CompTIA CASP+ (CAS-004) — Question 411

Which of the following is the best reason for obtaining file hashes from a confiscated laptop?

Answer options

• A. To prevent metadata tampering on each file
• B. To later validate the integrity of each file
• C. To generate unique identifiers for each file
• D. To preserve the chain of custody of files

Correct answer: B

Explanation

The correct answer is B because obtaining file hashes allows for later verification that the files have not been altered, ensuring their integrity. Option A is incorrect as it focuses on metadata rather than file integrity, C is not the main purpose of hashes, and D, while important, is not the primary reason for obtaining hashes.