A security administrator needs to review events from different systems located worldwide. Which of the following is MOST important to ensure that logs can be effectively correlated?
A.
Logs should be synchronized to their local time zone.
B.
Logs should be synchronized to a common, predefined time source.
C.
Logs should contain the username of the user performing the action.
D.
Logs should include the physical location of the action performed.
B. Logs should be synchronized to a common, predefined time source.
Explanation:
Log synchronization to a common, predefined time source (such as using NTP - Network Time Protocol) ensures that all logs from different systems, regardless of their geographical location, use the same reference time. This is crucial for correlating events accurately across multiple systems worldwide, as discrepancies in time could make it difficult to piece together the sequence of events or detect incidents in real-time.
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
044f354
2 months, 4 weeks ago