Sophos Certified Engineer Practice Exam

When File Integrity Monitoring is enabled, which two items are monitored?

1. Documents and Folders

2. Files and Network Activity

3. Files and Registry Entries

4. Directories and Services

The correct answer is: Files and Registry Entries

The choice that includes files and registry entries is the correct answer because File Integrity Monitoring (FIM) is focused on tracking changes to critical system and application files, as well as monitoring the integrity of registry entries within the operating system. This process is essential for detecting unauthorized changes that could indicate security breaches or malicious activities. Files are fundamental components of any operating system, and monitoring them allows for the identification of alterations that could compromise system integrity or security. Similarly, registry entries play a crucial role in system configuration, settings, and behaviors. Any unauthorized changes to these entries could lead to significant vulnerabilities. The other items mentioned do not align as closely with the primary focus of File Integrity Monitoring. While monitoring documents and folders, network activity, or services may be relevant in broader security contexts, they typically fall outside the specific scope of FIM, which is dedicated to ensuring the integrity of files and crucial system components.