200-201 Question 359
Select 3A cybersecurity analyst is investigating a suspected data breach in an organization. During the analysis, they find that several configuration files have been modified to include unauthorized commands that could potentially disrupt operations. Which of the following actions should the analyst take to confirm a data integrity issue and identify the root cause?
- A
Compare the current configuration files with the latest known good backup.
- B
Review the system's access logs to identify unauthorized access or changes.
- C
Run an antivirus scan to identify and remove malware from the affected system.
- D
Analyze the network traffic for unusual patterns that could signify data exfiltration.
- E
Calculate and compare file hashes of the current files with previous versions.
Show answer and explanation
Correct answers: A, B, E
Explanation
Data integrity ensures that information remains accurate and unaltered. To confirm a data integrity issue, the analyst must compare the current state of the data with a known good reference (like a backup or hash) and investigate logs for unauthorized activities. These steps help identify tampering and the root cause of the issue. Other actions like antivirus scans or network traffic analysis, while valuable in security investigations, do not directly address the integrity of the data in this scenario.
- A. Correct.
Comparing the current configuration files with a known good backup helps determine if unauthorized changes were made, confirming a potential data integrity issue.
- B. Correct.
Reviewing access logs can help identify unauthorized access or changes that may have affected the integrity of the files.
- C. Incorrect.
While running an antivirus scan is a good security practice, it does not directly confirm or address data integrity issues in this scenario.
- D. Incorrect.
Analyzing network traffic focuses on identifying data exfiltration or communication anomalies, which is not directly related to verifying file integrity in this case.
- E. Correct.
Calculating and comparing file hashes ensures that the files have not been tampered with and is a key step in confirming a data integrity issue.