CAS-002 · Question #757
The source workstation image for new accounting PCs has begun blue-screening. A technician notices that the date/time stamp of the image source appears to have changed. The desktop support director…
The correct answer is A. Retrieve source system image from backup and run file comparison analysis on the two images. C. Calculate a new hash and compare it with the previously captured image hash. Determining whether a source image was tampered with requires both comparing it against a known-good backup through file analysis and verifying cryptographic hash values to detect any unauthorized modifications.
Question
The source workstation image for new accounting PCs has begun blue-screening. A technician notices that the date/time stamp of the image source appears to have changed. The desktop support director has asked the Information Security department to determine if any changes were made to the source image. Which of the following methods would BEST help with this process? (Select TWO).
Options
- ARetrieve source system image from backup and run file comparison analysis on the two images.
- BParse all images to determine if extra data is hidden using steganography.
- CCalculate a new hash and compare it with the previously captured image hash.
- DAsk desktop support if any changes to the images were made.
- ECheck key system files to see if date/time stamp is in the past six months.
How the community answered
(29 responses)- A72% (21)
- B3% (1)
- D17% (5)
- E7% (2)
Why each option
Determining whether a source image was tampered with requires both comparing it against a known-good backup through file analysis and verifying cryptographic hash values to detect any unauthorized modifications.
Retrieving the image from backup and performing a file comparison analysis provides a direct binary comparison against a trusted reference, revealing any added, removed, or modified files in the potentially compromised image.
Steganography analysis looks for data hidden within files and is unrelated to detecting unauthorized modification or corruption of a system image.
Recalculating the hash of the current image and comparing it to a previously stored hash value provides a cryptographically reliable integrity check - any modification to the image, no matter how small, produces a completely different hash value.
Asking desktop support is an informal social query with no technical verification value - it cannot prove whether the image file was actually altered and is easily circumvented if the change was malicious.
Checking date/time stamps is unreliable for integrity verification because timestamps can be manipulated by an attacker, and the question already establishes the timestamp changed without confirming whether underlying files were altered.
Concept tested: File integrity verification using hashing and backup comparison
Source: https://csrc.nist.gov/publications/detail/sp/800-128/final
Topics
Community Discussion
No community discussion yet for this question.