Exam CAS-004 topic 1 question 68 discussion

I think the most suitable answer is AB as the keyword "A developer wants to maintain". So it shud be something to do with implementation prevention control.

A and C both directly address the goal of ensuring code integrity and detecting unauthorized modifications by providing ways to validate that the code has not been altered since it was signed or hashed. Certificate-based authentication focuses on verifying the identity of users or systems involved in a communication but does not check the integrity of the code itself.

A and C Question wants integrity, signing attests, hash confirms Other answers are for other purposes such as confidentiality and authentication which is not what was asked

A. Utilize code signing by a trusted third party Explanation: Code signing ensures that the modules are authenticated and have not been altered. It provides a digital signature verifying that the code is genuine. C. Verify MD5 hashes Explanation: Hashing helps ensure code integrity. By generating an MD5 hash for each module and verifying it, the developer can detect if the code has been modified. However, stronger hash functions (e.g., SHA-256) are often recommended.

A and C.

A. Utilize code signing by a trusted third party. Code signing ensures that the code’s integrity is verified and that it has not been altered since it was signed. It provides a way to confirm that the code is from a trusted source and has not been tampered with. (Request number 1 of the problem - Assure integrity) F. Make the DACL read-only. Making the DACL (Discretionary Access Control List) read-only helps prevent unauthorized or malicious users from altering the code (Request Number 2 of the problem). This access control measure directly addresses the issue of unauthorized alterations by restricting write access to the code.

A. Utilize code signing by a trusted third party. Code signing involves digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. This process uses a trusted third-party certificate authority (CA) to ensure the authenticity and integrity of the code. C. Verify MD5 hashes. Verifying hashes involves calculating a hash of the program's code and comparing it to a known good hash. While MD5 is not the most secure hash function (SHA-256 is preferred for stronger security), using hashes in general helps ensure that the code has not been altered. Regularly verifying these hashes can help detect any unauthorized changes to the code.

The arguments for C not "preventing" also applies to A. As for finding a MD5 collision, good luck with that while keeping the module valid.

The correct answers are (A and C)

Developer wants to: 1-maintain integrity to each module of a program and 2-ensure the code cannot be altered by malicious users. A. Utilize code signing by a trusted third party: Code signing digitally signs executable files with a cryptographic signature. By obtaining a code signing certificate from a trusted third party, the developer signs each module of the program, ensuring integrity. When users run the program, their systems can verify the signature to ensure the code has not been altered since it was signed. Code signing is widely used to establish trust in software distribution channels and mitigate the risk of code tampering. F. Make the DACL read-only: DACL (Discretionary Access Control List) specifies access permissions to securable objects, such as files or directories, on Windows systems. Making the DACL read-only restricts write access to the program's files, maintaining integrity by preventing malicious users from altering them.

To maintain the integrity of each module in a program and prevent malicious alteration, the developer should consider the following two options: A. Utilize code signing by a trusted third party: This creates a digital signature for each module using a certificate from a trusted authority. Any modification to the code will invalidate the signature, alerting users and preventing execution. E. Encrypt with 3DES: While considered less secure than modern algorithms like AES, 3DES encryption can still provide a layer of protection against unauthorized modification. Decrypting would require the attacker to possess the encryption key, adding a barrier to tampering.

Leaning towards AC. Everybody agrees on A. Everybody also agrees that the possible choices are: AB, AC, or AF. If A is done, then B is also effectively done. So B is probably not the best choice. If DACL is made read-only across the board, then authorized users could not alter the code. By default, the best choice seems to be: AC.

For a developer aiming to maintain integrity to each module of a program and ensure the code cannot be altered by malicious users, the best choices would be: A. Utilize code signing by a trusted third party. Code signing involves signing the code with a cryptographic signature, and this signature is verified by the operating system or runtime environment. It ensures that the code has not been tampered with since it was signed. A trusted third party enhances the credibility of the signature. C. Verify MD5 hashes. MD5 hashes can be used to verify the integrity of files. The developer can compute the MD5 hash of each module and provide the computed hashes. Users can then independently calculate the MD5 hash of the downloaded modules and compare them to ensure integrity.

why not F ?

What is the right answer? Did anyone take exams

correcting to AB

Utilize code signing by a trusted third party (Option A): Code signing ensures authenticity and integrity by providing a digital signature. Make the DACL read-only (Option F): Restricting write access via DACL helps prevent unauthorized modifications to the code.