CCNA Network Services and Security Practice Question
A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?
⚠ Common exam trap
Don't confuse protocols with similar acronyms or those related to network management. Focus on the specific function of time synchronization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NTP
Consistent timestamps depend on synchronized clocks. NTP is the service used to keep network devices aligned to the same time reference, which makes syslog analysis and troubleshooting much more reliable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS
Why it's wrong here
DNS is a naming service that translates human-readable hostnames into IP addresses, enabling endpoint discovery and connectivity. It has no mechanism to adjust or synchronize device clocks, and DNS queries and responses involve timeouts and caching, not time synchronization, so using DNS would not address the need for consistent time across network infrastructure.
When this WOULD be correct
If the exam question asked about ensuring that devices can resolve hostnames to IP addresses for logging purposes, then DNS would be the correct answer. For instance, a scenario focusing on troubleshooting connectivity issues due to incorrect hostname resolution would make DNS relevant.
- ✓
NTP
Why this is correct
NTP is the correct choice because it synchronizes the system clocks of routers and switches across the network, ensuring consistent timestamps for logging, troubleshooting, and event correlation. Without NTP, device clocks drift independently, making it impossible to accurately sequence or compare events from different devices, which is critical for network monitoring and security forensics.
- ✗
SNMP
Why it's wrong here
SNMP is a management protocol used to monitor and control network devices by reading and setting variables, and for sending traps and alerts. It relies on each device's local clock for its timestamps, so it does not correct or synchronize time between devices; even if SNMP reports events, the time values remain unsynchronized, leaving the root problem of clock inconsistency unresolved.
When this WOULD be correct
If the question were about monitoring network performance and gathering statistics from devices, then SNMP would be the correct answer, as it provides valuable data for network management and troubleshooting.
- ✗
CDP
Why it's wrong here
CDP is a Cisco proprietary Layer 2 protocol that advertises device identity, platform, and capabilities to neighboring Cisco devices, facilitating topology discovery and network management. CDP does not carry any time synchronization information, and it operates only on directly connected links, so it cannot propagate time to all routers and switches in a consistent manner, making it irrelevant to the requirement of uniform clock settings.
When this WOULD be correct
If the exam question asked which protocol is essential for network device discovery and management in a Cisco environment, CDP would be the correct answer. This scenario would focus on identifying devices and their capabilities rather than time synchronization.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓NTPCorrect answer▾
Why this is correct
NTP is the correct choice because it synchronizes the system clocks of routers and switches across the network, ensuring consistent timestamps for logging, troubleshooting, and event correlation. Without NTP, device clocks drift independently, making it impossible to accurately sequence or compare events from different devices, which is critical for network monitoring and security forensics.
✗DNSWrong answer — click to see why▾
Why this is wrong here
DNS (Domain Name System) resolves hostnames to IP addresses and has no role in time synchronization. DNS does not provide timestamp information or clock setting capabilities. Verifying DNS would not help ensure consistent timestamps in logs.
★ When this WOULD be the correct answer
If the exam question asked about ensuring that devices can resolve hostnames to IP addresses for logging purposes, then DNS would be the correct answer. For instance, a scenario focusing on troubleshooting connectivity issues due to incorrect hostname resolution would make DNS relevant.
Why candidates choose this
Students may think DNS is involved because some logging systems use DNS for reverse lookups, but this does not affect timestamp accuracy. The similarity in acronyms (DNS vs. NTP) can also cause confusion.
✗SNMPWrong answer — click to see why▾
Why this is wrong here
SNMP (Simple Network Management Protocol) is used for monitoring and managing network devices, not for time synchronization. While SNMP can retrieve device uptime or timestamps from MIBs, it does not set or synchronize clocks. Relying on SNMP for time consistency would not correct clock drift.
★ When this WOULD be the correct answer
If the question were about monitoring network performance and gathering statistics from devices, then SNMP would be the correct answer, as it provides valuable data for network management and troubleshooting.
Why candidates choose this
Students might confuse SNMP with NTP because both are network management protocols. SNMP is often associated with monitoring and logging, leading to the mistaken belief that it handles timestamps.
✗CDPWrong answer — click to see why▾
Why this is wrong here
CDP (Cisco Discovery Protocol) is a Layer 2 protocol used to discover neighboring Cisco devices and their capabilities. It does not provide time synchronization or affect timestamps in logs. CDP is irrelevant for ensuring consistent timestamps.
★ When this WOULD be the correct answer
If the exam question asked which protocol is essential for network device discovery and management in a Cisco environment, CDP would be the correct answer. This scenario would focus on identifying devices and their capabilities rather than time synchronization.
Why candidates choose this
Students might associate CDP with device discovery and assume it also synchronizes time, or confuse CDP with NTP due to both being Cisco-related protocols. However, CDP has no time-related functionality.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Network Time Protocol
Network Time Protocol (NTP) is a networking protocol that synchronizes the clocks of computers and devices over a network to a common reference time source, typically Coordinated Universal Time (UTC).
Key term
Syslog
Syslog is a standard protocol used to send and store log messages from network devices and servers to a central logging server for monitoring and troubleshooting.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-301
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network team wants all devices to timestamp logs consistently so event correlation works across routers, switches, and firewalls. Which service should they configure first?
medium- A.DNS
- B.DHCP
- ✓ C.NTP
- D.TFTP
Why C: NTP provides consistent time across the infrastructure. Syslog carries log messages, but if device clocks are wrong, the log entries will still be hard to correlate. Accurate time is a foundational service for troubleshooting and forensics.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.