Exam SY0-601 topic 1 question 375 discussion

Hashing makes no sense, as it has nothing with the order in which the logs are captured. Time stamps and the time offset (think time zones) will definitely impact the order in which they are displayed.

Time stamps: Logs typically contain time stamps that indicate when events occurred. The administrator can use these time stamps to establish the chronological order of the logs and understand the sequence of events. Time offset: In a distributed environment or when logs are collected from different servers or time zones, it's important to account for time offsets. The administrator should consider any time differences between servers and adjust the logs accordingly to ensure accurate sequencing.

D & F, for sure. You need time stamps to determine the sequence, and you need time offset to determine the correct for time zones (to make a sequence). hashing does nothing for sequencing events

Logs are one of the primary sources of determining the sequence of events. Log entries include timestamps, so anyone reading the logs can determine when the event occurred. However, it’s essential to consider time offsets based on how the timestamps are recorded.

objective 4.5, Timelines of sequence of events

The administrator should consider D. Time stamps and E. Hash values. Time stamps can be used to sort log entries chronologically, while hash values can be used to uniquely identify each entry.

D & F question is asking about time logs are displayed.

A and D

A. Chain of custody D. Time stamps

Hashing is about integrity, which is not part of the question. D and F.