Network Data and Infrastructure Analysis GOSI Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   You are starting an investigation into a potentially malicious domain. You need to gather initial network-related data to understand the domain's infrastructure. Which set of data sources should you query first?

   • ASearch engine results and cached pages of the domain.
   • BSocial media profiles and news articles mentioning the domain.
   • CDNS records (A, MX, NS, TXT), WHOIS record, and IP address information.
   • DSSL certificate details and HTTP headers from the domain's website.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You have collected a large amount of network data about a target, including DNS records, WHOIS information, and IP addresses. You need to present the relationships between domains, IPs, and hosting providers in a clear visual format for a report. Which tool or approach is most appropriate?

   • AUse a link-analysis tool to create a graph showing connections between domains, IPs, and hosting providers.
   • BWrite a narrative report describing the data in paragraphs.
   • CUse a port scanner to generate a network map.
   • DCreate a spreadsheet listing all the data points in columns.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   You are investigating a C2 server. The IP address 198.51.100.23 is known to be the C2. You find that this IP is part of a /24 block assigned to 'CloudHost Inc.' and the PTR record resolves to 'server-23.customer-4567.cloudhost.example'. You also find that the IP hosts a web server with a self-signed certificate for 'admin.c2domain.net'. Which conclusion is best supported?

   • AThe IP is a shared hosting server because it is in a /24 block.
   • BThe IP is likely a dedicated cloud instance for the C2 domain, as indicated by the PTR and certificate.
   • CThe C2 domain is hosted on a CDN because the IP is in a cloud provider's range.
   • DThe C2 domain is using a reverse proxy to hide the real server.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An analyst has collected the following data for a target domain: A records resolve to 203.0.113.10 and 203.0.113.11; both IPs are in the same /24 block assigned to 'Example Hosting Inc.'; the NS records point to ns1.examplehosting.com and ns2.examplehosting.com. What is the most reasonable conclusion about the target's infrastructure?

   • AThe domain is using a third-party DNS provider because the NS records are not the domain itself.
   • BThe domain and its DNS are likely hosted with the same provider, Example Hosting Inc.
   • CThe domain uses a CDN because the two IPs are in the same /24.
   • DThe domain is hosted on a dedicated server because it has two IP addresses.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   You are investigating a web server that is part of a phishing campaign. You need to identify the web server software and the underlying operating system to understand the hosting environment. Which technique would provide this information?

   • APerform a reverse DNS lookup on the server's IP address.
   • BUse a DNS TXT record lookup to find server information.
   • CQuery the WHOIS record for the domain to determine the hosting provider.
   • DSend an HTTP request to the server and analyze the 'Server' header in the response.
   Reveal Solution Discussion Select an answer first