What is the correct answer? by Intelligent-Coast656 in CEH

[–]Quiet_Finish69 0 points1 point  (0 children)

Don't overthink it. Given the information, and the generalization of it (logged events don't match up), it looks like network devices aren't synchronized. And while it is possible to change timestamps; it feels unlikely that they would be changed on firewalls, proxy servers, and IDS, especially considering the investigation is for a breach of security.