nerdexam
CompTIA

LX0-104 · Question #405

You have downloaded a file named file.tgz along with a signature file named file.tgz.asc. Which commands can be used to verify that file.tgz has not been tampered with since the file creator created…

The correct answer is A. gpg verify file.tgz.asc file.tgz C. gpg verify file.tgz.asc E. gpgv file.tgz.asc. When a file is accompanied by a detached signature, GPG provides commands to verify the file's integrity and authenticity against that signature.

Security

Question

You have downloaded a file named file.tgz along with a signature file named file.tgz.asc. Which commands can be used to verify that file.tgz has not been tampered with since the file creator created the signature? Assume that you have already retrieved the public key of the file creator. (Select THREE correct answers)

Options

  • Agpg verify file.tgz.asc file.tgz
  • Bgpg verify file.tgz
  • Cgpg verify file.tgz.asc
  • Dgpgv verify file.tgz.asc
  • Egpgv file.tgz.asc

How the community answered

(30 responses)
  • A
    93% (28)
  • B
    3% (1)
  • D
    3% (1)

Why each option

When a file is accompanied by a detached signature, GPG provides commands to verify the file's integrity and authenticity against that signature.

Agpg verify file.tgz.asc file.tgzCorrect

gpg --verify file.tgz.asc file.tgz explicitly instructs GPG to verify the signature in 'file.tgz.asc' against the content of 'file.tgz'.

Bgpg verify file.tgz

gpg verify file.tgz is incomplete; GPG needs to know which signature file to use for verification.

Cgpg verify file.tgz.ascCorrect

gpg --verify file.tgz.asc implicitly tells GPG to look for a corresponding data file (e.g., 'file.tgz') in the same directory to verify the signature against, based on common naming conventions.

Dgpgv verify file.tgz.asc

gpgv verify file.tgz.asc is redundant; 'gpgv' does not require the 'verify' subcommand, as verification is its primary function when given a signature file.

Egpgv file.tgz.ascCorrect

gpgv file.tgz.asc utilizes the 'gpgv' utility, a specialized version of GPG focused on verification, to check the detached signature 'file.tgz.asc' against its implied data file 'file.tgz'.

Concept tested: GPG detached signature verification

Source: https://man7.org/linux/man-pages/man1/gpgv.1.html

Topics

#GPG#signature verification#detached signature#file integrity

Community Discussion

No community discussion yet for this question.

Full LX0-104 Practice