A company’s Chief Information Security Officer requires that servers and firewalls have accurate timestamps when creating log files so that security analysts can correlate events during incident investigations. Which of the following should be implemented?

The Network Time Protocol (NTP) is specifically designed to synchronize the clocks of computer systems over a packet-switched, variable-latency data network. For security incident investigations, having precisely synchronized time across all devices, such as servers and firewalls, is critical. It allows security analysts to accurately correlate log entries from different sources to create a coherent timeline of events. Without synchronized time, determining the correct sequence of actions during an attack becomes extremely difficult, if not impossible.

A. Syslog server: A Syslog server is used for centralized log collection and storage. It does not synchronize the time on the devices that generate the logs.
B. SMTP: The Simple Mail Transfer Protocol (SMTP) is a standard for transmitting electronic mail (email) and is unrelated to network time synchronization.
C. SNMP: The Simple Network Management Protocol (SNMP) is used for managing and monitoring network devices. It is not the standard protocol for high-accuracy time synchronization.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-92

Guide to Computer Security Log Management.

Section 2.4

Log Generation

Page 2-4: "Organizations should also synchronize the clocks of all log sources on the network. Using a common time source

such as one provided by the Network Time Protocol (NTP) or an authenticated time source

makes it much easier to correlate and analyze log data from multiple sources."

2. Mills

D.

Martin

J.

et al. (2010). RFC 5905 - Network Time Protocol Version 4: Protocol and Algorithms Specification. Internet Engineering Task Force (IETF).

Section 1

Introduction

Page 3: "This document describes the Network Time Protocol (NTP)

which is widely used to synchronize computer clocks in the global Internet... It provides the mechanisms to select synchronization sources

mitigate the effects of network path asymmetry

and discipline the computer clock."

3. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 2

Application Layer

Section 2.6

Page 151: This section describes SMTP as the principal application-layer protocol for Internet electronic mail.

Chapter 9

Network Management

Section 9.2

Page 802: This section details SNMP as the primary protocol for conveying network-management control and information messages between a managing server and an agent executing on behalf of that managing server. This function is distinct from time synchronization.