Investigators cannot place events from workloads in three cloud regions in the correct order, because each system logs in its own local time zone and several clocks have drifted. What should be implemented to fix this?
Select an answer to reveal the explanation.
Short Explanation
If every witness wears a different watch set to a different time zone, you'll never agree on what happened first. Point every system at the same trusted clock and write timestamps in UTC. More logs just means more confusion if the times don't line up.
Full Explanation
Correlating events across systems requires timestamps that are both accurate and comparable. Accuracy comes from synchronizing every system to a common, reliable time source using a time synchronization protocol, so clock drift is eliminated or bounded. Comparability comes from recording timestamps in a single reference, typically Coordinated Universal Time, with sufficient precision, so events from different regions and time zones can be ordered without conversion errors such as daylight saving changes. Together these let investigators build a reliable timeline and support the evidential value of logs. Increasing log verbosity produces more events but does nothing to fix inconsistent or drifting clocks, so ordering problems remain and grow. A sequence counter that resets daily at local midnight orders events only within one region and one day, and resets at different absolute times across time zones, so it cannot order events between regions. Keeping each region's logs in a separate SIEM instance avoids mixing zones by preventing correlation altogether, which is the opposite of what the investigation needs. Exam caveat: time synchronization also matters for authentication protocols and certificate validation, not only for logging. Operational check: compare clock offsets across a sample of systems in each region against the reference source and confirm all logs carry UTC timestamps.