LFCS Question #405: Real Exam Question with Answer & Explanation

Question

You have downloaded a file named file.tgz along with a signature file named file.tgz.asc. Which commands can be used to verify that file.tgz has not been tampered with since the file creator created the signature? Assume that you have already retrieved the public key of the file creator. (Select THREE correct answers)

Options

• Agpg verify file.tgz.asc file.tgz
• Bgpg verify file.tgz
• Cgpg verify file.tgz.asc
• Dgpgv verify file.tgz.asc
• Egpgv file.tgz.asc

Explanation

To verify a detached GPG signature (.asc) against its corresponding data file (.tgz), you can use gpg verify with both files, gpg verify with just the signature file (if named conventionally), or the gpgv utility with just the signature file.

Common mistakes.

• B. gpg verify file.tgz is incorrect because it expects the file itself to contain an inline signature, not a detached one, and would not automatically search for file.tgz.asc.
• D. gpgv verify file.tgz.asc is syntactically incorrect; gpgv itself implies verification, so the verify subcommand is redundant and not part of the gpgv syntax.

Concept tested. GPG detached signature verification

Reference. https://gnupg.org/documentation/manuals/gnupg/Verify-signatures.html

No community discussion yet for this question.