Thin vs Thick Whois Models in Footprinting

312-50v13 By islever Editorial Last updated

Footprinting and Reconnaissance

Short answer

A The Thin Whois model working correctly returns limited registrar data instead of full registrant details.

Question

A certified ethical hacker is conducting a Whois footprinting activity on a specific domain. The individual is leveraging various tools such as Batch IP Converter and Whois Analyzer Pro to retrieve vital details but is unable to gather complete Whois information from the registrar for a particular set of data. As the hacker, what might be the probable data model being utilized by the domain's registrar for storing and looking up Whois information?
  1. Thin Whois model working correctly Correct Answer
  2. Thin Whois model with a malfunctioning server
  3. Thick Whois model with a malfunctioning server
  4. Thick Whois model working correctly

Key Takeaways

The question tests knowledge of Whois data storage models; the trap is assuming missing data implies a server error rather than the design of the Thin model.

Understand the difference between Thin and Thick Whois models to identify why incomplete data is returned during footprinting activities. This page explains that a Thin Whois model intentionally provides limited information.

Common mistake: Many candidates select 'Thick Whois with a malfunctioning server' because they associate complete Whois data with the Thick model and assume any lack thereof is a technical failure, ignoring the intentional limitation of the Thin model.

Expert Analysis

Why the Answer Is Correct

The correct answer is A. The Thin Whois model is designed to store only minimal, essential data (such as the registrar name and contact URL) at the registry level, while detailed registrant information is stored by individual registrars. When a query is made against a Thin Whois server, it correctly returns this limited dataset. The phrase "unable to gather complete Whois information" refers to the absence of full registrant details, which is expected behavior for a Thin model functioning correctly.

Why the Other Options Are Wrong

Option B suggests a malfunctioning server, but the prompt implies the tool is working and retrieving some data, just not all. Option C and D involve the Thick Whois model, which stores complete domain registration data centrally. If a Thick model were used, the query would return full details unless the server was down, which contradicts the scenario where specific tools are successfully interacting with the system to get partial results.

Community Comment Notes

Community consensus strongly favors Option A. As user MHafizC noted, the Thin model provides only a certain set of data by design. User Gibsomd reinforced that the server is working correctly, but full data is not stored in the central registry, which aligns with the definition of the Thin Whois architecture.

Exam Strategy

When analyzing footprinting questions involving Whois, distinguish between 'missing data due to design' (Thin model) and 'missing data due to error' (malfunction). Look for keywords like 'limited information' or 'registrar contact only' to identify Thin models.

Frequently Asked Questions

What is the main difference between Thin and Thick Whois?

Thin Whois stores minimal data (registrar info) at the registry level, while Thick Whois stores complete registrant details centrally.

Does incomplete Whois data always mean a server error?

No, if the system uses a Thin Whois model, incomplete data is expected and indicates normal operation, not an error.

More 312-50v13 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. bibibi 👍 3 Answered A
    i have changed my mind after carefully read into the question and this ""unable to gather complete Whois information from the registrar" show that it is the "Thin Whois model" that only provide limited information.
  2. MHafizC 👍 3 Answered A
    This is related to thin whois model, providing only certain set of data. It is working as this.
  3. Gibsomd 👍 2 Answered A
    The Whois system is used for querying domain registration details, and there are two primary models for storing and retrieving Whois information, Thin Whois Modeland and Thick Whois Model. Since the hacker is unable to retrieve complete Whois information, this suggests that The server is working correctly, but full data is not stored in the central registry (as per Thin Whois behavior).
  4. bibibi 👍 1 Answered D
    Thick WHOIS offers greater transparency and ease of access to domain information and consist more information like the contact information for the domain owner (registrant), administrative contact, and technical contact as compare to the Thin Whois.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide