Understand event correlation, clock integrity, retention and test the resulting controls with reproducible evidence.
45 min 180 XPSkills: Event correlation, Clock integrity, Retention
Brief
Northwind Freight needs defensible evidence for logging and time, not a vocabulary quiz. Start with the system boundary and trace how a technical state changes the confidentiality, integrity or availability of the service. A passing document is not a passing running system.
You will examine event correlation, clock integrity, retention, then make short incident decisions and author a testable specification. Keep desired state, observed state and evidence separate: an approved requirement tells you what should happen, while a dated observation tells you what actually happened.
Never convert missing evidence into a passing control result.
Events with enough context
Authentication logs show sign-ins and factor events, system logs show service and kernel activity, and audit logs record security-relevant administrative actions. An application log can show a request outcome without proving who changed host policy. Capture actor, action, target, outcome, host identity and timestamp with offset so records can be correlated.
Severity is a producer convention, not a universal risk score. A warning about exhausted disk space may require faster action than an informational failed sign-in. Protect secrets by excluding passwords and raw session tokens from logs; access-controlled storage does not justify recording reusable credentials unnecessarily.
Monitoring controls need source inventories, field schemas and ingestion tests. An auditor asks which privileged actions generate events and whether failed operations are captured alongside successful ones.
Events with enough context requires both a declared boundary and independently testable observations.
Time is part of evidence
NTP synchronizes clocks using timestamp exchanges and estimates offset and delay; network asymmetry and untrusted sources can distort that estimate. A monotonic clock measures elapsed durations without wall-clock corrections, while civil timestamps are needed to correlate events across hosts. Store a time-zone offset or normalize event timestamps to UTC.
If one host is 90 seconds fast and another 30 seconds slow, their apparent event order can be wrong by 120 seconds. Monitor clock offset against approved sources and record corrections; do not rewrite original source events to hide skew. Use event time and ingestion time together when queues delay delivery.
Time-synchronization controls require source configuration, observed offsets and alert history. An auditor asks whether ordering claims account for the measured uncertainty at the time of an incident.
Time is part of evidence requires both a declared boundary and independently testable observations.
Retention, integrity and completeness
Retention must reflect investigation needs, legal requirements and storage cost. A policy might require 30 days searchable and 365 days retained; those are distinct service levels. Rotation on a host does not establish central retention if collection stopped, and a retention lock does not prove the record was accurate at creation.
Restrict deletion rights, send records to a separate trust boundary and use append-only or tamper-evident storage where appropriate. Hashes help detect later changes only when reference hashes are protected. Monitor sequence gaps, source heartbeat and expected volume so a silent collector is not mistaken for a quiet system.
Evidence preservation requires access history, disposal policy and verified retrieval tests. An auditor asks for a dated historical sample and proof that administrators of the monitored system cannot erase the independent copy.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: Wrong source
Scenario sim+60 XP
Read the brief and answer both questions.
Incident brief
A report uses a reboot message to prove who altered account policy. A separate privileged-action event contains actor, target and outcome. The owner calls the reboot entry administrative evidence.
Term bank, not all of these are right
audit logsystem logaccess logpacket log
1.1Which log type records the privileged action? (two words)
1.2Which log type commonly contains reboot messages? (two words)
Task 2: Clocks disagree
Scenario sim+60 XP
Read the brief and answer both questions.
Incident brief
Host A is 90 seconds fast and host B is 30 seconds slow. The analyst says their timestamps are only 60 seconds apart. The collection standard requires one common zero-offset time basis.
Term bank, not all of these are right
120UTC60local
2.1What is the maximum apparent relative skew here in seconds? (a number)
2.2Which time basis should normalized timestamps use? (one acronym)
Task 3: A protected but short history
Scenario sim+60 XP
Read the brief and answer both questions.
Incident brief
Records have protected hashes, but expire after seven days despite a year-long policy. The owner says tamper resistance automatically provides the missing history.
Term bank, not all of these are right
integrityretentionavailabilityseverity
3.1What property do protected hashes support against later modification? (one word)
3.2What property defines how long records remain available? (one word)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
The control owner calls the current summary complete because every field has a label. Several labels confuse a technical mechanism with assurance, and missing observations have been treated as passing.
Use the fixture as the authoritative requirement. Replace the empty fields with typed, testable values and identify the evidence needed to substantiate the claim. Do not copy the owner's optimistic summary.
Approved requirement and measured facts
Retain events 365 days, searchable for 30 days. Maximum absolute clock offset is 2 seconds. Evidence must include collector heartbeat and a protected hash reference.
The coordinator calls every line critical because it contains security terminology. The queue includes normal observations and verified changes as well as actual defects.
Use this exercise scale: active destructive compromise is critical; a confirmed unauthorized modification path is high; an isolated test coverage gap is medium; verified-state documentation hygiene is low. Informational verified observations are noise.
List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.
Observed events with scope and impact
IT6-1 ACTIVE: attacker-controlled account is currently deleting the sole event correlation evidence copy; stop ongoing destruction.
IT6-2 EXPOSED: unauthorized users can modify clock integrity configuration; exploit path confirmed, no current exploitation.
IT6-3 LIMITED: one isolated test node lacks a required retention observation; production unaffected.
IT6-4 HYGIENE: documentation heading for event correlation is stale, but measured state and coverage are verified.
IT6-5 Authentication logs show sign-ins and factor events, system logs show service and kernel activity, and audit logs record security-relevant administrative actions. Verified informational baseline observation, no gap.
IT6-6 NTP synchronizes clocks using timestamp exchanges and estimates offset and delay; network asymmetry and untrusted sources can distort that estimate. Verified informational mechanism observation, no gap.
IT6-7 Scheduled collector heartbeat received within the approved window; no missed collection.
IT6-8 Approved maintenance completed with independent post-change evidence and no unresolved finding.
1
2
3
4
5
6
7
8
9
10
11
12
Checks
The right findings are raised
Benign lines are left out
Severity matches the actual exposure
Ranked worst first
Next on your path · IT Fundamentals
Hardening and Patching
Understand baseline drift, patch lifecycle, risk prioritization and test the resulting controls with reproducible evidence.
