nerdexam
GIAC

GCFA · Question #58

Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?

The correct answer is B. File integrity auditing. File integrity auditing is the security process of generating and comparing cryptographic hash values of system files to detect unauthorized changes.

File System & Registry Forensics

Question

Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?

Options

  • ASpoofing
  • BFile integrity auditing
  • CReconnaissance
  • DShoulder surfing

How the community answered

(40 responses)
  • A
    10% (4)
  • B
    83% (33)
  • C
    5% (2)
  • D
    3% (1)

Why each option

File integrity auditing is the security process of generating and comparing cryptographic hash values of system files to detect unauthorized changes.

ASpoofing

Spoofing is the act of impersonating a legitimate identity such as an IP address, MAC address, or email sender to deceive systems or users, which has no relation to hash function comparison.

BFile integrity auditingCorrect

File integrity auditing uses cryptographic hash functions such as SHA-256 to create a verified baseline fingerprint of executables and configuration files, then periodically computes and compares current hashes against that baseline to detect tampering, corruption, or unauthorized modification - directly matching the process described in the question.

CReconnaissance

Reconnaissance is an information-gathering phase where an attacker collects data about a target environment, not a defensive cryptographic verification technique.

DShoulder surfing

Shoulder surfing is a physical observation technique where an attacker watches a user's screen or keyboard to steal credentials, entirely unrelated to cryptographic file verification.

Concept tested: File integrity auditing using cryptographic hashes

Source: https://csrc.nist.gov/publications/detail/sp/800-128/final

Topics

#file integrity auditing#cryptographic hash#hash comparison#system integrity

Community Discussion

No community discussion yet for this question.

Full GCFA Practice