Which logs benefit most from synchronized clocks?

• A. Logs from across systems enable accurate event correlation.
• B. All logs benefit equally.
• C. Only firewall logs.
• D. Logs are unaffected by time synchronization.

Answer: (C)

Synchronizing clocks is essential for cross-system event correlation. When all logs share a common time reference, you can line up events from different machines and devices to see how an incident unfolds across the environment. If clocks drift, events can appear out of order or be misattributed, making it hard to connect related actions. Because the main value of synchronized timestamps is realized when combining data from multiple sources, logs from across systems benefit the most for accurate timeline reconstruction. Relying on only firewall logs misses the broader context, and saying all logs benefit equally isn’t precise since the impact is greatest when linking events from multiple sources. And logs are indeed affected by time synchronization; inaccurate timestamps hinder analysis and response.