CEH Cryptography and Malware Analysis Practice Question

Exhibit

Refer to the exhibit.

---
C:\> certutil -hashfile C:\Users\Admin\Downloads\update.exe SHA256
SHA256 hash of C:\Users\Admin\Downloads\update.exe:
4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f
---

Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?

⚠ Common exam trap

The trap here is that candidates may mistakenly think a hash that matches is suspicious or that SHA256 is unreliable, when in fact a matching hash is the definitive proof of file integrity; the exam tests whether you understand that hash length and format are fixed and correct for SHA256.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The file is authentic and has not been tampered with.

The SHA256 hash provided by the vendor exactly matches the hash of the downloaded file. SHA256 is a cryptographically strong hash function that produces a fixed 256-bit (64-character hexadecimal) output. A matching hash confirms the file's integrity and authenticity, indicating it has not been tampered with.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The file has been tampered with because the hash is from a different file.
Why it's wrong here
This statement is incorrect. If the calculated cryptographic hash of the downloaded file precisely matches the officially provided hash, it confirms that the file's contents are identical to the original source. A mismatch would indeed indicate tampering or corruption, but in this scenario, the hashes align, unequivocally verifying the file's integrity and authenticity, not a different file.
✗
The SHA256 hash is not reliable; the analyst should use MD5 instead.
Why it's wrong here
This assertion is fundamentally flawed. SHA256 is a cryptographically robust hashing algorithm, offering significantly stronger collision resistance and security compared to MD5. MD5 has known vulnerabilities, making it unsuitable for security-critical integrity checks where malicious collisions could be engineered. Therefore, SHA256 is the preferred and reliable choice for verifying file integrity, not MD5.
✓
The file is authentic and has not been tampered with.
Why this is correct
This statement is correct. When the cryptographic hash (e.g., SHA256) calculated from a downloaded file precisely matches the official, published hash value, it provides strong cryptographic assurance. This match confirms that the file's contents are identical to the original source and have not been altered, corrupted, or tampered with during transit or storage, thereby establishing its authenticity and integrity.
✗
The file is malicious because the hash is too long.
Why it's wrong here
This conclusion is incorrect. The length of a cryptographic hash is determined solely by the specific hashing algorithm used (e.g., SHA256 produces a 256-bit output, which is 64 hexadecimal characters long) and bears no relation to whether a file is malicious. A hash's primary purpose is integrity verification; if it matches the expected value, it indicates integrity, not maliciousness or benignness based on its length.

Go deeper

CEH Cryptography and Malware Analysis Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question