What ensures consistent timestamps across logs in incident detection?

What ensures consistent timestamps across logs in incident detection?

• A. Time synchronization (NTP)
• B. Increasing log size
• C. Hiding events
• D. Encrypting logs

Answer: (A)

Time synchronization with a common reference clock is what keeps timestamps aligned across different logs. When every system—firewalls, endpoints, servers, and security tools—runs its clock in sync, their logs use the same time base, usually Coordinated Universal Time (UTC). That alignment lets you order events accurately and correlate actions from multiple sources to reconstruct what happened and when. If clocks drift apart, one device could show an event that actually occurred after another device’s event, but in the wrong order, which breaks the timeline in incident detection. NTP is the standard way networks keep those clocks in harmony. Devices periodically check time against trusted servers, adjust for drift, and maintain consistent timestamps across the board. Increasing log size won’t fix timing discrepancies, and hiding or encrypting events doesn’t address when they happened or how to line them up across sources.

Time synchronization with a common reference clock is what keeps timestamps aligned across different logs. When every system—firewalls, endpoints, servers, and security tools—runs its clock in sync, their logs use the same time base, usually Coordinated Universal Time (UTC). That alignment lets you order events accurately and correlate actions from multiple sources to reconstruct what happened and when. If clocks drift apart, one device could show an event that actually occurred after another device’s event, but in the wrong order, which breaks the timeline in incident detection.

NTP is the standard way networks keep those clocks in harmony. Devices periodically check time against trusted servers, adjust for drift, and maintain consistent timestamps across the board. Increasing log size won’t fix timing discrepancies, and hiding or encrypting events doesn’t address when they happened or how to line them up across sources.