GSLC · Question #473
Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?
The correct answer is A. File integrity auditing. File integrity auditing compares cryptographic hash values of system files against a known-good baseline to detect unauthorized modifications.
Question
Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?
Options
- AFile integrity auditing
- BReconnaissance
- CSpoofing
- DShoulder surfing
How the community answered
(66 responses)- A94% (62)
- B2% (1)
- C2% (1)
- D3% (2)
Why each option
File integrity auditing compares cryptographic hash values of system files against a known-good baseline to detect unauthorized modifications.
File integrity auditing specifically involves generating and comparing cryptographic hash values (such as MD5 or SHA-256) of system executables and configuration files against a trusted baseline. Any deviation in hash values indicates tampering, corruption, or unauthorized change. This is the defining technical process described in the question stem.
Reconnaissance is the process of gathering information about a target system or network prior to an attack, not comparing cryptographic hash values of files.
Spoofing involves impersonating a legitimate entity such as an IP address, MAC address, or email sender, which is unrelated to hash comparison of system files.
Shoulder surfing is a social engineering technique of visually observing someone's screen or keyboard to steal credentials, not a file hash comparison process.
Concept tested: File integrity monitoring via cryptographic hashing
Source: https://csrc.nist.gov/publications/detail/sp/800-137/final
Topics
Community Discussion
No community discussion yet for this question.