ITPEC FE Subject A April 2025 Question 31

Store each file's hash and compare it periodically — any change to a file's contents changes its hash value.

A cryptographic hash function turns a file into a short fixed-length value, and any modification, even of one bit, produces a different value. Recording the hash of every content file while the files are known to be good, then recomputing and comparing on a schedule, reveals exactly which files were altered. Integrity checkers such as Tripwire work this way, and the reference hashes must be kept where an attacker cannot rewrite them.

Answer (b)

Why not others:

• •(a) — allowing only HTTP and HTTPS is a preventive control, and content can be tampered with through those very protocols; it tells nothing about whether files changed
• •(c) — checking memory looks for one attack technique in progress, not for content that has already been changed
• •(d) — a file's update date is metadata that an attacker can reset to its old value, so a modified file can keep its original date

Key rule: To detect tampering, compare something derived from the content itself, such as a hash, not attributes like timestamps or size that can be forged.

Security · AI-written, may contain errors