To ensure accurate time for incident response, which time synchronization method is recommended?

• A. Disable time synchronization
• B. Synchronize all systems via authenticated NTP to a central time source
• C. Change system clocks manually every day
• D. Rely on local time without synchronization

Answer: (B)

Accurate incident response depends on everyone sharing a single, trusted time reference. When all systems are synchronized to a central time source, logs, events, and forensic data line up correctly, making it possible to reconstruct timelines, verify sequence of actions, and preserve evidence integrity.

Using authenticated NTP to a central time source provides that trusted reference and protects against time tampering. It keeps clocks in sync across the environment and ensures the time data cannot be spoofed, which is crucial for credible timelines and chain-of-custody: you can trust the timestamps when analyzing incidents.

Disabling time synchronization lets clocks drift at different rates, breaking the timeline. Manually adjusting clocks daily is error-prone and impractical for large environments. Relying on local time without synchronization yields no common frame of reference, making cross-system correlation unreliable.