Study. uk . com
  1. Home
  2. All questions
  3. Question 440

CISSP study material · question 440 of 500

Which two problems does NIST SP 800-92 identify when normalising times across log sources, and what does it recommend? Choose two.

  1. Timestamps recorded in a twelve-hour format cannot be converted at all.
  2. System clocks may be out of synchronisation, so time synchronisation such as a network time protocol server should be used.
  3. Systems in different time zones must all be converted to a single zone.
  4. Sources that log in coordinated universal time must be excluded from correlation.
Show the answer

Answer: C. Systems in different time zones must all be converted to a single zone.
B. System clocks may be out of synchronisation, so time synchronisation such as a network time protocol server should be used.

Sources in several zones must be converted to one, clocks drift apart, and time synchronisation technology is what keeps the sources consistent with each other.

Source: NIST SP 800-92 (NIST) — SP 800-92 > 3.2 footnote 24

Challenge yourself on this topic → Study as cards