Certified Incident Handler (ECIH) — Question 44

A text file containing sensitive information about the organization has been leaked and modified to bring down the reputation of the organization. As a safety measure, the organization did contain the MD5 hash of the original file. The file which has been leaked is retained for examining the integrity. A file named "Sensitiveinfo.txt" along with OriginalFileHash.txt has been stored in a folder named Hash in Documents of Attacker Machine-1. Compare the hash value of the original file with the leaked file and state whether the file has been modified or not by selecting yes or no.

Answer options

• A. No
• B. Yes

Correct answer: B

Explanation

The correct answer is B because the MD5 hash comparison indicates that the leaked file does not match the original file's hash, confirming that it has been modified. Option A is incorrect as it suggests that the file has not been altered, which contradicts the results of the hash comparison.