CCNA Network Services and Security Practice Question
Exhibit
R1# show ntp associations address ref clock st when poll reach delay offset disp ~192.0.2.50 203.0.113.1 3 12 64 377 22.1 0.8 1.2 *198.51.100.20 .GPS. 1 14 64 377 18.3 0.4 0.9
Exhibit: A branch router receives time from an NTP server, but the show output marks the server with a tilde instead of an asterisk. What does that mean?
⚠ Common exam trap
Be careful not to confuse the tilde (~) with the asterisk (*) or other symbols that indicate different statuses in NTP output.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The server is reachable but not the one currently selected for synchronization
In Cisco NTP output, the asterisk (*) indicates the current synchronization source. The tilde (~) specifically means the server is statically configured and reachable but has not been selected for synchronization. This differs from the plus sign (+), which denotes a candidate for synchronization. Therefore, the router is not using that server as its active time source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
That server is the current system clock source
Why it's wrong here
The asterisk (*) next to an NTP association in the 'show ntp status' or 'show ntp associations' output indicates the currently selected and synchronized source. If a server is merely reachable but not marked with an asterisk, it is not the system clock source. The system clock is synchronized to the source with the best reference stratum and distance; reachability alone does not make it the clock source.
When this WOULD be correct
This would be correct in a question asking: 'What does an asterisk (*) next to an NTP server indicate in the show ntp associations output?'
- ✓
The server is reachable but not the one currently selected for synchronization
Why this is correct
In Cisco IOS, 'show ntp associations' displays remote servers with symbols like '.' (rejected), 'o' (selected), '*' (system peer). If a server is reachable but not selected, it will appear without the asterisk, meaning the router can communicate with it and receive NTP packets, but it has not been chosen as the synchronization source due to stratum, offset, or reachability comparisons among multiple sources. This is a normal condition when the router has multiple NTP servers configured.
- ✗
NTP authentication has disabled the server permanently
Why it's wrong here
NTP authentication failure is indicated by an 'A' flag or specific authentication errors in NTP association output, not by the absence of the selected-source symbol. A reachable but unselected server can still pass authentication; the symbol simply reflects synchronization selection state. Permanent disablement is not a concept in NTP association symbols; authentication is either configured correctly or not.
When this WOULD be correct
If the question asked about an NTP server marked with a period (.) and the options included 'NTP authentication has disabled the server permanently,' that would be correct because a period indicates the server is unreachable or has failed authentication.
- ✗
The router is acting as an NTP master for that server
Why it's wrong here
When a router is configured as an NTP master, it uses its own clock as the reference and does not rely on an external server for synchronization. The association symbol indicates the role of the router as a client or peer relative to the remote server. If the router were acting as a master, it would provide time to other clients, not receive time from this server, and the association would show the server as a client, not as a potential synchronization source.
When this WOULD be correct
This option would be correct in a scenario where the question asks: 'What does it mean if a router is configured with the ntp master command and an NTP server is also configured?' In that case, the router could act as an NTP master for that server, providing time to it.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The server is reachable but not the one currently selected for synchronizationCorrect answer▾
Why this is correct
In Cisco IOS, 'show ntp associations' displays remote servers with symbols like '.' (rejected), 'o' (selected), '*' (system peer). If a server is reachable but not selected, it will appear without the asterisk, meaning the router can communicate with it and receive NTP packets, but it has not been chosen as the synchronization source due to stratum, offset, or reachability comparisons among multiple sources. This is a normal condition when the router has multiple NTP servers configured.
✗That server is the current system clock sourceWrong answer — click to see why▾
Why this is wrong here
In NTP, an asterisk (*) indicates the selected time source, while a tilde (~) means the server is reachable but not selected. Option A describes the asterisk, not the tilde.
★ When this WOULD be the correct answer
This would be correct in a question asking: 'What does an asterisk (*) next to an NTP server indicate in the show ntp associations output?'
Why candidates choose this
Candidates may confuse the tilde with the asterisk symbol, or assume any reachable server is the current source without understanding NTP's selection algorithm.
✗NTP authentication has disabled the server permanentlyWrong answer — click to see why▾
Why this is wrong here
A tilde (~) indicates the server is reachable but not synchronized; a permanently disabled server due to authentication would show a period (.) or not appear at all.
★ When this WOULD be the correct answer
If the question asked about an NTP server marked with a period (.) and the options included 'NTP authentication has disabled the server permanently,' that would be correct because a period indicates the server is unreachable or has failed authentication.
Why candidates choose this
Candidates may confuse the tilde symbol with authentication failure, or they may overgeneralize that any NTP issue is due to authentication problems.
✗The router is acting as an NTP master for that serverWrong answer — click to see why▾
Why this is wrong here
In the context of NTP, a tilde (~) indicates the server is reachable but not selected as the synchronization source. The router acting as an NTP master would be indicated by the 'master' command or stratum level, not by the tilde symbol.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks: 'What does it mean if a router is configured with the ntp master command and an NTP server is also configured?' In that case, the router could act as an NTP master for that server, providing time to it.
Why candidates choose this
Candidates may confuse the tilde symbol with the router's role as an NTP master, or they might think that a reachable server implies the router is providing time to it, rather than receiving time from it.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
Network Time Protocol
Network Time Protocol (NTP) is a networking protocol that synchronizes the clocks of computers and devices over a network to a common reference time source, typically Coordinated Universal Time (UTC).
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.