CAS-004 Security Operations Practice Question
A security operations team is implementing a new SIEM and wants to ensure that log sources are properly synchronized. The team notices that some events appear out of order in the SIEM interface. Which of the following is the most likely cause and the best solution?
⚠ Common exam trap
The trap here is blaming the SIEM's parsing or time zone settings when the underlying issue is often unsynchronized clocks on the sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The log sources are not synchronized with a common time source. Implement NTP on all log sources and the SIEM.
The most likely cause of out-of-order events is clock skew due to unsynchronized clocks on log sources. Even small differences in system time can cause events to be sorted incorrectly. Implementing NTP on all log sources and the SIEM ensures a consistent time reference. This is a fundamental requirement for accurate log correlation and timeline analysis. Other factors like time zone or parsing issues can also cause problems, but clock skew is the primary culprit for subtle ordering issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network latency between log sources and the SIEM is causing delays. Deploy log collectors closer to the sources.
Why it's wrong here
Network latency can cause delays in log delivery but does not affect the event timestamps themselves. The SIEM should sort by event time, not receipt time. If events are delayed, they may appear later in the interface, but if timestamps are correct, they will be ordered correctly once ingested. Deploying collectors closer may reduce delay but does not address the root cause of out-of-order events.
- ✗
The SIEM is not parsing timestamps correctly. Update the SIEM's log parsers to recognize the timestamp format.
Why it's wrong here
If the SIEM fails to parse timestamps, events might be assigned the ingestion time instead of the event time, causing ordering issues. However, this would typically result in all events from a source having the same timestamp or being out of order in a consistent way. The scenario mentions some events appear out of order, which is more indicative of clock skew. Parsing issues would affect all events from that source.
- ✗
The SIEM is using a different time zone than the log sources. Configure all log sources to use UTC.
Why it's wrong here
Time zone differences can cause apparent ordering issues, but if all sources are in different time zones, the SIEM should normalize them to a common time zone, typically UTC. However, the problem states events appear out of order, which is more likely due to clock skew or ingestion delays. Simply setting all sources to UTC is good practice but may not resolve out-of-order events if clocks are not synchronized.
- ✓
The log sources are not synchronized with a common time source. Implement NTP on all log sources and the SIEM.
Why this is correct
Out-of-order events in a SIEM are often caused by clock skew between log sources. If clocks are not synchronized, timestamps can be inaccurate, leading to events being sorted incorrectly. Implementing NTP ensures all systems have consistent time, which is critical for correlation. This is the most likely cause and the best solution to maintain event order.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.