CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Define an NTP authentication key using the ntp authentication-key command.

  Why this is correct

  The ntp authentication-key command creates the cryptographic credential that NTP will later use to validate time sources. You must specify a key ID and an MD5 authentication string (optionally encrypted with type 7), because every subsequent configuration step—trusting the key, associating it with a server—references this numeric key ID. Without this defined key, the router has nothing to compare against when a peer or server sends its MD5 digest.

• ✓

  Enable NTP authentication globally using the ntp authenticate command.

  Why this is correct

  The ntp authenticate command is the global master switch that turns on NTP authentication for all NTP associations on the device. Even with keys defined and trusted, this command must be issued, or else the router will accept unauthenticated NTP packets and the defined keys will never actually be enforced. It is a common pitfall to define and trust keys but forget this command, leaving NTP effectively unauthenticated.

• ✓

  Specify the trusted key with the ntp trusted-key command.

  Why this is correct

  The ntp trusted-key command builds an allowlist of key IDs that the router will accept when authenticating NTP peers or servers. If a key is defined but not listed as trusted, the router discards NTP packets carrying that key ID, causing authentication to fail. This step distinguishes legitimate time sources from randomly defined keys and prevents a malicious or misconfigured peer from using an untrusted key to spoof NTP.

• ✓

  Associate the NTP server with the authentication key using the ntp server command with the key option.

  Why this is correct

  The ntp server command with the key keyword binds a specific remote NTP server to a previously defined and trusted key ID. This is the per-association step that tells the router which key to use when sending and verifying NTP packets to that particular server; without it, even if global authentication is enabled, the server association remains unauthenticated. Using distinct key IDs per server allows different NTP servers to authenticate with separate credentials.

• ✓

  Verify the authenticated NTP association using the show ntp associations command.

  Why this is correct

  The show ntp associations command is the verification step that confirms whether each NTP association is actually authenticated and synchronized. Its output displays each peer/server address, the stratum, the poll interval, and reachability, and importantly marks associations with an asterisk (*) for synchronized and shows authentication status. This command is essential for troubleshooting because it reveals mismatched keys, untrusted keys, or missing global authentication, which often produce a 'bad authentication' or 'not configured' state.