問題文
Two firewalls report the same event, but the records arrive with times that differ by several minutes. Why does an analyst care about that before drawing conclusions?
選択肢
- Because the order of events across devices is what an investigation relies on, and a clock difference makes that order unreliable.
- Because records with mismatched times are rejected by the central store and therefore never appear in the results of a query that covers the period in question.
- Because the time difference changes which rule handled the session, and the analyst has to correct the timestamps before reading the rulebase.
- Because the retention period is measured from the recorded time so a device whose clock runs ahead loses its entries earlier than the rest.