200-201 Security Monitoring Practice Question
During an incident response, an analyst extracts a suspicious file and computes its MD5 hash: d41d8cd98f00b204e9800998ecf8427e. Upon checking a threat intelligence feed, this hash is known as a malicious indicator. What does this hash represent?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A false positive; the hash corresponds to an empty file.
The MD5 hash d41d8cd98f00b204e9800998ecf8427e is the well-known hash of an empty file (zero bytes). It is not a valid indicator of a malicious file; the analyst should verify the file's actual content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A false positive; the hash corresponds to an empty file.
Why this is correct
The empty file hash is often listed in threat feeds as a mistake; it is a false positive.
- ✗
An invalid hash; the file may be corrupt.
Why it's wrong here
The hash is valid but corresponds to an empty file.
- ✗
A known malicious executable that should be quarantined.
Why it's wrong here
This hash is actually the hash of an empty file, not a known malware.
- ✗
A hash of a benign system file.
Why it's wrong here
It is not a system file; it's an empty file.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.