CCOA Practice Question: Identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux…
You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?
⚠ Common exam trap
CCOA often tests the distinction between network-layer controls (firewalls) and host-based integrity monitoring, so candidates who see 'unauthorized modifications' and reflexively pick a security-sounding tool like firewalld miss that the question is about file integrity, not traffic filtering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AIDE
AIDE (Advanced Intrusion Detection Environment) is a host-based file integrity monitoring tool that creates a cryptographic database of file attributes (hashes, permissions, inodes, timestamps) and compares the live filesystem against it to detect unauthorized changes. It is specifically designed to catch tampering with system binaries, configuration files, and other critical files on Linux hosts like RHEL. Running 'aide --check' against a known-good baseline reveals added, removed, or modified files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
firewalld
Why it's wrong here
firewalld filters network packets by zone and port; it never reads file contents, so it cannot detect altered binaries. It is tempting because it is a core RHEL security component, but its purpose is traffic control, whereas integrity verification needs a tool such as AIDE that compares cryptographic hashes against a baseline database.
- ✗
systemctl status
Why it's wrong here
systemctl status reports whether a unit is active and shows recent journal entries; it never hashes files on disk. It is tempting because it inspects running services, but service state is unrelated to binary integrity, whereas AIDE compares current file hashes against a stored baseline to reveal tampering.
- ✗
yum check-update
Why it's wrong here
yum check-update queries configured repositories for newer package versions; it does not hash installed binaries or compare them against known-good values. It is tempting because it reports package-level change, but that reflects available updates rather than unauthorised file modification, which AIDE detects through its baseline database.
- ✓
AIDE
Why this is correct
AIDE maintains a cryptographic hash database of file attributes, detecting unauthorised changes to system binaries on Red Hat Enterprise Linux. It satisfies the integrity verification requirement by comparing current hashes against the stored baseline, flagging any modification to monitored files.
About these practice questions
This CCOA question is part of Courseiva's 338-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CCOA questions
- What is the function of the 'netstat' command in a Windows environment?
- A CCOA analyst is reviewing the security posture of an organization's public cloud tenancy. The team wants to reduce the…
- You are tasked with securing a database connection. Which technology is best for ensuring data in transit is encrypted?
- You are investigating a network segment using a protocol analyzer. You see traffic with the RST flag set. What does this…
- A security operations center (SOC) analyst is reviewing logs from a Windows server and notices Event ID 4625 (An account…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CCOA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCOA exam.