Among indicator classifications, which type is most commonly represented by hashes of files?

• A. Atomic Indicators
• B. Behavioral Indicators
• C. Computed Indicators
• D. Indicator signatures

Answer: (C)

The idea being tested is how indicators are categorized. A hash of a file is produced by applying a hash function to the file’s bytes, so the value you see is the result of a computation rather than the raw artifact itself. That makes it a computed indicator—the information you obtain by calculating something from the data, not the original artifact alone.

Hashes are the most commonly used form of this type because they provide a stable, reproducible fingerprint of a file’s content. The same file content will always yield the same hash, which lets defenders quickly identify known malware, verify integrity across systems, and share detections independent of file names, paths, or other changing metadata. While other indicator types describe behavior, patterns, or raw artifacts, a file hash embodies the outcome of a calculation that uniquely represents the file’s content, hence why it’s categorized as computed.