CCNA Network Services and Security Practice Question
A company wants all routers and switches to use a common time source so log timestamps line up during incident review. Which two statements about NTP are correct?
⚠ Common exam trap
A common exam trap is mistaking NTP for a routing or security protocol. Some candidates incorrectly believe NTP advertises Layer 3 reachability like routing protocols (e.g., OSPF or EIGRP) or that it encrypts data traffic by default. This confusion arises because NTP is often mentioned alongside other network services, but its sole purpose is to synchronize device clocks. Selecting options related to routing or encryption when the question focuses on time synchronization leads to incorrect answers. Understanding that NTP only aligns time across devices helps avoid this trap.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It helps synchronize device clocks
NTP (Network Time Protocol) is used to synchronize device clocks (option A) so that event timestamps are consistent across network devices, which improves correlation of syslog and other event data (option B). Option C is incorrect because NTP does not advertise Layer 3 reachability; that is a function of routing protocols like OSPF or EIGRP. Option D is incorrect because NTP does not encrypt data traffic by default; it only synchronizes time and does not provide encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It helps synchronize device clocks
Why this is correct
NTP uses a hierarchical stratum model to distribute UTC time from authoritative sources down to client routers and switches, typically over UDP port 123. Each device adjusts its local clock gradually to eliminate drift and jitter, converging on a mutually consistent time reference. This is the core synchronization mechanism that makes a common time base possible across all networking devices.
- ✓
Consistent time improves correlation of syslog and other event data
Why this is correct
When syslog entries, interface counters, RADIUS/TACACS+ records, and access logs carry trustworthy, synchronized timestamps, administrators can sequence security-related and operational events across multiple devices. If each device ticks to a different clock, a single incident can appear as unrelated entries, and reconstructing the exact order of a DDoS attack or unauthorized access becomes nearly impossible. A common time base enables correlated analysis and accurate forensic timelines.
- ✗
It advertises Layer 3 reachability between routers
Why it's wrong here
NTP is transported over IP, but it does not exchange routing information or build neighbor adjacency for Layer 3 reachability. Routing protocols — such as OSPF, EIGRP, and BGP — are responsible for discovering paths and populating the routing table, while NTP merely carries time-sync packets. Therefore, NTP cannot serve as a substitute for a routing protocol.
When this WOULD be correct
In a question about routing protocols that advertise Layer 3 reachability between routers, such as 'Which protocol advertises Layer 3 reachability?' then options like OSPF or EIGRP would be correct, but NTP would not.
- ✗
It encrypts data traffic between endpoints by default
Why it's wrong here
NTP is strictly a time synchronization protocol, so it does not encrypt or protect data-plane traffic by default. Its messages carry time information, not user payloads, and any confidentiality on the wire is an optional enhancement such as NTP authentication, which only verifies packet integrity, not encrypt traffic. Encryption of endpoints is handled by separate protocols like IPsec, TLS, or SSH, not by NTP itself.
When this WOULD be correct
If the question asked 'Which protocol encrypts data traffic between endpoints by default?' or 'Which protocol provides confidentiality for IP communications?', then IPsec (or a similar encryption protocol) would be correct, not NTP.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It helps synchronize device clocksCorrect answer▾
Why this is correct
NTP uses a hierarchical stratum model to distribute UTC time from authoritative sources down to client routers and switches, typically over UDP port 123. Each device adjusts its local clock gradually to eliminate drift and jitter, converging on a mutually consistent time reference. This is the core synchronization mechanism that makes a common time base possible across all networking devices.
✗It advertises Layer 3 reachability between routersWrong answer — click to see why▾
Why this is wrong here
NTP is used for clock synchronization, not for advertising Layer 3 reachability; routing protocols like OSPF or EIGRP perform that function.
★ When this WOULD be the correct answer
In a question about routing protocols that advertise Layer 3 reachability between routers, such as 'Which protocol advertises Layer 3 reachability?' then options like OSPF or EIGRP would be correct, but NTP would not.
Why candidates choose this
Candidates may confuse NTP with routing protocols because both involve network communication and time synchronization is sometimes associated with network discovery or keepalive mechanisms.
✗It encrypts data traffic between endpoints by defaultWrong answer — click to see why▾
Why this is wrong here
NTP does not encrypt data traffic; it synchronizes clocks. Encryption of data traffic is handled by protocols like IPsec or TLS, not NTP.
★ When this WOULD be the correct answer
If the question asked 'Which protocol encrypts data traffic between endpoints by default?' or 'Which protocol provides confidentiality for IP communications?', then IPsec (or a similar encryption protocol) would be correct, not NTP.
Why candidates choose this
Candidates may confuse NTP with security protocols or assume that any network protocol provides encryption, especially if they have limited experience with NTP's actual function.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
OSPF
OSPF is a link-state routing protocol used to find the best path for data packets to travel across IP networks, like a smart GPS that recalculates routes when traffic changes.
Key term
Syslog
Syslog is a standard protocol used to send and store log messages from network devices and servers to a central logging server for monitoring and troubleshooting.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.