210-255 · Question #109
Which option is the common artifact used to uniquely identify a detected file?
The correct answer is D. file hash. A file hash (such as MD5 or SHA-256) produces a unique fixed-length digest of a file's contents, making it the standard artifact for uniquely identifying files in security analysis and threat intelligence.
Question
Which option is the common artifact used to uniquely identify a detected file?
Options
- Afile size
- Bfile extension
- Cfile timestamp
- Dfile hash
How the community answered
(25 responses)- B4% (1)
- C8% (2)
- D88% (22)
Why each option
A file hash (such as MD5 or SHA-256) produces a unique fixed-length digest of a file's contents, making it the standard artifact for uniquely identifying files in security analysis and threat intelligence.
File size is not unique because many different files can share the same byte count, making it unsuitable as a sole identifier.
File extensions can be trivially renamed by an attacker and do not reflect the actual content of the file.
File timestamps can be manipulated through a technique called timestomping, making them an unreliable and non-unique identifier.
A cryptographic hash function processes the entire file contents and produces a unique digest that changes if even one bit of the file changes. This makes the hash a reliable fingerprint for identifying a file regardless of its name, location, or metadata. Tools like Cisco Threat Grid and VirusTotal use file hashes as the primary key for threat lookups.
Concept tested: File hash as unique malware identifier
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-86.pdf
Topics
Community Discussion
No community discussion yet for this question.