What approach is commonly used to automatically detect host intrusions by verifying file integrity?

What approach is commonly used to automatically detect host intrusions by verifying file integrity?

• A. File checksums
• B. Intrusion Detection System
• C. Antivirus Scanning
• D. Firewall Rules

Answer: (A)

Verifying file integrity with checksums is a common automated method to detect host intrusions. The approach works by taking cryptographic hashes of critical system files and storing them as a baseline. Later, the system recalculates the hashes and compares them to the baseline. If a file has been changed—whether by tampering, malware, or accidental modification—the hash will differ and trigger an alert. This lets defenders automatically notice unauthorized alterations even if there isn’t obvious suspicious activity elsewhere on the host. File integrity monitoring tools like Tripwire or AIDE are built around this principle, continuously or periodically checking that important executables, libraries, and configuration files remain unchanged. Other options operate differently: an Intrusion Detection System looks for signs of intrusion in traffic or behavior rather than file changes, antivirus scanning searches for known malware signatures on files, and firewall rules manage network access rather than monitoring and reporting on the integrity of host files.

Verifying file integrity with checksums is a common automated method to detect host intrusions. The approach works by taking cryptographic hashes of critical system files and storing them as a baseline. Later, the system recalculates the hashes and compares them to the baseline. If a file has been changed—whether by tampering, malware, or accidental modification—the hash will differ and trigger an alert. This lets defenders automatically notice unauthorized alterations even if there isn’t obvious suspicious activity elsewhere on the host. File integrity monitoring tools like Tripwire or AIDE are built around this principle, continuously or periodically checking that important executables, libraries, and configuration files remain unchanged.

Other options operate differently: an Intrusion Detection System looks for signs of intrusion in traffic or behavior rather than file changes, antivirus scanning searches for known malware signatures on files, and firewall rules manage network access rather than monitoring and reporting on the integrity of host files.