FIM

Detects unauthorized changes to critical files by comparing against a baseline.

FIM establishes a trusted baseline, often using cryptographic hashes, and alerts when monitored files, directories, or configurations change unexpectedly. This helps detect malware persistence, unauthorized tampering, and insider modification, and it supports compliance regimes that require change detection on critical systems. Because legitimate updates also trigger alerts, effective deployments whitelist expected activity such as patch cycles to control noise. The exam value is recognizing FIM as a detective control that surfaces integrity violations rather than preventing them, frequently feeding alerts into a SIEM.