastructure that are likely controlled by the same actor. Which visualization or analysis technique is most appropriate?
Select an answer first
29application · medium
You are mapping the infrastructure of a target organization. You have identified a primary domain and several subdomains. You notice that two subdomains resolve to the same IP address, but the WHOIS records for the subdomains show different registrants. What is the most likely explanation?
Select an answer first
30foundation · easy
Which DNS record type is commonly used to store arbitrary text data such as SPF policies, DKIM keys, or verification tokens, and can be valuable during infrastructure analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.

Network Data and Infrastructure Analysis GOSI Practice Questions (Page 6)

Questions 26–30

You have collected a large amount of network data for an investigation: multiple domains, IP addresses, WHOIS records, and SSL certificate details. You need to present the relationships between these entities to a non-technical stakeholder. Which approach is most effective?

An analyst is examining DNS records for a domain and wants to identify the mail servers responsible for handling email for that domain. Which type of DNS record should the analyst query?

You are mapping the infrastructure of a target organization. You have identified a primary domain and several subdomains. You notice that two subdomains resolve to the same IP address, but the WHOIS records for the subdomains show different registrants. What is the most likely explanation?

Which DNS record type is commonly used to store arbitrary text data such as SPF policies, DKIM keys, or verification tokens, and can be valuable during infrastructure analysis?

Keep studying — Target Investigation and Infrastructure Analysis