Ntp practice questions

A switch shows a clock that is several minutes off from other devices even though an NTP server has been configured. Which issue is the most likely cause?

Exhibit

show ntp associations
 address         ref clock     st when poll reach delay offset disp
*~10.10.50.5     .INIT.        16   -   64    0  0.000  0.000 16000
Configured server: 10.10.50.5

Trap 1: The device must run Syslog before NTP can sync

Syslog is unrelated.

Trap 2: NTP requires a trunk port on the management VLAN

NTP needs IP reachability, not a trunk specifically.

Trap 3: The clock can sync only if DNS is configured

NTP uses IP connectivity; DNS is optional if using addresses.

A
The NTP server is unsynchronized or unreachable
This is correct because NTP requires a reachable, synchronized time source. If the server is unreachable or not synchronized, the switch cannot update its clock, leading to drift.
B
The device must run Syslog before NTP can sync
Why wrong: Syslog is unrelated.
C
NTP requires a trunk port on the management VLAN
Why wrong: NTP needs IP reachability, not a trunk specifically.
D
The clock can sync only if DNS is configured
Why wrong: NTP uses IP connectivity; DNS is optional if using addresses.

Read the full network assurance explanation →

Question 2mediummultiple choice

Why is NTP especially useful when devices send logs to a centralized Syslog server?

Trap 1: It assigns the Syslog server an IP address.

This is wrong because NTP does not provide IP addressing.

Trap 2: It replaces the need for a Syslog server.

This is wrong because NTP and Syslog serve different roles.

Trap 3: It encrypts every Syslog message automatically.

This is wrong because NTP is not a Syslog encryption mechanism.

A
It helps align device clocks so centralized log timestamps can be correlated more accurately.
This is correct because consistent time improves the usefulness of centralized logs.
B
It assigns the Syslog server an IP address.
Why wrong: This is wrong because NTP does not provide IP addressing.
C
It replaces the need for a Syslog server.
Why wrong: This is wrong because NTP and Syslog serve different roles.
D
It encrypts every Syslog message automatically.
Why wrong: This is wrong because NTP is not a Syslog encryption mechanism.

Question 3mediummatching

Match each management or monitoring concept to its most accurate role.

Trap 1: SIEM: Manages network device configurations and monitors device…

This is incorrect because SIEM does not manage device configurations or use SNMP for health monitoring; those functions belong to network management systems like SNMP-based tools.

Trap 2: SIEM: Analyzes network traffic flows to identify bandwidth usage…

This is incorrect because traffic flow analysis is the role of NetFlow or similar flow monitoring tools, not SIEM.

Trap 3: SIEM: Controls user access to network resources based on roles and…

This is incorrect because role-based access control (RBAC) is the mechanism for managing user permissions, not SIEM.

A
SIEM: Centralizes and correlates log data from multiple sources for security analysis.
SIEM (Security Information and Event Management) aggregates logs from various devices, correlates events, and provides real-time analysis for security monitoring.
B
SIEM: Manages network device configurations and monitors device health via SNMP.
Why wrong: This is incorrect because SIEM does not manage device configurations or use SNMP for health monitoring; those functions belong to network management systems like SNMP-based tools.
C
SIEM: Analyzes network traffic flows to identify bandwidth usage and application performance.
Why wrong: This is incorrect because traffic flow analysis is the role of NetFlow or similar flow monitoring tools, not SIEM.
D
SIEM: Controls user access to network resources based on roles and policies.
Why wrong: This is incorrect because role-based access control (RBAC) is the mechanism for managing user permissions, not SIEM.

Question 4mediummatching

Match each IP service symptom to the most likely service involved.

Trap 1: Packet loss causes intermittent connectivity

Packet loss can cause intermittent connectivity, but the question asks for the most likely service involved. Packet loss is a symptom, not a service. The service most associated with packet loss is not a single service; it is a network condition.

Trap 2: Bandwidth congestion slows transfers

Bandwidth congestion can slow transfers, but it is a network condition, not a specific service. The question asks for the service involved, and bandwidth congestion is not a service.

Trap 3: Jitter affects real-time services

Jitter affects real-time services like VoIP and video, but the question asks for the most likely service involved. Jitter is a symptom, not a service. The service affected is real-time communication, but the symptom itself is jitter.

A
DNS failures prevent name resolution
DNS is responsible for translating domain names to IP addresses; if DNS fails, name resolution fails, and users cannot access resources by name.
B
Packet loss causes intermittent connectivity
Why wrong: Packet loss can cause intermittent connectivity, but the question asks for the most likely service involved. Packet loss is a symptom, not a service. The service most associated with packet loss is not a single service; it is a network condition.
C
Bandwidth congestion slows transfers
Why wrong: Bandwidth congestion can slow transfers, but it is a network condition, not a specific service. The question asks for the service involved, and bandwidth congestion is not a service.
D
Jitter affects real-time services
Why wrong: Jitter affects real-time services like VoIP and video, but the question asks for the most likely service involved. Jitter is a symptom, not a service. The service affected is real-time communication, but the symptom itself is jitter.

