210-250 · Question #41
Refer to the exhibit. During an analysis this list of email attachments is found. Which files contain the same content?
The correct answer is C. 1 and 3. Two files with identical cryptographic hash values contain identical content, regardless of filename or extension - this is the basis of hash-based file deduplication and forensic identification.
Question
Refer to the exhibit. During an analysis this list of email attachments is found. Which files contain the same content?
Exhibit
Options
- A1 and 4
- B3 and 4
- C1 and 3
- D1 and 2
How the community answered
(32 responses)- A3% (1)
- B6% (2)
- C81% (26)
- D9% (3)
Why each option
Two files with identical cryptographic hash values contain identical content, regardless of filename or extension - this is the basis of hash-based file deduplication and forensic identification.
Files 1 and 4 have different hash values in the exhibit, indicating their content differs despite any similarity in name or size.
Files 3 and 4 have different hash values in the exhibit, so their content is not identical.
Cryptographic hash functions such as MD5 or SHA-256 produce a fixed-length digest that is deterministically derived from file content. If files 1 and 3 share the same hash value in the exhibit, their underlying byte content is identical. This property is foundational in digital forensics and email security analysis for detecting duplicate or renamed malicious attachments.
Files 1 and 2 have different hash values in the exhibit, confirming they do not share the same content.
Concept tested: Hash-based file content identification in forensics
Source: https://www.nist.gov/system/files/documents/2017/05/09/hash-functions.pdf
Topics
Community Discussion
No community discussion yet for this question.