200-201 Question 310
Single answerDuring an incident investigation, a cybersecurity analyst is asked to verify the integrity of a suspicious file. The analyst generates an MD5 hash and compares it to a hash value provided by the vendor. The hashes do not match. What does this indicate?
- A
The file has been altered or tampered with.
- B
The MD5 hashing algorithm is unreliable and should not be used.
- C
The hash comparison process was performed incorrectly.
- D
The file is verified as legitimate and unaltered.
Show answer and explanation
Correct answer: A
Explanation
Hashes are used to verify the integrity of data by creating a unique fixed-size output based on the input data. In this scenario, the mismatch between the computed MD5 hash and the vendor-provided hash indicates that the file has been altered or tampered with. MD5, while not secure for cryptographic purposes, is still commonly used for integrity checks.
- A. Correct.
This is correct. A mismatch in the hash values indicates that the file's contents have been modified or tampered with, as the hash is used to verify data integrity.
- B. Incorrect.
This is incorrect. While MD5 is not recommended for cryptographic security due to vulnerabilities, it is still reliable for verifying file integrity in non-security-critical contexts.
- C. Incorrect.
This is incorrect. If the hash comparison process was performed incorrectly, the analyst would likely encounter an error or need to reevaluate the process, but this is not indicated in the scenario.
- D. Incorrect.
This is incorrect. A mismatch in hash values indicates that the file cannot be verified as legitimate or unaltered.