200-201 Question 219
Select 2During a cybersecurity investigation, an analyst is tasked with verifying the integrity of a file suspected to have been tampered with. The analyst calculates the hash of the current file and compares it with a previously recorded hash value. Which of the following statements about this process is correct?
- A
If the calculated hash matches the recorded hash, the file has not been tampered with.
- B
The hash comparison can reveal the identity of the person who accessed the file.
- C
Hashes are encrypted values and can be decrypted to retrieve the original file contents.
- D
A mismatch between the calculated hash and the recorded hash indicates that the file has been modified.
Show answer and explanation
Correct answers: A, D
Explanation
Hash functions are commonly used to verify the integrity of data. By comparing the hash of a file with a previously recorded hash value, analysts can determine if the file has been modified. Matching hashes mean the file is intact, while mismatched hashes indicate potential tampering. Hashes do not provide information about file access or identity, and they are not reversible.
- A. Correct.
This is correct because matching hash values indicate that the file has not been altered and its integrity is intact.
- B. Incorrect.
This is incorrect because hash functions do not provide information about who accessed the file; they only verify file integrity.
- C. Incorrect.
This is incorrect because hashes are not encrypted values; they are the result of a one-way function that cannot be reversed to retrieve the original data.
- D. Correct.
This is correct because a mismatch between hash values suggests that the file content has been altered, indicating a potential compromise of integrity.