Exam SY0-501 topic 1 question 564 discussion

Boot init should not change. I guess thats why answer is correct.

"I think this answer is correct. /etc/passwd changes a lot (adding users, etc) so the hash can be expected to change. iptables-save doesn’t change often since ACLs are generally not edited all the time. initrd.img is part of the boot loader, which shouldn’t change at all. The hash on it changes at 3:30 and that’s why it’s the time of the compromise. Passwd: Changes often IPTables: Doesn’t change often, but can change initrd: Shouldn’t change at all" Source: https://vceguide.com/drag-drop-616/

The server has not been updated since it was installed, So, /boot/initrd.img-2.6..., hashes in that sector should not changed at all. because there was no updates after it is installed. So, when you see 1/1/2016 time 3:30:00 hash has been changed, it means that hash got compromised.

Etc Password hashes should all be different. (because they are passwords) So nothing it that. Nothing has changed in iptables per the hash. The init image clearly has a different hash at 3:30. Which is why that is the answer. That is the hash of your computers image if i'm not mistaken. It shouldn't just change.

Please explain the answer.