Event correlation in CHFI v11 is a critical investigative technique used to reconstruct attack timelines by analyzing and correlating events from multiple log sources. The CHFI blueprint clearly distinguishes between Same-Platform Correlation and Cross-Platform Correlation under the domain of Image/Evidence Examination and Event Correlation .
Cross-Platform Correlation applies when an investigation involves heterogeneous environments , meaning different operating systems, hardware platforms, or network devices are involved in the incident. A common real-world example-explicitly referenced in CHFI training-is an enterprise environment where Windows-based client systems or servers interact with Linux-based infrastructure components such as firewalls, IDS/IPS devices, or proxies . In such cases, investigators must correlate Windows Event Logs with Linux syslogs, firewall logs, and network device records to build a unified timeline of attacker activity.
Option B correctly reflects this scenario by describing the use of Windows servers alongside Linux-based firewalls , which is a textbook example of Cross-Platform Correlation. Option A relates to standardization, not correlation. Option C represents a single-platform environment, and Option D refers to security tooling diversity rather than operating system or platform diversity.
CHFI v11 emphasizes Cross-Platform Correlation as essential for detecting multi-stage attacks , lateral movement, and perimeter breaches in modern hybrid infrastructures, making Option B the correct and exam- aligned answer