easyMultiple ChoiceObjective-mapped
200-201 Practice Question: Which best practice helps ensure accurate network…
Which best practice helps ensure accurate network intrusion analysis when reviewing logs from multiple sources?
⚠ Common exam trap
Cisco often tests the misconception that log format consistency is more important than time synchronization, but without synchronized time, even identical formats cannot provide accurate event correlation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use synchronized time across all devices.
Synchronized time (via NTP) ensures that logs from different sources share a consistent timestamp, which is critical for correlating events across network devices during intrusion analysis. Without time synchronization, an attacker's actions might appear out of order or be missed entirely, leading to inaccurate incident reconstruction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use synchronized time across all devices.
Why this is correct
Time synchronization enables accurate correlation of events.
- ✗
Disable all logging except firewall logs.
Why it's wrong here
This reduces visibility and is not a best practice.
- ✗
Rely solely on automated analysis tools.
Why it's wrong here
Automation is helpful but cannot replace human analysis.
- ✗
Store logs in different formats for each source.
Why it's wrong here
Standardized formats facilitate analysis; different formats hinder it.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.