You are investigating a malicious IP address (203.0.113.45) that is part of a botnet's command-and-control infrastructure. You have limited time and need to determine the hosting provider and whether the IP is dedicated to the botnet or shared with other services. You also need to identify the operating system of the server. Which combination of techniques would provide the most comprehensive information in the shortest time?

Use a geolocation database and a search engine query for the IP.

Send a ping and a traceroute to the IP address.

Perform an IP WHOIS lookup, a reverse DNS lookup, and a service fingerprinting scan with Nmap.

Perform a reverse IP lookup and a DNS zone transfer for the IP's domain.

You are investigating a suspicious web server. You want to identify the technologies and services running on it without causing disruption. Which technique is most appropriate?

Perform a DNS zone transfer to identify the server's software.

Use a tool like Nmap to perform service fingerprinting on the server's open ports.

Send a large number of requests to the server to see how it responds under load.

Query the WHOIS record for the server's IP address.

You are analyzing DNS records for a domain. You notice that the MX record points to 'mail.targetdomain.com' and the A record for 'mail.targetdomain.com' resolves to an IP address that is also used by a web server hosting a login page. What can you infer from this?

The domain uses a third-party email provider because the MX record is not an external service.

The domain is using a CDN for email delivery.

The mail server is on a separate network segment from the web server.

The same server may host both mail and web services, and the login page could be for webmail.

An analyst is compiling a list of network-related data sources to support an infrastructure investigation. Which of the following is a data source specifically used to obtain IP address allocation and ownership information?

Regional Internet Registry (RIR) WHOIS

GIAC Open Source Intelligence (GOSI)

Domain 2Objective 3

Network Data and Infrastructure Analysis GOSI Practice Questions (Page 9)

Part of the Target Investigation and Infrastructure Analysis domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 9–14 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 41–45

41foundation · easy
An analyst is reviewing WHOIS data for a domain and wants to determine the date when the domain was originally registered. Which field in the WHOIS record provides this information?
Select an answer first
42expert · hard
You are investigating a malicious IP address (203.0.113.45) that is part of a botnet's command-and-control infrastructure. You have limited time and need to determine the hosting provider and whether the IP is dedicated to the botnet or shared with other services. You also need to identify the operating system of the server. Which combination of techniques would provide the most comprehensive information in the shortest time?
Select an answer first
43application · medium
You are investigating a suspicious web server. You want to identify the technologies and services running on it without causing disruption. Which technique is most appropriate?
Select an answer first
44application · medium
You are analyzing DNS records for a domain. You notice that the MX record points to 'mail.targetdomain.com' and the A record for 'mail.targetdomain.com' resolves to an IP address that is also used by a web server hosting a login page. What can you infer from this?
Select an answer first
45foundation · easy
An analyst is compiling a list of network-related data sources to support an infrastructure investigation. Which of the following is a data source specifically used to obtain IP address allocation and ownership information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOSI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOSI” is a trademark of its owner, used for identification only.