Knowledge CheckPass mark 80%+200 XP

Module 1 Assessment — Part A: Correlation Knowledge

Pass mark 80%1 / 3

After normalising all timestamps to UTC, your timeline shows an outbound beacon starting BEFORE the process that would send it. What is the best explanation?

A.A new attack technique that reverses cause and effectB.Clock tampering or a logging gap — the impossible order is a finding, not a factC.Ignore it; timelines are always approximateD.Close the case — the data is unreliable