17. A company's Chief Information Security Officer (CISO) requires that all servers have accurate time stamps for easier security incident investigation. Which of the following should be implemented?
Answer: C
Implementing NTP ensures accurate time stamps for security incident investigation.
To provide accurate time stamps for all servers, implementing a Network Time Protocol (NTP) is essential. NTP synchronizes the clocks of servers, which is critical for maintaining consistent time across all systems involved in security incident investigations.
A) Syslog server
A Syslog server is used for logging messages from various devices but does not directly contribute to ensuring accurate time stamps. While it collects log data, the accuracy of those logs depends on the time synchronization provided by protocols like NTP.
B) SNMP
Simple Network Management Protocol (SNMP) is primarily used for network management and monitoring. It does not focus on time synchronization, making it unsuitable for the requirement of accurate time stamps in security incident investigations.
C) NTP
NTP is specifically designed to synchronize the clocks of computers over a network. By ensuring that all servers have the correct time, NTP directly fulfills the CISO's requirement for accurate time stamps, enabling effective security incident investigations.
D) SNMP
Similar to option B, this instance of SNMP does not contribute to time synchronization. Its role is limited to network management, thus failing to address the need for accurate timestamps in logs for security purposes.
Conclusion
NTP is the definitive solution for ensuring all servers have accurate time stamps, directly addressing the CISO's needs for improved security incident investigation. All other options, while relevant in different contexts, do not provide the necessary time synchronization that is critical for maintaining the integrity of security logs and incident analysis.