A company's Chief Information Security Officer (CISO) requires that all servers have accurate time stamps for easier security incident investigation. Which of the following should be implemented?

Rationale

NTP should be implemented for accurate time stamps on servers.

Network Time Protocol (NTP) is specifically designed to synchronize the clocks of computers over a network, ensuring that all servers have accurate time stamps. This accuracy is crucial for security incident investigations, as it allows for proper correlation of events across different systems.

A (Syslog server) YOUR ANSWER

A Syslog server is used for collecting and storing log data from various devices, which is important for monitoring and analyzing system events. However, it does not inherently manage or synchronize time stamps, making it insufficient for the requirement of ensuring accurate time across servers.

B (SNMP) YOUR ANSWER

Simple Network Management Protocol (SNMP) is used for network management and monitoring devices on a network. While it can provide information about network devices, it does not synchronize time on servers, which is the primary need expressed for accurate time stamps in the context of security incident investigations.

C (NTP) CORRECT

NTP is the protocol explicitly designed for synchronizing the time across devices in a network. By implementing NTP, all servers can maintain consistent and accurate time stamps, which are essential for correlating logs and tracking security incidents effectively. This makes it the most suitable choice for the CISO’s requirement.

D (SNMP) YOUR ANSWER

This option is a repetition of choice B and does not alter the explanation. As previously stated, while SNMP is useful for network management, it does not fulfill the need for precise time synchronization across servers.

Conclusion

For a company's CISO to ensure that all servers maintain accurate time stamps, implementing NTP is essential. This protocol directly addresses the requirement by synchronizing the time across devices, which is crucial for effective security incident investigation. Other options like Syslog and SNMP, while beneficial for different purposes, do not provide the necessary time synchronization needed for accurate event correlation.

A company's Chief Information Security Officer (CISO) requires that all servers have accurate time stamps for easier security incident investigation. Which of the following should be implemented?

NTP should be implemented for accurate time stamps on servers.

Related Questions

Related Quizzes

How familiar were you with this question?

Report an Issue

Rate this Practice Test