200-201 Question 309
Single answerAs a junior cybersecurity analyst, you are investigating a suspected malware file found on a company system. To verify its integrity and identify if it matches known malicious files, you calculate its hash using a hashing algorithm and compare it to a database of known malware hashes. Which of the following statements about the use of hashes in this scenario is correct?
- A
Hashes uniquely identify a file, and any change to the file will result in a completely different hash value.
- B
Hashes can be used to decrypt files to verify their contents.
- C
Hashes are reversible, allowing you to reconstruct the original file from the hash value.
- D
Hashes are only useful for identifying file sizes, not for file integrity.
Show answer and explanation
Correct answer: A
Explanation
Hashes are a fundamental tool in cybersecurity for verifying file integrity and detecting changes. In this scenario, calculating the hash of the suspected malware file and comparing it to known malicious hashes allows the analyst to determine whether the file matches any known threats. Hashes are one-way, unique representations of data, and any alteration to a file will result in a completely different hash, making them ideal for this purpose.
- A. Correct.
Correct. Hashes are designed to uniquely represent the data of a file, and even a minor change in the file contents will produce a completely different hash value. This makes hashes a powerful tool for verifying file integrity and detecting tampered or malicious files.
- B. Incorrect.
Incorrect. Hashes are not used for decryption. They are one-way cryptographic functions, meaning they cannot be reversed to reveal the original data.
- C. Incorrect.
Incorrect. Hash functions are not reversible. Their purpose is to produce a fixed-length output that represents the data, without allowing the original data to be reconstructed.
- D. Incorrect.
Incorrect. Hashes are not used to measure file size. They are used to verify file integrity and uniqueness by producing a unique output for a given input.