39. A software engineer is downloading a third-party application from a public repository and wants to ensure the application has not been maliciously altered. Which of the following techniques should the engineer use?
Answer: B
Code signing is the technique the engineer should use to ensure the application has not been maliciously altered.
Code signing provides a way to verify the integrity and authenticity of the application by ensuring that it has not been modified since it was signed by the developer. This technique uses cryptographic signatures to confirm that the application comes from a trusted source and remains untampered.
A) Dynamic analysis
Dynamic analysis involves executing the application in a controlled environment to observe its behavior. While this can help identify malicious actions during runtime, it does not provide assurance that the application has not been altered before execution, making it less suitable for verifying integrity.
B) Code signing
Code signing is a critical technique that allows the engineer to validate the authenticity and integrity of the application. By checking the digital signature, the engineer can confirm that the application has not been modified or tampered with since it was signed by the legitimate developer.
C) Encryption in transit
Encryption in transit secures data as it travels over the network, protecting it from interception during transmission. However, it does not address the integrity of the application itself once it has been downloaded, thus failing to ensure that the application has not been altered.
D) Static analysis
Static analysis involves examining the application's code without executing it, often to identify vulnerabilities or coding errors. Although it can provide insights into the code's quality, it does not verify whether the application has been altered after it was created, making it insufficient for confirming integrity.
Conclusion
Code signing is the definitive method for ensuring that a third-party application has not been maliciously altered, as it directly addresses the need for integrity and authenticity verification. The other options, while useful in their contexts, do not provide the same level of assurance regarding the application's state after it has been downloaded. Thus, code signing stands out as the most appropriate choice for this scenario.