What does a changed cmd.exe hash indicate?

SY0-701 By islever Editorial Last updated

Short answer

D A rootkit was deployed.

Question

A systems administrator receives the following alert from a file integrity monitoring tool: The hash of the cmd.exe file has changed. The systems administrator checks the OS logs and notices that no patches were applied in the last two months. Which of the following most likely occurred?
  1. The end user changed the file permissions.
  2. A cryptographic collision was detected.
  3. A snapshot of the file system was taken.
  4. A rootkit was deployed. Correct Answer

Key Takeaways

This tests File Integrity Monitoring (FIM) interpretation, where the trap is confusing metadata changes like permissions with actual content modifications indicated by hash changes.

A change in the hash of a critical system file like cmd.exe without a corresponding update suggests unauthorized modification. The community agrees this is a strong indicator of a rootkit deployment designed to hide malicious activity.

Common mistake: Selecting A (permissions changed) is a common mistake because users often confuse metadata updates with actual file content changes, which are the only factors that affect a file's hash.

Expert Analysis

Why the Answer Is Correct

The hash of cmd.exe changing without a patch implies the file content was altered illegitimately. Rootkits frequently modify or replace system binaries to maintain persistence and evade detection. Since no legitimate update occurred, this unauthorized modification points directly to malware activity like a rootkit.

Why the Other Options Are Wrong

Changing file permissions (Option A) alters metadata, not the file content, so the hash would remain the same. A cryptographic collision (Option B) is statistically improbable and not the "most likely" scenario in a real-world security alert. Taking a snapshot (Option C) captures the state of the drive but does not modify the live file's content or hash.

Community Comment Notes

Commenters emphasize that rootkits specifically target system files to conceal their presence and provide attackers with persistent access. The consensus highlights that the absence of recent patching is the key context that rules out legitimate changes. The community strongly supports Option D as the standard interpretation of FIM alerts for core executables.

Exam Strategy

When analyzing File Integrity Monitoring (FIM) questions, always check for the context of recent updates or patches. If a critical system file hash changes without a corresponding update, immediately suspect malicious modification or rootkits rather than administrative errors.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Penguin1730 👍 18
    D. A rootkit was deployed. A change in the hash of a critical system file like cmd.exe, without any corresponding patches or updates being applied, is a strong indicator of potential malicious activity. A rootkit is a type of malware that can modify system files and hide its presence to maintain persistent and privileged access to a system. If a rootkit has altered cmd.exe, it could be an attempt to replace the legitimate command prompt with a malicious version, or to modify its behavior for nefarious purposes. This is a serious security concern and should be investigated immediately.
  2. Mehsotopes 👍 5 Answered D
    A rootkit can be snuck into a system, & provide functions for an attacker to tamper with system configuration settings without the knowledge of owners, or system administrators.
  3. SHADTECH123 👍 3 Answered D
    Changes to the hash of system files, such as cmd.exe, without corresponding patching activity, are often indicative of unauthorized modifications, such as those caused by malware or rootkits. Rootkits are malicious software designed to conceal their presence or the presence of other malware on a system. They often modify system files like cmd.exe to maintain persistence and evade detection.
  4. dbrowndiver 👍 2 Answered D
    o The hash change of a critical system file like cmd.exe without authorized patches indicates potential malware activity, with rootkits being a prime suspect due to their method of operation.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide