200-201 · Question #461
200-201 Question #461: Real Exam Question with Answer & Explanation
The correct answer is D: A tampered image has a different stored and computed hash.. Hash values are used in forensic investigations to ensure the integrity of data. When a file or image is created, a hash (a unique digital fingerprint) is computed based on its contents. If any modification occurs to the data, the computed hash will no longer match the original s
Question
A cyber security engineer is performing a forensic investigation on a system. What is evidence that data has been modified?
Options
- AAn untampered image has the same stored and computed hash.
- BA tampered image has the same stored and computed hash.
- CAn untampered image has a different stored and computed hash.
- DA tampered image has a different stored and computed hash.
Explanation
Hash values are used in forensic investigations to ensure the integrity of data. When a file or image is created, a hash (a unique digital fingerprint) is computed based on its contents. If any modification occurs to the data, the computed hash will no longer match the original stored hash, indicating tampering. If the image has been tampered with, the stored hash (the original hash) will be different from the computed hash (the hash calculated after tampering), which is evidence that the data has been If the image is untampered, the stored and computed hash would be the same, indicating no
Topics
Community Discussion
No community discussion yet for this question.