Analysts investigating an incident cannot reconstruct the sequence of events because timestamps on servers, firewalls and authentication systems differ by several minutes. Which control would MOST have prevented this problem?
Select an answer to reveal the explanation.
Short Explanation
Trying to build a timeline from unsynchronized clocks is like five witnesses each wearing a watch set to a different time. Your story falls apart. You synchronize the clocks first; more detail or stronger protection won't fix the ordering.
Full Explanation
Investigations depend on a reliable timeline that correlates events across systems, and that is only possible when every system records time against the same reference. Synchronizing clocks to a common, authoritative time source ensures that a login on the authentication system, a connection through the firewall and a process on a server can be placed in correct order, which is essential for determining scope, attack path and dwell time, and for presenting credible evidence. Encrypting log files at rest protects their confidentiality but does nothing to correct the time values inside them. Increasing logging verbosity captures more events, yet each extra event still carries a skewed timestamp, so the ordering problem remains and analysis becomes harder. Write-once media protects logs from tampering and supports evidentiary integrity, which matters, but integrity of a wrong timestamp does not make it right. Exam caveat: time synchronization and appropriate log retention are both foundational for investigation readiness; when the stem describes misaligned timestamps, synchronization is the targeted control. Operational check: confirm all critical systems use the approved time source, monitor for drift, and record time zone handling consistently in collected logs.