GCIH · Question #224
Which of the following applications automatically calculates cryptographic hashes of all key system files that are to be monitored for modifications?
The correct answer is A. Tripwire. Tripwire is a file integrity monitoring tool that computes cryptographic hashes of critical system files and alerts administrators when unauthorized modifications are detected.
Question
Which of the following applications automatically calculates cryptographic hashes of all key system files that are to be monitored for modifications?
Options
- ATripwire
- BTCPView
- CPrcView
- DInzider
How the community answered
(61 responses)- A90% (55)
- B2% (1)
- C3% (2)
- D5% (3)
Why each option
Tripwire is a file integrity monitoring tool that computes cryptographic hashes of critical system files and alerts administrators when unauthorized modifications are detected.
Tripwire generates a cryptographic hash baseline of key system files, binaries, and configuration files during an initial scan and stores the results in a protected database. On subsequent scans it recomputes hashes and compares them against the baseline, flagging any file that has been added, removed, or altered. This makes it the standard host-based intrusion detection tool for detecting unauthorized file system changes.
TCPView is a Windows Sysinternals utility that displays active TCP and UDP network connections and their associated processes, not a file hashing or integrity monitoring tool.
PrcView is a process viewer that lists running processes and loaded modules, not a tool for computing or comparing cryptographic hashes of system files.
Inzider is a utility that reveals which DLLs and sockets are associated with running processes and does not perform file integrity monitoring or hash calculation.
Concept tested: File integrity monitoring using cryptographic hashing
Topics
Community Discussion
No community discussion yet for this question.