CAS-003 · Question #177
The source workstation image for new accounting PCs has begun blue-screening. A technician notices that the date/time stamp of the image source appears to have changed. The desktop support director…
The correct answer is A. Retrieve source system image from backup and run file comparison analysis on the two images. C. Calculate a new hash and compare it with the previously captured image hash. Running a file comparison analysis on the two images will determine whether files have been changed, as well as what files were changed. Hashing can be used to meet the goals of integrity and non-repudiation. One of its advantages of hashing is its ability to verify that…
Question
The source workstation image for new accounting PCs has begun blue-screening. A technician notices that the date/time stamp of the image source appears to have changed. The desktop support director has asked the Information Security department to determine if any changes were made to the source image. Which of the following methods would BEST help with this process? (Select TWO).
Options
- ARetrieve source system image from backup and run file comparison analysis on the two images.
- BParse all images to determine if extra data is hidden using steganography.
- CCalculate a new hash and compare it with the previously captured image hash.
- DAsk desktop support if any changes to the images were made.
- ECheck key system files to see if date/time stamp is in the past six months.
How the community answered
(51 responses)- A82% (42)
- B6% (3)
- D10% (5)
- E2% (1)
Explanation
Running a file comparison analysis on the two images will determine whether files have been changed, as well as what files were changed. Hashing can be used to meet the goals of integrity and non-repudiation. One of its advantages of hashing is its ability to verify that information has remained unchanged. If the hash values are the same, then the images are the same. If the hash values differ, there is a difference between the
Topics
Community Discussion
No community discussion yet for this question.