Question 90
At the Quayside university IT office, a software-update client accepts downloaded packages without checking publisher signatures. Which underlying issue most directly explains this situation?
Explanation
Correct Answer
The evidence indicates that a hash alone does not identify which party authorized the content. The appropriate response is to verify a publisher signature against a trusted signing identity before installation and demonstrate that a modified update fails signature validation while the signed release installs.
Incorrect Answers
Fast unsalted hashing enables rapid offline guessing and reveals password reuse. That is not the mechanism that accounts for the stated failure at the Quayside university IT office.
The offered principle is: Vector similarity does not prove a retrieved chunk is trustworthy or authorized. In the source material it is associated with: Vector similarity does not prove a retrieved chunk is trustworthy or authorized. This case has a different controlling cause: A hash alone does not identify which party authorized the content. Its keyed mechanism is: A hash alone does not identify which party authorized the content.
Although mixed criticality zones permit compromise of public services to spread toward identity infrastructure, the presented symptoms do not support that as the primary cause; they indicate that a hash alone does not identify which party authorized the content. For the Quayside university IT office, the direct corrective action is to verify a publisher signature against a trusted signing identity before installation.