Which files are considered critical for change-detection purposes?

Which files are considered critical for change-detection purposes?

• A. System executables, application executables, configuration and log files
• B. User documents only
• C. Multimedia files
• D. Temporary files

Answer: (A)

Change-detection focuses on files whose integrity directly affects system security and the ability to detect tampering. In practice, monitoring system and application executables, along with configuration and log files, provides the strongest signal if something malicious has altered how the system operates or records events. System and application executables are the actual code that runs; if an attacker changes them, they can insert backdoors or disable protections. Configuration files determine how security controls behave, so tampering can weaken defenses. Log files are where audit trails live, and attackers may try to modify them to cover tracks, so keeping an eye on changes helps reveal illicit activity. User documents, multimedia files, and temporary files are not typically monitored for change-detection because they are more likely to change legitimately and do not directly indicate security compromise.

Change-detection focuses on files whose integrity directly affects system security and the ability to detect tampering. In practice, monitoring system and application executables, along with configuration and log files, provides the strongest signal if something malicious has altered how the system operates or records events. System and application executables are the actual code that runs; if an attacker changes them, they can insert backdoors or disable protections. Configuration files determine how security controls behave, so tampering can weaken defenses. Log files are where audit trails live, and attackers may try to modify them to cover tracks, so keeping an eye on changes helps reveal illicit activity.

User documents, multimedia files, and temporary files are not typically monitored for change-detection because they are more likely to change legitimately and do not directly indicate security compromise.