LFCS · Question #421
What is the purpose of tripwire?
The correct answer is D. To identify changes to critical system files and directories. Tripwire is a security tool primarily used for File Integrity Monitoring (FIM), detecting unauthorized changes to critical system files and directories.
Question
Options
- ATo act as a honeypot and attract attackers.
- BTo enforce mandatory access control policies to confine users to the minimum amount of privilege
- CTo monitor a server for breakin attempts and, if desired, ban the IP address.
- DTo identify changes to critical system files and directories.
How the community answered
(16 responses)- C6% (1)
- D94% (15)
Why each option
Tripwire is a security tool primarily used for File Integrity Monitoring (FIM), detecting unauthorized changes to critical system files and directories.
Honeypots are designed to attract and trap attackers to gather intelligence, which is a different security function than file integrity monitoring.
Mandatory Access Control (MAC) enforces strict access policies based on security labels, focusing on user privileges rather than file content integrity.
While related to security monitoring, Tripwire's core function is file integrity, not real-time network intrusion detection and IP banning, which is typical of an IDS/IPS.
Tripwire operates by establishing a baseline of cryptographic hashes for critical files and directories. It then periodically compares the current state of these files against the baseline, alerting administrators to any modifications, deletions, or additions, which can indicate a security breach or configuration drift.
Concept tested: Tripwire purpose and File Integrity Monitoring
Source: https://www.tripwire.com/solutions/file-integrity-monitoring
Topics
Community Discussion
No community discussion yet for this question.