Exam CFR-310 topic 1 question 69 discussion

C. Domain Name System (DNS) records may have changed since the log was created. The GREATEST risk of having a SIEM collect computer names with older log entries is that DNS records may have changed over time. This means that the computer name associated with an older log entry might no longer resolve to the same IP address, leading to difficulties in accurately identifying which system generated the event at the time it occurred. Here’s a breakdown of the other options: A. Duplicate computer names: While possible, most modern networks use unique identifiers (like GUIDs or IP addresses) to distinguish systems, so this is less of a risk. B. Admissibility in court: The primary concern here would be the integrity of the logs and chain of custody, not the specific inclusion of a computer name. D. Field name duplication: This is more of a log parsing or storage issue rather than a significant risk in network security or forensics.