CompTIA CySA+ (CS0-002) — Question 21

A Chief Information Security Officer (CISO) is concerned about new privacy regulations that apply to the company. The CISO has tasked a security analyst with finding the proper control functions to verify that a user's data is not altered without the user's consent. Which of the following would be an appropriate course of action?

Answer options

• A. Automate the use of a hashing algorithm after verified users make changes to their data.
• B. Use encryption first and then hash the data at regular, defined times.
• C. Use a DLP product to monitor the data sets for unauthorized edits and changes.
• D. Replicate the data sets at regular intervals and continuously compare the copies for unauthorized changes.

Correct answer: A

Explanation

The correct answer is A because automating a hashing algorithm after users make changes ensures that any alterations can be verified against the original data, providing integrity. Option B is less effective, as it hashes after encryption, which does not directly verify user modifications. Option C, while monitoring for unauthorized changes, does not prevent alterations; it only detects them. Option D focuses on replication and comparison, which is less efficient for real-time verification of user consent.