An organization downloads backup archives from cloud storage to an offline vault. Auditors require proof, at any later date, that each archive has not been altered since it was created. Which technique directly provides this assurance?
Select an answer to reveal the explanation.
Short Explanation
A hash is a fingerprint for data: change one byte and the fingerprint changes completely. Take the fingerprint when you create the archive, take it again later, and compare. The trap is mixing up secrecy with integrity; encryption keeps it private, but it doesn't prove nobody touched it.
Full Explanation
Hashing is the cryptographic tool for data integrity. A secure hash function produces a fixed-length digest that changes unpredictably if any bit of the input changes, and finding a different input with the same digest is computationally infeasible. Recording each archive's hash at creation, and storing those values where they cannot be altered by the same parties, allows anyone to recompute the hash later and confirm the archive is unchanged. Encryption with a symmetric key provides confidentiality, not integrity; ciphertext can still be modified or replaced, and unless an authenticated mode or separate integrity check is used, the change may go undetected or surface only as corrupted output. Lossless compression formats may include checksums, but they are designed to catch accidental corruption, not to provide cryptographic proof against deliberate tampering. Replicating to two regions improves availability, but replication propagates changes, so matching replicas can simply mean both copies were altered or corrupted together. Exam caveat: a hash alone shows that data matches a reference value; it does not show who created it, which requires a signature. Operational check: store reference hashes in a protected, separate location and run scheduled verification of the vault's archives.