企業の最高情報セキュリティ責任者は、セキュリティアナリストがインシデント調査中にイベントを関連付けることができるよう、サーバーとファイアウォールがログファイルを作成する際に正確なタイムスタンプを付けることを要求している。
以下のうち、どれを実施すべきでしょうか?
正解:C
The correct solution is NTP (Network Time Protocol). Accurate timestamps across servers, firewalls, and network devices are critical for correlating logs during incident response. NTP synchronizes device clocks to a trusted time source, ensuring consistency across the network.
A). Syslog centralizes logs but does not synchronize time.
B). SMTP is email transfer, unrelated to time.
D). SNMP monitors devices but does not correct time discrepancies.
By implementing NTP, analysts can ensure that logs from different devices are time-aligned, which is essential for reconstructing attack timelines and detecting anomalies.
References (CompTIA Network+ N10-009):
Domain: Network Operations - Time synchronization, NTP, log correlation.