SY0-701 Security Operations Practice Question
A SOC analyst notices that log timestamps from different servers do not line up during an investigation. What should be implemented to improve event correlation?
⚠ Common exam trap
It's easy for candidates to confuse operational security controls (like password policies or naming conventions) with the technical infrastructure needed for accurate log correlation, overlooking NTP as a fundamental prerequisite for time-based analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Time Protocol time synchronization across systems.
Network Time Protocol (NTP) synchronizes clocks across systems to a common time source, ensuring log timestamps align for accurate event correlation. Without NTP, timestamps from different servers can drift, making it impossible to reconstruct the sequence of events during an investigation. This is a foundational requirement for effective security monitoring and incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A more aggressive password policy for all users.
Why it's wrong here
Password policies govern credential strength and authentication resilience, but they have no influence on the hardware clocks or time daemons that produce log timestamps. Even if every account had 40-character passwords, servers would still record events using their own unsynchronized local time, so the SOC analyst would still see the same out-of-order events. The timestamp inconsistency is a system configuration problem, not an access-control problem.
- ✓
Network Time Protocol time synchronization across systems.
Why this is correct
Time synchronization is essential for reliable logging because incident responders need events to appear in the correct order. If servers use different clocks, correlations can become misleading and slow the investigation. NTP keeps system time aligned so SIEM alerts, authentication records, and host logs can be compared accurately across multiple systems.
- ✗
Longer user account names to make records easier to read.
Why it's wrong here
User account name length does not affect the fields that matter for log correlation, such as timestamp values or sequence numbers. While longer names might improve human readability of a log line, SIEM tools parse usernames as strings and do not depend on character count to determine event ordering. The core issue is that servers' clocks disagree, so no formatting change to account identifiers can align event timelines.
- ✗
Disabling centralized logging to reduce duplication.
Why it's wrong here
Centralized logging is the SIEM's aggregation point, and removing it would eliminate the very repository that allows event correlation. Reducing duplicate logs would not repair clock skew; instead, it would create silos of log data across endpoints, forcing investigators to manually align timelines from heterogeneous sources. The analyst's problem is inconsistent timestamps, not excessive log volume.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.