A hotel SOC sees two alerts that share one file hash and list two different guest-network IP addresses. What does that shared hash tie together?
Select an answer to reveal the explanation.
Short Explanation
Matching prints on two doors mean the same document showed up twice. You tie the shared hash to the same file on both hotel hosts, not to a person's name. The trap is reading the hash as a guest, a cipher suite, or a room key.
Full Explanation
A file hash is a digest of file contents. When two alerts carry the same hash, the contents match even if the guest-network addresses differ. The hash does not encode a person's name, a TLS suite, or a physical key. "The same file sitting on both hotel hosts that produced the two separate alerts" is what the hash ties together. "The same guest by name, inferred from the hash without any separate identity record" treats a digest as an identity, which a hash does not provide. "The same cipher suite, treating the file hash as if it were a TLS algorithm label" confuses a file fingerprint with a handshake field. "The same physical room key, as if that key were encoded inside the file hash" invents a meaning the digest does not have. Exam caveat: identical hashes mean identical contents, and two hosts can hold that file without being the same person. Operational check: hash both files again, confirm the digests match, and keep any guest name in a separate identity record. Different guest addresses do not turn one digest into two different files.