NTP Synchronization for Log Timestamps
Exhibit
R2# show clock *00:12:11.123 UTC Mon Mar 1 1993 R3# show logging | include %LINEPROTO Mar 1 00:12:17.011: %LINEPROTO-5-UPDOWN: Line protocol on Interface G0/0, changed state to up
Users complain that log timestamps from several routers do not line up with one another. Which two actions are most appropriate?
Quick Answer
The answer is to verify timezone and timestamp settings, as the most appropriate actions when log timestamps from multiple routers do not line up. This is correct because NTP synchronization for consistent log timestamps ensures all devices share a common universal time reference, but without correct timezone and timestamp configurations, the displayed syslog messages will still appear misaligned due to local offsets or incorrect formatting. On the CCNA 200-301 v2 exam, this tests your understanding that NTP alone is not enough—you must also configure the clock timezone and service timestamps commands to correlate events across the network. A common trap is assuming NTP configuration alone fixes all timestamp issues, but the exam emphasizes that timezone mismatches are a frequent root cause of log correlation failures. Remember the memory tip: NTP gives the time, timezone gives the place—both are needed for logs to align.
⚠ Common exam trap
Don't confuse log display settings or buffer configurations with time synchronization settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure NTP on the network devices
Option A is correct because configuring NTP on the routers synchronizes their clocks to a common, authoritative time source, which is the fundamental fix for timestamps that do not align across devices. Option B is correct because even with NTP running, mismatched timezone or timestamp service settings (for example, 'service timestamps log datetime localtime' versus UTC, or an incorrect clock timezone offset) will make log entries appear inconsistent, so these settings must be verified. Option C is wrong because raising the syslog severity threshold to debugging only increases the volume and detail of logged messages; it does nothing to correct clock skew. Option D is wrong because disabling console logging merely stops messages from being displayed on the console and does not affect timestamp accuracy. Option E is wrong because clearing the logging buffer only discards stored log entries and has no effect on the time synchronization or timestamp formatting of future messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure NTP on the network devices
Why this is correct
NTP synchronises each router's clock to a common time source, so log timestamps across devices align. Without a shared reference, routers drift independently, producing the mismatched timestamps users reported; configuring NTP directly resolves that clock-skew constraint.
- ✓
Verify timezone and timestamp settings
Why this is correct
Verifying timezone and timestamp settings directly addresses the stem's constraint: mismatched log timestamps across routers. Routers may share NTP synchronisation yet still display differing local times if their timezone offsets or timestamp service configurations diverge. Aligning these settings ensures consistent, comparable log entries across all devices.
- ✗
Increase the syslog severity threshold to debugging
Why it's wrong here
Severity thresholds control which messages are logged, not clock accuracy; timestamps still drift because each router's own clock is unsynchronised. Raising the threshold to debugging merely floods syslog with extra low-severity events. Configuring NTP on every router is what actually aligns timestamps.
- ✗
Disable console logging
Why it's wrong here
Disabling console logging stops messages appearing on the terminal but does not alter the device clock, so recorded timestamps remain misaligned. It is tempting to reduce noise while investigating, yet the remedy is clock synchronisation through NTP plus matching timezone and service timestamp configuration.
When this WOULD be correct
When a question asks how to reduce CPU load on a router due to excessive logging, disabling console logging is appropriate because console logging is CPU-intensive and can be disabled without losing logs to other destinations.
- ✗
Clear the logging buffer on all devices
Why it's wrong here
Clearing the logging buffer deletes stored messages and leaves each device's clock unchanged, so timestamps still disagree. It is tempting as a troubleshooting step to remove stale entries, but the fix requires synchronising clocks, typically via NTP, and configuring consistent timezone and timestamp settings.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure NTP on the network devicesCorrect answer▾
Why this is correct
NTP synchronises each router's clock to a common time source, so log timestamps across devices align. Without a shared reference, routers drift independently, producing the mismatched timestamps users reported; configuring NTP directly resolves that clock-skew constraint.
✗Increase the syslog severity threshold to debuggingWrong answer — click to see why▾
Why this is wrong here
Increasing the syslog severity threshold to debugging generates more log messages but does not address the root cause of time discrepancies. It can overwhelm storage and analysis without fixing the time synchronization issue.
Why candidates choose this
Students might think that more detailed logs help identify the problem, but this confuses log verbosity with time accuracy. Debugging logs do not correct clock drift.
✗Disable console loggingWrong answer — click to see why▾
Why this is wrong here
Disabling console logging does not address timestamp synchronization; it only stops log messages from appearing on the console, which does not align timestamps across devices.
★ When this WOULD be the correct answer
When a question asks how to reduce CPU load on a router due to excessive logging, disabling console logging is appropriate because console logging is CPU-intensive and can be disabled without losing logs to other destinations.
Why candidates choose this
Candidates may think console logging causes timestamp issues or that disabling it resets timestamps, confusing logging behavior with time synchronization.
✗Clear the logging buffer on all devicesWrong answer — click to see why▾
Why this is wrong here
Clearing the logging buffer removes existing log entries but does not prevent future timestamps from being incorrect. The time drift persists, so new logs will still have mismatched timestamps.
Why candidates choose this
Students might believe that clearing logs resets the time or fixes the issue temporarily. In reality, it only deletes historical data without addressing the root cause.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Exam Trap: OSPF Common Mistakes
Key term
Syslog
Syslog is a standard protocol used to send and store log messages from network devices and servers to a central logging server for monitoring and troubleshooting.
Key term
NTP
Network Time Protocol is a networking protocol used to synchronize the clocks of computers and devices over a network to a common time reference.
About these practice questions
One of 1,450 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-301
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants all routers and switches to use a common time source so log timestamps line up during incident review. Which two statements about NTP are correct?
easy- ✓ A.It helps synchronize device clocks
- ✓ B.Consistent time improves correlation of syslog and other event data
- C.It advertises Layer 3 reachability between routers
- D.It encrypts data traffic between endpoints by default
Why A: NTP (Network Time Protocol) is used to synchronize device clocks (option A) so that event timestamps are consistent across network devices, which improves correlation of syslog and other event data (option B). Option C is incorrect because NTP does not advertise Layer 3 reachability; that is a function of routing protocols like OSPF or EIGRP. Option D is incorrect because NTP does not encrypt data traffic by default; it only synchronizes time and does not provide encryption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.