Why is time synchronization important for audit logs?

• A. It ensures all events can be sequenced correctly.
• B. It increases log size.
• C. It is optional.
• D. It prevents data loss

Answer: (A)

Time synchronization matters because audit logs rely on timestamps to mark when events happened. When all systems share a common clock, events from different machines can be ordered consistently, which is essential for reconstructing the sequence of actions, correlating activity across hosts, and performing effective forensic analysis or incident response. Without synchronized clocks, events may appear out of order, making it hard to tell what actually occurred or to align related events across systems. This is why synchronization is the best choice—it ensures the timeline is trustworthy. It won’t by itself change log size, isn’t optional in most environments, and doesn’t prevent data loss, but it keeps the sequence of events reliable. The practical approach is to align all devices to a trusted time source (for example, using NTP/PTP and UTC).