Identity and Access Management
Question #237
A SOC team reports that misaligned timestamps across multiple logs in a SIEM are breaking incident correlation. Which of the following should you check first to troubleshoot the root cause?
A. Check general performance of monitored hosts (CPU, RAM, disk, network usage).
B. Verify the UDP port 123 (NTP) configuration on the SIEM server.
C. Review deduplication policies set up in the SIEM.
D. Confirm if the SIEM service has administrative privileges.
Domain Concept: Identity and Access Management
This scenario evaluates management-level decision making in Identity and Access Management. In CISSP exam scenarios, evaluate answers through executive governance, risk assessment, life safety, and due diligence before implementing technical controls.
💡 View the Answer & Detailed Explanation
The correct answer to this scenario-based question requires an understanding of the CISSP Managerial Mindset. Register to view our in-depth explanation and access 1100+ adaptive questions completely free.