Election-office content servers must alert if campaign-filing PDFs or web binaries change outside a change window. Which capability best detects unauthorized file modifications?
Select an answer to reveal the explanation.
Short Explanation
Think of the election servers as a locked evidence locker with a seal on each box. File integrity monitoring checks that seal—hash or content—and yells when something moves outside the approved window.
Full Explanation
Election-office content servers holding campaign-filing PDFs and web binaries need continuous assurance that approved files have not been tampered with outside a change window. File integrity monitoring (FIM) establishes cryptographic baselines—typically hashes—of critical paths and compares subsequent state against that baseline, alerting when unexpected content or hash changes occur. That detection model matches the municipal need: authorized updates during a controlled window can be expected and acknowledged, while silent replacements of ballots-related publications or site binaries outside policy trigger investigation before citizens or candidates rely on altered material.
Weekly full backups preserve recovery points but do not, by themselves, continuously detect or alert on unauthorized modifications between backup jobs; restores without integrity checking can even reinstate compromised content. Disabling write permissions globally freezes legitimate updates and operations and is not a practical detection strategy for systems that must publish filings. Publishing file listings on a public website invites reconnaissance and still fails to provide authenticated, automated integrity alerting for operators.
Exam caveat: FIM alerts on change; it does not automatically tell you whether a change was malicious versus an unapproved but benign edit—tie alerts to change tickets and signed release processes. Also distinguish FIM from antivirus: AV looks for known malware patterns; FIM watches integrity of defined files regardless of signature.
Operational check: baseline election content and binary paths after authorized publishes, exclude noisy temp paths carefully, route unexpected-hash alerts to the SOC with change-window context, and periodically test by introducing a controlled unauthorized edit to prove the municipal FIM pipeline still fires.