A library cannot order a security incident because the firewall log and the server log disagree by several minutes. Which change puts those clocks on one timeline?
Select an answer to reveal the explanation.
Short Explanation
Two clocks that disagree by minutes will tell you the end of the story before the beginning. You point the firewall and the servers at the same NTP source so their logs share one timeline. A tighter industrial clock, two different NTP servers, or local time zones with no shared source leave the logs on different timelines.
Full Explanation
Network Time Protocol distributes a common time to hosts and network devices so their timestamps can be compared. A gap of several minutes between a firewall log and a server log makes it impossible to say which event happened first. Pointing both at the same NTP source removes that skew and lets an incident be ordered. Precision Time Protocol is built for very tight synchronization, on the order of the sub-microsecond timing used in industrial and telecom settings. Log lines that are minutes apart do not need that class of clock, and introducing it does not describe the ordinary requirement, which is one reliable NTP source for the systems that write the logs. Pointing the firewall and the servers at different NTP servers still uses NTP, and the clocks are not shared. Stamping each log in a local time zone sorts nothing if the clocks disagree by minutes. Exam caveat: the NTP source itself has to be stable and reachable. Two devices aimed at two different, drifting sources can still disagree. Operational check: after the change, compare a fresh firewall event with the matching server event and confirm the timestamps agree within a small fraction of a minute rather than several minutes.