The answer is to first check time synchronization and timezone normalization across all log sources. This is correct because a consistent five-minute offset between firewall and endpoint logs for the same connection almost always points to unsynchronized system clocks, not a network delay or attack artifact. On the CompTIA CySA+ CS0-003 exam, this scenario tests your understanding of the evidence source phase in incident reconstruction, where timeline integrity is critical; a common trap is to jump to investigating packet loss or routing issues instead of the more fundamental clock drift. Remember that without NTP alignment, even perfectly correlated events can mislead your analysis. A useful memory tip is “Sync before you sift”—always verify time sources before interpreting log order.
CS0-003 Security Operations Practice Question
This CS0-003 practice question tests your understanding of security operations. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: nTP (Network Time Protocol) is essential for clock synchronization.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the evidence source phase, Which evidence source best supports or refutes the detection?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Time synchronization and timezone normalization across log sources
A five-minute discrepancy between firewall and endpoint logs for the same connection strongly indicates a time synchronization issue. The analyst should first verify NTP configuration and timezone normalization across all log sources to ensure a consistent timeline. Without synchronized clocks, event ordering and correlation are unreliable, which can lead to incorrect conclusions during incident reconstruction.
Key principle: NTP (Network Time Protocol) is essential for clock synchronization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Time synchronization and timezone normalization across log sources
Why this is correct
Clock drift and timezone parsing commonly distort event order in SIEM timelines.
Clue confirmation
The clue words "best", "first" in the question point toward this answer.
Related concept
NTP (Network Time Protocol) is essential for clock synchronization.
✗
Delete one source from the timeline
Why it's wrong here
Removing telemetry reduces evidence quality.
✗
Prioritize only the source with the highest EPS
Why it's wrong here
Event volume does not determine chronological accuracy.
✗
Assume the firewall logs are falsified
Why it's wrong here
Time-order issues are often configuration problems, not proof of tampering.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that log volume or event priority should dictate which logs to trust, when in fact time synchronization is the foundational prerequisite for any timeline-based analysis.
Detailed technical explanation
How to think about this question
Under the hood, log timestamps are typically generated by the system clock of the logging device. If NTP is misconfigured or the timezone is not set to UTC across all sources, timestamps can drift by minutes or even hours. In real-world scenarios, a five-minute offset could cause an analyst to miss a critical sequence of events, such as a firewall blocking a connection before the endpoint even logs the outbound request, leading to a false narrative of the attack timeline.
KKey Concepts to Remember
NTP (Network Time Protocol) is essential for clock synchronization.
Timezone normalization converts all timestamps to a common standard (e.g., UTC).
Clock drift causes devices to gradually lose time accuracy.
SIEMs rely on accurate source timestamps for timeline construction.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
NTP (Network Time Protocol) is essential for clock synchronization.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CS0-003 question in full detail.
Review nTP (Network Time Protocol) is essential for clock synchronization., then practise related CS0-003 questions on the same topic to reinforce the concept.
Security Operations — This question tests Security Operations — NTP (Network Time Protocol) is essential for clock synchronization..
What is the correct answer to this question?
The correct answer is: Time synchronization and timezone normalization across log sources — A five-minute discrepancy between firewall and endpoint logs for the same connection strongly indicates a time synchronization issue. The analyst should first verify NTP configuration and timezone normalization across all log sources to ensure a consistent timeline. Without synchronized clocks, event ordering and correlation are unreliable, which can lead to incorrect conclusions during incident reconstruction.
What should I do if I get this CS0-003 question wrong?
Review nTP (Network Time Protocol) is essential for clock synchronization., then practise related CS0-003 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "best", "first". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
NTP (Network Time Protocol) is essential for clock synchronization.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the alert triage phase, Which action gives the analyst the clearest next triage step?
medium
A.Prioritize only the source with the highest EPS
✓ B.Time synchronization and timezone normalization across log sources
C.Assume the firewall logs are falsified
D.Delete one source from the timeline
Why B: Time synchronization and timezone normalization across log sources is the correct first check because a consistent five-minute offset between firewall and endpoint events for the same connection strongly indicates a clock drift or timezone misconfiguration rather than a security anomaly. In incident reconstruction, analysts must ensure all timestamps are aligned to a common reference (e.g., UTC) and that NTP is properly configured on all devices; otherwise, the timeline is unreliable. This step directly addresses the root cause before any triage or prioritization can occur.
Variation 2. During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the root-cause analysis phase, Which finding would most directly explain the activity?
medium
✓ A.Time synchronization and timezone normalization across log sources
B.Delete one source from the timeline
C.Assume the firewall logs are falsified
D.Prioritize only the source with the highest EPS
Why A: The five-minute discrepancy between firewall and endpoint events for the same connection is a classic symptom of clock drift or misconfigured time synchronization. The analyst should first check NTP (Network Time Protocol) settings and timezone normalization across all log sources to ensure timestamps are aligned. Without synchronized time, correlation of events during incident reconstruction is unreliable, making this the foundational step in root-cause analysis.
Variation 3. During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the containment trade-off phase, Which response balances containment with evidence preservation?
medium
A.Prioritize only the source with the highest EPS
B.Delete one source from the timeline
C.Assume the firewall logs are falsified
✓ D.Time synchronization and timezone normalization across log sources
Why D: Time discrepancies between log sources are a classic symptom of clock drift or misconfigured time zones. Before assuming data tampering or prioritizing one source, the analyst must verify that all systems use synchronized time (e.g., NTP) and consistent timezone settings. This ensures the timeline is accurate for proper incident reconstruction.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CS0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.