Which of the following presents the GREATEST challenge to a security operations center's (SOCs) timely identification of potential security breaches?

The correct answer is A. IT system clocks are not synchronized with the centralized logging server. A SOC's core function-correlating events across multiple systems to detect attack patterns-depends entirely on accurate, synchronized timestamps. When IT system clocks are not synchronized with the centralized logging server, log events cannot be reliably ordered or correlated…

Submitted by haruto_sh· Apr 18, 2026Information Security Incident Management

Question

Options

AIT system clocks are not synchronized with the centralized logging server.
BAn organization uses multiple cloud services.
COperating systems are no longer supported by the vendor.
DThe patch management system does not deploy patches in a timely manner.

How the community answered

(42 responses)

A
55% (23)
B
7% (3)
C
14% (6)
D
24% (10)

Explanation

A SOC's core function-correlating events across multiple systems to detect attack patterns-depends entirely on accurate, synchronized timestamps. When IT system clocks are not synchronized with the centralized logging server, log events cannot be reliably ordered or correlated. An attacker's lateral movement or a breach sequence that spans multiple systems becomes nearly impossible to reconstruct, causing the SOC to miss or significantly delay breach identification. Using multiple cloud services, unsupported operating systems, and delayed patching are risk factors, but none directly impair the SOC's fundamental ability to correlate log data in real time the way clock skew does.

Topics

#SOC operations#Log management#Event correlation#Time synchronization

Community Discussion

No community discussion yet for this question.

Full CISM Practice