200-201 Question 360
Select 2A security analyst is investigating a suspected data breach where an attacker might have altered sensitive financial records in a database. To ensure data integrity and verify whether the records have been tampered with, which of the following methods should the analyst use?
- A
Calculate and compare cryptographic hash values of the database records
- B
Review user access logs for unusual activity
- C
Use file permissions to prevent further unauthorized changes
- D
Implement database encryption to secure the data at rest
- E
Check for mismatches in digital signatures applied to the records
Show answer and explanation
Correct answers: A, E
Explanation
To verify data integrity, comparing cryptographic hash values and checking digital signatures are effective methods. Both approaches allow the analyst to detect any unauthorized modifications to the data. While reviewing logs or securing data can aid in broader security efforts, these actions do not directly validate the integrity of the data in question.
- A. Correct.
Calculating and comparing cryptographic hash values ensures that the data has not been altered. If the hash values differ, it is a clear sign of tampering.
- B. Incorrect.
While reviewing user access logs can help identify unauthorized access, it does not directly verify whether the data has been altered.
- C. Incorrect.
Using file permissions prevents future unauthorized changes but does not verify the integrity of the current data.
- D. Incorrect.
Database encryption protects data but does not provide a mechanism to verify if data has been modified.
- E. Correct.
Digital signatures are used to ensure data integrity and authenticity. If the signatures do not match, it indicates potential tampering.