Tripwire is primarily used to detect unauthorized changes to what?

• A. Network traffic
• B. System files and web content
• C. User accounts
• D. DNS records

Answer: (B)

The main idea here is file integrity monitoring. Tripwire is a host-based integrity checker that creates a baseline snapshot of critical files and directories—such as system binaries, configuration files, and web content stored on a server. It records cryptographic hashes, permissions, and other attributes. On subsequent scans, Tripwire compares the current state to the baseline; any unauthorized modification triggers an alert, helping you detect tampering, malware, or unintended changes. Because of that focus, Tripwire is best suited to guarding system files and web content, not network traffic, user accounts, or DNS records, which are typically monitored by other security tools like network intrusion detectors, authentication logs, or DNS-change monitors.