GCFA · Question #58
Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?
The correct answer is B. File integrity auditing. File integrity auditing is the security process of generating and comparing cryptographic hash values of system files to detect unauthorized changes.
Question
Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?
Options
- ASpoofing
- BFile integrity auditing
- CReconnaissance
- DShoulder surfing
How the community answered
(40 responses)- A10% (4)
- B83% (33)
- C5% (2)
- D3% (1)
Why each option
File integrity auditing is the security process of generating and comparing cryptographic hash values of system files to detect unauthorized changes.
Spoofing is the act of impersonating a legitimate identity such as an IP address, MAC address, or email sender to deceive systems or users, which has no relation to hash function comparison.
File integrity auditing uses cryptographic hash functions such as SHA-256 to create a verified baseline fingerprint of executables and configuration files, then periodically computes and compares current hashes against that baseline to detect tampering, corruption, or unauthorized modification - directly matching the process described in the question.
Reconnaissance is an information-gathering phase where an attacker collects data about a target environment, not a defensive cryptographic verification technique.
Shoulder surfing is a physical observation technique where an attacker watches a user's screen or keyboard to steal credentials, entirely unrelated to cryptographic file verification.
Concept tested: File integrity auditing using cryptographic hashes
Source: https://csrc.nist.gov/publications/detail/sp/800-128/final
Topics
Community Discussion
No community discussion yet for this question.