The answer is time drift between the system and the SIEM. This is the most likely cause of apparent gaps in cloud SIEM logs because when a system’s clock is not synchronized with the SIEM’s timestamp index, logs are recorded with incorrect timestamps. Even if every event is successfully forwarded, the SIEM may place those logs outside the queried incident timeframe, creating the illusion of missing data—a classic symptom of time drift rather than actual log loss. On the CHFI exam, this concept tests your understanding of log integrity and forensic timeline reconstruction; a common trap is assuming network connectivity or log source failure is the culprit. Remember the mnemonic “Drift Creates Gaps”—if you see gaps but no delivery errors, suspect clock skew first.
CHFI Network and Cloud Forensics Practice Question
This CHFI practice question tests your understanding of network and cloud forensics. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization uses a cloud-based SIEM to collect logs from multiple sources. The investigator notices gaps in the log data for a critical system during the incident timeframe. What is the MOST likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Time drift between the system and the SIEM
Time drift between the system and the SIEM causes logs to be timestamped incorrectly, leading to apparent gaps when the SIEM queries by time range. Even if logs are delivered, they may fall outside the incident timeframe in the SIEM's index, creating the illusion of missing data. This is a common issue in cloud-based SIEMs where NTP synchronization is not enforced across all sources.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Network latency delayed log delivery
Why it's wrong here
Latency delays but does not create gaps.
✗
Log rotation policy deleted logs prematurely
Why it's wrong here
Log rotation may delete old logs but would not cause gaps in the middle of an incident.
✓
Time drift between the system and the SIEM
Why this is correct
Clock skew can cause logs to appear missing or out of order.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The system's log level was set to ERROR only
Why it's wrong here
This would reduce log volume but not create specific gaps.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse 'missing logs' with 'logs not sent' (option A) or 'logs deleted' (option B), but the question specifically says 'gaps in the log data' during the incident timeframe, which points to a timestamp alignment issue rather than a delivery or retention problem.
Detailed technical explanation
How to think about this question
Under the hood, SIEMs like Splunk or Azure Sentinel rely on the timestamp in the log event (often extracted from the syslog header or a custom field) to determine the time bucket for indexing. If the system clock is off by even a few minutes due to NTP misconfiguration, logs may be indexed in a different time window, causing the SIEM to report gaps when searching the incident timeframe. In real-world scenarios, this is often discovered during forensic analysis when correlating logs from multiple sources reveals inconsistent timestamps for the same event.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CHFI exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CHFI question in full detail.
Network and Cloud Forensics — This question tests Network and Cloud Forensics — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Time drift between the system and the SIEM — Time drift between the system and the SIEM causes logs to be timestamped incorrectly, leading to apparent gaps when the SIEM queries by time range. Even if logs are delivered, they may fall outside the incident timeframe in the SIEM's index, creating the illusion of missing data. This is a common issue in cloud-based SIEMs where NTP synchronization is not enforced across all sources.
What should I do if I get this CHFI question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.