nerdexam
GIAC

GSLC · Question #473

Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?

The correct answer is A. File integrity auditing. File integrity auditing compares cryptographic hash values of system files against a known-good baseline to detect unauthorized modifications.

Security Operations & Incident Response Leadership

Question

Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?

Options

  • AFile integrity auditing
  • BReconnaissance
  • CSpoofing
  • DShoulder surfing

How the community answered

(66 responses)
  • A
    94% (62)
  • B
    2% (1)
  • C
    2% (1)
  • D
    3% (2)

Why each option

File integrity auditing compares cryptographic hash values of system files against a known-good baseline to detect unauthorized modifications.

AFile integrity auditingCorrect

File integrity auditing specifically involves generating and comparing cryptographic hash values (such as MD5 or SHA-256) of system executables and configuration files against a trusted baseline. Any deviation in hash values indicates tampering, corruption, or unauthorized change. This is the defining technical process described in the question stem.

BReconnaissance

Reconnaissance is the process of gathering information about a target system or network prior to an attack, not comparing cryptographic hash values of files.

CSpoofing

Spoofing involves impersonating a legitimate entity such as an IP address, MAC address, or email sender, which is unrelated to hash comparison of system files.

DShoulder surfing

Shoulder surfing is a social engineering technique of visually observing someone's screen or keyboard to steal credentials, not a file hash comparison process.

Concept tested: File integrity monitoring via cryptographic hashing

Source: https://csrc.nist.gov/publications/detail/sp/800-137/final

Topics

#file integrity monitoring#hash functions#integrity auditing#configuration management

Community Discussion

No community discussion yet for this question.

Full GSLC Practice