SY0-501 · Question #331
A security analyst reviews the following output: The analyst loads the hash into the SIEM to discover if this hash is seen in other parts of the network. After inspecting a large number of files…
The correct answer is B. There are MD5 hash collisions. The widespread discovery of the same hash across many files in different network locations is most likely attributed to hash collisions, especially if the hash algorithm used is MD5.
Question
A security analyst reviews the following output:
The analyst loads the hash into the SIEM to discover if this hash is seen in other parts of the network. After inspecting a large number of files, the security analyst reports the following:
Which of the following is the MOST likely cause of the hash being found in other areas?
Exhibit
Options
- AJan Smith is an insider threat
- BThere are MD5 hash collisions
- CThe file is encrypted
- DShadow copies are present
How the community answered
(27 responses)- A15% (4)
- B74% (20)
- C4% (1)
- D7% (2)
Why each option
The widespread discovery of the same hash across many files in different network locations is most likely attributed to hash collisions, especially if the hash algorithm used is MD5.
This option proposes an actor's motivation rather than a technical explanation for how a specific hash value would appear across multiple files in a network.
Hash collisions occur when two distinct inputs, such as different files, produce an identical hash output. MD5 is a cryptographic hash function widely recognized for its vulnerability to collision attacks, meaning it is technically feasible for different files to generate the same MD5 hash, leading to its appearance across various, potentially unique files on a network.
File encryption alters the data, which inherently changes its hash value; therefore, encryption does not explain how different files could share the same hash or why a particular hash is broadly observed.
Shadow copies are local volume snapshots used for data recovery on a single system and do not account for the distribution of a hash across a large number of files on different network machines.
Concept tested: Hash function collision vulnerability and MD5 weakness
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-baselines/security-baselines-faq#should-i-disable-md5-or-sha1
Topics
Community Discussion
No community discussion yet for this question.