CCNA AI and Network Operations Practice Question
Exhibit
Router# show ntp status Clock is synchronized, stratum 16, reference is 0.0.0.0 nominal freq is 250.0000 Hz, actual freq is 250.0000 Hz, precision is 2**10 reference time is 0.0.0.0 clock offset is 0.0000 msec, root delay is 0.00 msec root dispersion is 0.00 msec, peer dispersion is 0.00 msec Router# show ntp associations address ref clock st when poll reach delay offset disp *~192.168.1.10 .INIT. 16 - 64 0 0.0 0.00 16000. * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured Router# show running-config | include ntp ntp server 192.168.1.10
A network engineer notices that the system clock on a Cisco IOS-XE router is incorrect, causing syslog timestamps to be unreliable. The router is configured as an NTP client to synchronize with a remote NTP server at 192.168.1.10. However, the show ntp status command indicates the clock is unsynchronized. What is the most likely cause of this issue?
⚠ Common exam trap
Cisco often tests the misconception that NTP uses TCP or that authentication is the primary cause of synchronization failure, when in fact the most common issue is simple network reachability or firewall blocking of UDP port 123.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The router cannot reach the NTP server due to a missing route or firewall blocking UDP port 123.
NTP operates over UDP port 123. If the router cannot reach the NTP server at 192.168.1.10 due to a missing route or a firewall blocking UDP 123, the NTP client will remain unsynchronized, as indicated by the 'show ntp status' command showing the clock as unsynchronized. This is the most common cause of NTP synchronization failure in a network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NTP server is using TCP instead of UDP for NTP communication.
Why it's wrong here
NTP is a protocol that exclusively uses UDP port 123 for both client requests and server replies; it does not have a TCP implementation for standard time synchronization. If the server were somehow configured to use TCP, the router's NTP client would still send its requests via UDP and would simply receive no response, but this scenario does not occur in practice because TCP is only used for NTP-over-TCP tunneling or diagnostic utilities, not for production NTP. Therefore, a TCP/UDP mismatch is not a plausible explanation for the reachability failure shown by the reach counter.
- ✓
The router cannot reach the NTP server due to a missing route or firewall blocking UDP port 123.
Why this is correct
The reach value of 0 in the 'show ntp status' output indicates that the router has not received any successful NTP responses from the configured server across the last eight polling attempts. This is typically caused by a Layer 3 routing problem preventing the router from sending packets to the server's IP address, or by a firewall/ACL dropping either the outbound request or the inbound reply because NTP uses UDP port 123. Without reachability, the router can never achieve synchronization, even if the server is running correctly and all other NTP settings match.
- ✗
The NTP server has a higher stratum level than the router's local clock, so the router ignores it.
Why it's wrong here
A server with a higher stratum number (e.g., stratum 4) is considered less authoritative than the router's own local clock if the router is running as stratum 3, so the NTP selection algorithm would choose not to synchronize to that server. However, this stratum-based preference only affects which of multiple reachable servers is selected as the synchronization source; it does not affect the router's ability to exchange NTP packets with the server. The reach counter would still reflect successful NTP packet exchanges even if the server's stratum caused it to be rejected for sync, so a reach of 0 cannot be explained by stratum alone. In fact, the router would still receive and process NTP messages, just not use them for clock synchronization.
- ✗
NTP authentication is misconfigured on the router.
Why it's wrong here
NTP authentication is a security feature that uses MD5 or SHA1 keys to verify the authenticity of NTP messages, but the running-configuration on the router does not display an 'ntp authentication-key' or 'ntp trusted-key' statement, so authentication is not enabled on this device. Even if authentication were enabled, a mismatch of keys would cause the router to drop the NTP response immediately after receiving it, which would typically update the reach counter to a nonzero value or generate an authentication failure log, rather than keeping reach at zero. The absence of any authentication configuration and the complete lack of received packets point to a connectivity issue, not a key mismatch.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The router cannot reach the NTP server due to a missing route or firewall blocking UDP port 123.Correct answer▾
Why this is correct
The reach value of 0 in the 'show ntp status' output indicates that the router has not received any successful NTP responses from the configured server across the last eight polling attempts. This is typically caused by a Layer 3 routing problem preventing the router from sending packets to the server's IP address, or by a firewall/ACL dropping either the outbound request or the inbound reply because NTP uses UDP port 123. Without reachability, the router can never achieve synchronization, even if the server is running correctly and all other NTP settings match.
✗The NTP server is using TCP instead of UDP for NTP communication.Wrong answer — click to see why▾
Why this is wrong here
NTP exclusively uses UDP port 123 for communication, not TCP. The statement that NTP uses TCP is factually incorrect.
Why candidates choose this
Students may confuse NTP with other protocols that use TCP, such as SNMP or FTP, or may recall that some NTP implementations can use TCP for control messages, but standard NTP synchronization uses UDP.
✗The NTP server has a higher stratum level than the router's local clock, so the router ignores it.Wrong answer — click to see why▾
Why this is wrong here
The router synchronizes with the server as long as the server's stratum is lower (more accurate) than the local clock; if the server has a higher stratum, the router may still synchronize if the local clock is unsynchronized, but this is not the most likely cause of the 'unsynchronized' state.
Why candidates choose this
A student might think that because Telnet is used for remote management, it might be needed to initiate NTP synchronization, or they may confuse NTP with other protocols that require a session.
✗NTP authentication is misconfigured on the router.Wrong answer — click to see why▾
Why this is wrong here
NTP authentication is not configured in the running-config, and the symptom described (unsynchronized clock with reach value 0) indicates a lack of connectivity, not an authentication failure. Authentication issues would typically show NTP packets being received but rejected, resulting in a non-zero reach value.
Why candidates choose this
Students may know that NTP authentication can cause synchronization issues if misconfigured, and might assume that any NTP problem is due to authentication, especially if they have studied NTP authentication scenarios.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Agentic AI in Network Operations
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.