A county IT team needs device clocks to agree so syslog and AAA records correlate, and they want protection against rogue time sources. Which practice best meets both goals?
Select an answer to reveal the explanation.
Short Explanation
Logs without matching clocks are like police reports with three different time zones. Point everyone at a trusted NTP source and authenticate it so a prank time server cannot rewrite your timeline. That is how county-wide correlation actually works.
Full Explanation
County syslog and AAA correlation require agreed device clocks, and civic environments also need protection against rogue time sources. Authenticated NTP toward a trusted civic stratum source synchronizes clocks securely, meeting both goals. That practice is the standard answer when the stem pairs correlation with anti-spoofing of time.
Setting clocks manually once per year and disabling NTP guarantees drift and breaks correlation. Using unsynchronized local clocks with logging timestamps disabled makes timelines useless. Preferring random public NTP pools without authentication exposes closet switches to untrusted or spoofable time sources.
Exam caveat: authentication (or equivalent secure time distribution) is the differentiator versus merely “run NTP”; reachability to a trusted source still matters. Operational check: configure authenticated NTP to the civic stratum, verify associations and offsets across sample closets, and confirm syslog/AAA timestamps align during a controlled test event. County evidence packages for audits should show NTP associations and authentication status alongside the syslog samples used in incident timelines. Record the chosen control and rejected alternatives in the municipal change record so future on-call engineers understand the failure modes avoided for city services.