nerdexam
CompTIA

SY0-501 · Question #416

A technician receives a device with the following anomalies: Frequent pop-up ads Show response-time switching between active programs Unresponsive peripherals The technician reviews the following log

The correct answer is B. The file integrity check. The log entries show an MD5 hash mismatch for iexplore.exe, indicating that the file has been altered from its original state, which directly points to a need to review file integrity.

Submitted by marco_it· Mar 4, 2026Security operations

Question

A technician receives a device with the following anomalies:

Frequent pop-up ads Show response-time switching between active programs Unresponsive peripherals The technician reviews the following log file entries:

File Name Source MD5 Target MD5 Status antivirus.exe F794F21CD33E4F57890DDEA5CF267ED2 F794F21CD33E4F57890DDEA5CF267ED2 Automatic iexplore.exe 7FAAF21CD33E4F57890DDEA5CF29CCEA AA87F21CD33E4F57890DDEAEE2197333 Automatic service.exe 77FF390CD33E4F57890DDEA5CF28881F 77FF390CD33E4F57890DDEA5CF28881F Manual USB.exe E289F21CD33E4F57890DDEA5CF28EDC0 E289F21CD33E4F57890DDEA5CF28EDC0 Stopped Based on the above output, which of the following should be reviewed?

Options

  • AThe web application firewall
  • BThe file integrity check
  • CThe data execution prevention
  • DThe removable media control

How the community answered

(40 responses)
  • A
    15% (6)
  • B
    73% (29)
  • C
    8% (3)
  • D
    5% (2)

Why each option

The log entries show an MD5 hash mismatch for `iexplore.exe`, indicating that the file has been altered from its original state, which directly points to a need to review file integrity.

AThe web application firewall

A web application firewall (WAF) primarily protects web servers from attacks targeting web applications, which is unrelated to the client-side operating system issues and file tampering evidenced by the MD5 mismatch.

BThe file integrity checkCorrect

The log entry for `iexplore.exe` shows a discrepancy between the source MD5 and the target MD5, indicating that the file on the system has been modified or tampered with. A file integrity check is specifically designed to detect such unauthorized changes to files by comparing their current hash values against known good baseline values.

CThe data execution prevention

Data Execution Prevention (DEP) is a security feature that prevents malicious code from running in non-executable memory regions; the logs, however, do not indicate a DEP issue but rather a file modification.

DThe removable media control

Removable media control manages access and usage of devices like USB drives. While unresponsive peripherals are noted, the most direct and critical evidence from the logs is the file modification, not a specific failure of removable media control.

Concept tested: File integrity monitoring, hash validation, and malware detection

Source: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash?view=powershell-7.4

Topics

#file integrity monitoring#MD5 hash#malware detection#log analysis

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice