SY0-701 Security Operations Practice Question
A SOC analyst wants to make sure logs from multiple servers can be compared accurately during an incident review. What should be configured on those systems?
⚠ Common exam trap
A common mix-up: candidates confuse administrative convenience (same password) or storage capacity with the fundamental need for temporal consistency, overlooking that log correlation depends on synchronized clocks, not identical credentials or disk space.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Time synchronization using the same trusted time source
Time synchronization using a trusted time source (e.g., NTP) ensures that all servers share the same clock. During incident review, accurate log correlation depends on timestamps being consistent across systems; even a few seconds of drift can misalign event sequences. Without synchronized time, comparing logs from multiple servers becomes unreliable, potentially obscuring the true timeline of an attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A local administrator account with the same password on every server
Why it's wrong here
Using an identical local administrator password across all servers facilitates ease of administration but does nothing to align log timestamps or sequence events across systems. Moreover, it creates a single point of failure: if one server is compromised, the same credential grants lateral movement to every host, undermining the integrity of the very logs being compared. Time correlation, not credential symmetry, is what makes multi-server log analysis coherent.
- ✓
Time synchronization using the same trusted time source
Why this is correct
Time synchronization via a common trusted time source (such as an internal NTP server or a public stratum-1 source) ensures all servers generate logs with consistent timestamps. Without this alignment, event sequences from different systems appear skewed by the clock offset, making it impossible to reconstruct a true attack timeline. NTP (Network Time Protocol) with authentication (e.g., NTPv4 with symmetric keys or MS-SNTP) prevents an attacker from spoofing time updates, which is critical for forensic accuracy and log integrity.
- ✗
A larger disk size on the log server
Why it's wrong here
Allocating a larger disk to the log server increases log retention capacity but does not address the fundamental need for chronological alignment across sources. Even with years of logs, if each server runs on a different clock, the records cannot be reliably correlated or ordered. Storage capacity is a resource constraint, whereas time synchronization is a logical prerequisite for meaningful cross-system analysis.
- ✗
A separate VLAN for each application server
Why it's wrong here
Placing each application server on a separate VLAN improves security by isolating broadcast domains and restricting lateral traffic, but it has no effect on the clocks of the hosts. Log timestamps are generated by each system's local clock; network segmentation does not introduce a shared time reference. The SOC analyst needs a common time baseline, not network topology changes, to merge and compare logs effectively.
Visual reference
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.