Exam CAS-004 topic 1 question 172 discussion

D is correct. Hackers have access the software repository to change the package, which is automatically published on the website, they didn't compromise the website itself to change the checksum value. Distributing the software via a third-party repository (option A) or emailing the software link to all customers (option C) would not necessarily ensure that customers are downloading the official software released by the company.

If they can change a file in the repository, then they can change the SHA checksum listed for verification. A trusted third-party provider should be used to host the software.

D. Display the SHA checksum on the website. Explanation: Displaying the SHA checksum (a cryptographic hash value) on the website allows users to verify the integrity of the software they are downloading. The checksum can be calculated for the software package that has been officially released by the company. Users can then compare the checksum of the downloaded file with the one displayed on the website. If the checksums match, it confirms that the downloaded file is authentic and hasn't been tampered with.

Definitely D

I believe the question is focused around integrity ("ensure the software the users download is the official software") and even though outsourcing to a 3rd party repository might be a good option, the only answer dealing with integrity is displaying the SHA checksum, regardless of how "weak" this method may be.

If you can't do security properly and it is a recurring problem, outsource hosting the application to a trusted 3rd party that has the security you don't. The SHA is a great method and the standard when you aren't always being hacked. The key phrase I see is "automatically publish to website" This means that the hackers don't even need access to the website to change the SHA posted because automation in place will do it for you. :) Source: Verifying each answer against Chat GPT, my experience, other test banks, a written book, and weighing in the discussion from all users to create a 100% accurate guide for myself before I take the exam. (It isn't easy because of the time needed, but it is doing my diligence)

D seems the most logical to me

Customers can compare the SHA checksum displayed on the website with the SHA checksum of the downloaded file to ensure that the software is the official software released by the company.

A is correct