An election office must centralize device logs after an incident and keep timelines trustworthy while cutting noise. Which operational practice best fits?
Select an answer to reveal the explanation.
Short Explanation
After an incident you want a synchronized story, not a scrapbook of random debug spam. Point devices at a syslog collector, keep clocks honest so timestamps line up, and use sharp conditional debugs instead of turning on the fire hose.
Full Explanation
Election-office incident response depends on centralized, trustworthy logs with correlated timelines and manageable noise. Sending syslog to a collector with reliable timestamps—and synchronized clocks—plus using conditional or focused debugs instead of global debug floods is the operational practice that meets those goals. Centralization enables forensics; clock sync makes timelines credible; conditional debugs keep CPU and log volume under control.
Leaving logging buffered-only without timestamps and enabling unconditional debug all on every switch destroys correlation and can destabilize devices. Disabling severity filtering so every debug print floods the collector continuously creates noise that hides the signal. Erasing local logs nightly so centralized syslog never needs correlation discards evidence and misunderstands how local and remote logging complement each other.
Exam caveat: NTP/PTP accuracy and syslog facility/severity design are part of the logging answer, not optional extras, when questions stress trustworthy timelines. Operational check: point devices at the collector, verify synchronized clocks, generate a known event, confirm it arrives with consistent timestamps, and practice a conditional debug that matches only the incident traffic class.