Exam CS0-003 topic 1 question 315 discussion

Only one that makes sense

I believe it is A can someone confirm ?

This is because the SHA-256 hash is a unique identifier for a specific file. If the indicator contains the hash of svchost.exe, it would help identify any malicious files with the same hash that have been altered or injected with malware. However, svchost.exe is a legitimate Microsoft binary, and unless modified with malicious intent, it wouldn’t trigger alerts on its own.