SY0-301 · Question #421
The security administrator is implementing a malware storage system to archive all malware seen by the company into a central database. The malware must be categorized and stored based on…
The correct answer is C. Fuzzy hashes. Fuzzy hashing identifies malware samples that are similar but not identical, enabling categorization of malware families by code similarity.
Question
The security administrator is implementing a malware storage system to archive all malware seen by the company into a central database. The malware must be categorized and stored based on similarities in the code. Which of the following should the security administrator use to identify similar malware?
Options
- ATwoFish
- BSHA-512
- CFuzzy hashes
- DHMAC
How the community answered
(34 responses)- A9% (3)
- B3% (1)
- C85% (29)
- D3% (1)
Why each option
Fuzzy hashing identifies malware samples that are similar but not identical, enabling categorization of malware families by code similarity.
TwoFish is a symmetric block cipher used for data encryption, not for comparing or identifying file similarity.
SHA-512 is a cryptographic hash that produces a completely different output for even a single-bit change, making it useless for detecting similarity between files.
Fuzzy hashing algorithms such as ssdeep compute context-triggered piecewise hashes that produce similar hash values for files with similar content. Unlike cryptographic hashes, fuzzy hashes allow a similarity score to be calculated between two files, making them ideal for clustering and categorizing malware variants that share code lineage.
HMAC is a message authentication code used to verify data integrity and authenticity, not to compare content similarity between files.
Concept tested: Fuzzy hashing for malware similarity detection
Source: https://www.cisa.gov/sites/default/files/publications/cisa-malware-analysis-report.pdf
Topics
Community Discussion
No community discussion yet for this question.