Why is time synchronization important for log analysis, and what protocols support it?

• A. It ensures accurate event timelines across systems.
• B. Protocols: HTTP and FTP
• C. Protocols: NTP and PTP
• D. It only affects time zones.

Answer: (C)

Accurate event timelines across systems hinge on synchronized clocks. In log analysis, you pull events from many devices, and when each device’s timestamp is slightly off, it’s hard to determine the true sequence of actions or reliably correlate activity across hosts. Time synchronization aligns all clocks to a common reference, making log timestamps consistent and enabling precise reconstruction of events and investigations. The protocols that support this are NTP (Network Time Protocol), which keeps clocks coordinated over a network, and PTP (Precision Time Protocol), which offers higher precision timing for environments that require sub-millisecond accuracy. HTTP and FTP aren’t used for time synchronization; they’re data transfer protocols. Time zones don’t solve the underlying timing of events—they’re a display convention, not a synchronization mechanism.