ITPEC FE Subject A April 2025 Question 31
ITPEC FE Subject A April 2025 — Question 31 of 60
File integrity checking (hash comparison) — detecting unauthorized changes to web server content.
The most effective method is to store hash values of each file and periodically compare them with freshly computed hashes. If even one byte changes, the hash will differ, immediately revealing tampering.
Why not others:
- (a) Monitoring communication protocols (HTTP/HTTPS only) is access control, not content change detection. An attacker could modify files through a legitimate channel.
- (c) Checking memory for buffer overflow detects a specific attack type, not unauthorized file modifications that have already occurred.
- (d) Comparing file update dates is unreliable — timestamps can be easily forged (e.g., using touch). Hash values cannot be faked.
Key rule: Hash comparison is the gold standard for file integrity monitoring (e.g., Tripwire).
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.