nerdexam
GIAC

GCIH · Question #224

Which of the following applications automatically calculates cryptographic hashes of all key system files that are to be monitored for modifications?

The correct answer is A. Tripwire. Tripwire is a file integrity monitoring tool that computes cryptographic hashes of critical system files and alerts administrators when unauthorized modifications are detected.

Incident Response & Cyber Kill Chain

Question

Which of the following applications automatically calculates cryptographic hashes of all key system files that are to be monitored for modifications?

Options

  • ATripwire
  • BTCPView
  • CPrcView
  • DInzider

How the community answered

(61 responses)
  • A
    90% (55)
  • B
    2% (1)
  • C
    3% (2)
  • D
    5% (3)

Why each option

Tripwire is a file integrity monitoring tool that computes cryptographic hashes of critical system files and alerts administrators when unauthorized modifications are detected.

ATripwireCorrect

Tripwire generates a cryptographic hash baseline of key system files, binaries, and configuration files during an initial scan and stores the results in a protected database. On subsequent scans it recomputes hashes and compares them against the baseline, flagging any file that has been added, removed, or altered. This makes it the standard host-based intrusion detection tool for detecting unauthorized file system changes.

BTCPView

TCPView is a Windows Sysinternals utility that displays active TCP and UDP network connections and their associated processes, not a file hashing or integrity monitoring tool.

CPrcView

PrcView is a process viewer that lists running processes and loaded modules, not a tool for computing or comparing cryptographic hashes of system files.

DInzider

Inzider is a utility that reveals which DLLs and sockets are associated with running processes and does not perform file integrity monitoring or hash calculation.

Concept tested: File integrity monitoring using cryptographic hashing

Topics

#file integrity monitoring#Tripwire#cryptographic hashes#host-based detection

Community Discussion

No community discussion yet for this question.

Full GCIH Practice