SY0-501 · Question #416
A technician receives a device with the following anomalies: Frequent pop-up ads Show response-time switching between active programs Unresponsive peripherals The technician reviews the following log
The correct answer is B. The file integrity check. The log entries show an MD5 hash mismatch for iexplore.exe, indicating that the file has been altered from its original state, which directly points to a need to review file integrity.
Question
A technician receives a device with the following anomalies:
Frequent pop-up ads Show response-time switching between active programs Unresponsive peripherals The technician reviews the following log file entries:
File Name Source MD5 Target MD5 Status antivirus.exe F794F21CD33E4F57890DDEA5CF267ED2 F794F21CD33E4F57890DDEA5CF267ED2 Automatic iexplore.exe 7FAAF21CD33E4F57890DDEA5CF29CCEA AA87F21CD33E4F57890DDEAEE2197333 Automatic service.exe 77FF390CD33E4F57890DDEA5CF28881F 77FF390CD33E4F57890DDEA5CF28881F Manual USB.exe E289F21CD33E4F57890DDEA5CF28EDC0 E289F21CD33E4F57890DDEA5CF28EDC0 Stopped Based on the above output, which of the following should be reviewed?
Options
- AThe web application firewall
- BThe file integrity check
- CThe data execution prevention
- DThe removable media control
How the community answered
(40 responses)- A15% (6)
- B73% (29)
- C8% (3)
- D5% (2)
Why each option
The log entries show an MD5 hash mismatch for `iexplore.exe`, indicating that the file has been altered from its original state, which directly points to a need to review file integrity.
A web application firewall (WAF) primarily protects web servers from attacks targeting web applications, which is unrelated to the client-side operating system issues and file tampering evidenced by the MD5 mismatch.
The log entry for `iexplore.exe` shows a discrepancy between the source MD5 and the target MD5, indicating that the file on the system has been modified or tampered with. A file integrity check is specifically designed to detect such unauthorized changes to files by comparing their current hash values against known good baseline values.
Data Execution Prevention (DEP) is a security feature that prevents malicious code from running in non-executable memory regions; the logs, however, do not indicate a DEP issue but rather a file modification.
Removable media control manages access and usage of devices like USB drives. While unresponsive peripherals are noted, the most direct and critical evidence from the logs is the file modification, not a specific failure of removable media control.
Concept tested: File integrity monitoring, hash validation, and malware detection
Source: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash?view=powershell-7.4
Topics
Community Discussion
No community discussion yet for this question.