Study. uk . com
  1. Home
  2. All questions
  3. Question 514

CompTIA Security+ study material · question 514 of 611

An investigation cannot establish the order of events across three systems. Which prerequisite was most likely missing?

  1. A longer retention period
  2. Time synchronisation across sources
  3. Log normalisation
  4. Encrypted log transport
Show the answer

Answer: B. Time synchronisation across sources

Without a common clock, timestamps cannot be compared and the sequence cannot be reconstructed.

Source: NIST SP 800-92 (NIST) — SP 800-92 § 3.2 Functions

Challenge yourself on this topic → Study as cards