312-50V9 · Question #502
Which of the following techniques will identify if computer files have been changed?
The correct answer is C. Integrity checking hashes. Cryptographic hash-based integrity checking detects unauthorized or accidental modifications to files by comparing stored baseline hashes against current file hashes.
Question
Which of the following techniques will identify if computer files have been changed?
Options
- ANetwork sniffing
- BPermission sets
- CIntegrity checking hashes
- DFirewall alerts
How the community answered
(41 responses)- B5% (2)
- C93% (38)
- D2% (1)
Why each option
Cryptographic hash-based integrity checking detects unauthorized or accidental modifications to files by comparing stored baseline hashes against current file hashes.
Network sniffing captures packets in transit on a network and cannot detect changes to files stored on disk.
Permission sets define who can access files but do not record or detect whether file contents have been altered.
Integrity checking hashes work by generating a cryptographic hash (such as SHA-256 or MD5) of a file at a known-good baseline and storing it securely. When the file is later re-hashed and compared, any change - even a single bit - produces a different hash value, definitively confirming tampering or corruption. Tools like Tripwire, AIDE, and Windows File Integrity Monitoring implement this technique.
Firewall alerts notify on network traffic anomalies and cannot monitor or compare the contents of files on a host system.
Concept tested: File integrity monitoring using cryptographic hashes
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows
Topics
Community Discussion
No community discussion yet for this question.