AP Cybersecurity Drill 27: Checking File Integrity with Hashes

Question 1. Reading the table, which file's hash does not match between before and after transfer?

• A) parcel_north.csv, because its before and after digests are identical
• B) boundary_notes.csv, because a notes file is the most likely to be edited
• C) elevation_grid.csv, because its before and after digests differ ✓
• D) parcel_south.csv, because it appears second in the list of files

Explanation: Choice C is correct. The elevation_grid.csv row shows a before digest that differs from its after digest, while every other row matches; a changed digest is the only evidence that matters here. Choice A is incorrect because identical before and after digests mean parcel_north.csv is unchanged. Choice B is incorrect because boundary_notes.csv matches before and after, and a guess about which file is likely edited is not evidence. Choice D is incorrect because a file's position in the list says nothing about whether its hash changed.

Question 2. What does comparing these before-and-after hashes let the receiving site verify?

• A) That each file was kept confidential and could not be read while in transit
• B) That each file arrived intact, with its contents unchanged since it was sent ✓
• C) That each file was sent by the person who claims to have sent it
• D) That each file was compressed to take up less space during the transfer

Explanation: Choice B is correct. A hash comparison checks integrity: a matching digest shows the file's contents are unchanged since it was hashed. Choice A is incorrect because hashing does not hide contents; confidentiality comes from encryption. Choice C is incorrect because a plain hash does not establish who sent the file; that is authenticity, which needs a signature or keyed hash. Choice D is incorrect because hashing is unrelated to compression and does not shrink a file.

Question 3. A colleague says the recorded hash can simply be reversed to rebuild the original file. Why is that claim about a cryptographic hash incorrect?

• A) Because the hash is encrypted, so it must be decrypted with a key before it can be read at all
• B) Because the hash is longer than the file, so reversing it would produce far too much data
• C) Because the hash stores only the file's name and size, not the bytes needed to rebuild it
• D) Because a hash maps data to a fixed-length digest that is not feasibly reversible to the input ✓

Explanation: Choice D is correct. A cryptographic hash reduces input of any size to a fixed-length digest, and recovering the original input from that digest is not computationally feasible. Choice A is incorrect because a hash is not encrypted and uses no key, so decryption does not apply. Choice B is incorrect because the digest is fixed-length and usually far shorter than the file, not longer. Choice C is incorrect because the digest is computed from the file's contents, not merely its name and size.

Question 4. Because the elevation_grid.csv digests differ, what has the integrity check detected about that file?

• A) It was altered on purpose by an attacker, since accidental corruption would leave the hash unchanged
• B) It was read by an unauthorized person at some point while it was crossing the network
• C) Its contents changed somewhere between hashing at the sender and recomputing at the receiver ✓
• D) It was delivered to the wrong recipient and now needs to be routed to a different site

Explanation: Choice C is correct. A mismatch shows only that the bytes differ between the two hashing points; the file changed somewhere in between, whether by corruption or tampering. Choice A is incorrect because the hash alone cannot tell deliberate tampering from accidental corruption, and corruption does change the hash. Choice B is incorrect because a hash mismatch does not reveal whether anyone read the file; that is confidentiality, not integrity. Choice D is incorrect because nothing in a digest indicates the recipient or routing of the file.

Question 5. What is the best next step for the elevation_grid.csv file given the mismatch?

• A) Request the file again and re-verify its hash before using it ✓
• B) Open the file and use it, since most of its rows are probably still fine
• C) Delete every transferred file and restart the entire batch from the beginning
• D) Rename the file and keep it, assuming the digest tool made a display error

Explanation: Choice A is correct. Because the integrity check failed, the safe response is to obtain a fresh copy and confirm its hash matches before relying on the data. Choice B is incorrect because using a file known to differ risks acting on corrupted or tampered data. Choice C is incorrect because the other three files matched, so discarding the whole batch is unnecessary. Choice D is incorrect because assuming a display error and keeping the file ignores the evidence that its contents actually differ.