Cisco Cyber Security Practice Exam

What does it indicate if the SHA-512 hash of a received data file does not match the original hash?

1. The file is encrypted

2. The data file has been tampered with and should be dropped

3. The file is virus-free

4. The data was sent in plaintext

The correct answer is: The data file has been tampered with and should be dropped

When the SHA-512 hash of a received data file does not match the original hash, it indicates that the contents of the file have been altered in some way since it was originally hashed. Hash functions like SHA-512 produce a unique fixed-size string representation for a specific input; even the slightest change in the input data results in a completely different hash output. Therefore, if the hashes do not align, it strongly suggests that the data file has been tampered with and may not be trustworthy. This situation warrants the recommendation to drop the data file, as relying on potentially altered or corrupted data can lead to security vulnerabilities, data integrity issues, or operational failures. Consequently, ensuring that the data matches the original hash is vital for maintaining the integrity of the data being handled. The incorrect choices do not accurately reflect what a hash mismatch indicates. For instance, encryption doesn't inherently affect the hash; a file can be hashed before or after encryption. Additionally, while a hash mismatch can suggest potential malware issues, it does not directly confirm that the file is virus-free. Lastly, the method of data transmission (plaintext or otherwise) is independent of the hash verification process, as the integrity of the file is what matters in this context.