A forensics analyst suspects that a breach has occurred. Security logs show the company's OS patch system may be compromised, and it is serving patches that contain a zero-day exploit and backdoor. The analyst extracts an executable file from a packet capture of communication between a client computer and the patch server. Which of the following should the analyst use to confirm this suspicion?
A) File size
B) Digital signature
C) Checksums
D) Anti-malware software
E) Sandboxing

Question

Quizplus · Accepted Answer

Digital signatures can be used to verify the authenticity and integrity of the executable file. If the digital signature is invalid or altered, it may indicate that the file has been tampered with or is malicious.

A Forensics Analyst Suspects That a Breach Has Occurred