Question 5mediummultiple choice

Exhibit: A branch router receives time from an NTP server, but the show output marks the server with a tilde instead of an asterisk. What does that mean?

Exhibit

R1# show ntp associations
  address         ref clock     st   when   poll reach  delay  offset   disp
~192.0.2.50      203.0.113.1    3     12     64   377   22.1    0.8    1.2
*198.51.100.20   .GPS.          1     14     64   377   18.3    0.4    0.9

Trap 1: That server is the current system clock source

The asterisk marks the selected synchronization source.

Trap 2: NTP authentication has disabled the server permanently

The symbol alone does not mean permanent disablement.

Trap 3: The router is acting as an NTP master for that server

That is not what the association symbol indicates.

A
That server is the current system clock source
Why wrong: The asterisk marks the selected synchronization source.
B
The server is reachable but not the one currently selected for synchronization
It is seen by the router, but it is not the chosen source.
C
NTP authentication has disabled the server permanently
Why wrong: The symbol alone does not mean permanent disablement.
D
The router is acting as an NTP master for that server
Why wrong: That is not what the association symbol indicates.

Question 6easymultiple choice

A user types www.example.com into a browser. Which service is used first to resolve that name into an IP address?

Trap 1: DHCP

DHCP assigns IP settings to a client; it does not resolve names.

Trap 2: NTP

NTP synchronizes time.

Trap 3: Syslog

Syslog is used for logging, not name resolution.

A
DHCP
Why wrong: DHCP assigns IP settings to a client; it does not resolve names.
B
DNS
DNS resolves the hostname to an IP address.
C
NTP
Why wrong: NTP synchronizes time.
D
Syslog
Why wrong: Syslog is used for logging, not name resolution.

Question 7mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the following steps into the correct order to configure NTP with authentication on a Cisco router.

Question 8mediummultiple choice

A network team wants centralized logging and also wants log timestamps from different devices to line up accurately. Which combination best supports that goal?

Trap 1: DHCP and STP

This is wrong because neither DHCP nor STP provides centralized logging with synchronized timestamps.

Trap 2: PAT and EtherChannel

This is wrong because NAT and link bundling do not solve centralized log collection and time correlation.

Trap 3: ARP and CDP

This is wrong because neighbor resolution and discovery do not provide the required logging and timestamp control.

A
Syslog and NTP
This is correct because Syslog centralizes log collection and NTP aligns timestamps across devices.
B
DHCP and STP
Why wrong: This is wrong because neither DHCP nor STP provides centralized logging with synchronized timestamps.
C
PAT and EtherChannel
Why wrong: This is wrong because NAT and link bundling do not solve centralized log collection and time correlation.
D
ARP and CDP
Why wrong: This is wrong because neighbor resolution and discovery do not provide the required logging and timestamp control.

Question 9mediummultiple choice

A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?

Trap 1: DNS

Distractor.

Trap 2: SNMP

Distractor.

Trap 3: CDP

Distractor.

A
DNS
Why wrong: Distractor.
B
NTP
Correct choice.
C
SNMP
Why wrong: Distractor.
D
CDP
Why wrong: Distractor.

Question 10hardmultiple choice

Refer to the exhibit. A network administrator is troubleshooting an NTP synchronization issue on R1. The router is configured with the command ntp server 10.1.1.100, but the clock remains unsynchronized. The administrator issues the show ntp status command. What is the most likely cause of the problem?

Exhibit

R1# show ntp status
Clock is unsynchronized, stratum 16, no reference clock
nominal freq is 250.0000 Hz, actual freq is 250.0000 Hz, precision is 2**18
ntp uptime is 15000 (4.1 hours)
reference time is 00000000.00000000 (00:00:00.000 UTC Jan 1 1900)
clock offset is 0.0000 msec, root delay is 0.00 msec
root dispersion is 0.00 msec, peer dispersion is 0.00 msec
loopfilter state is 'CTRL' (Normal Controlled Loop), drift is 0.000000000 s/s
system poll interval is 64, last update was 0 sec ago.

Trap 1: The NTP authentication key configured on R1 does not match the one…

While an authentication mismatch would prevent synchronization, the router would still receive NTP packets from the server, and show ntp associations would likely show the server as reachable but with a status of 'reject' or 'bad auth.' The exhibit shows no reference clock at all, indicating no NTP packets are arriving.

Trap 2: The system time on R1 is set to an epoch that is too far from the…

NTP can handle any time difference, although a very large offset (e.g., >1000 seconds by default) might trigger a panic and require manual stepping. However, in that case, the server would still be reachable and the output might show the server as a candidate but with a large offset; it would not result in 'no reference clock' and a persistent unsynchronized state without any peer communication.

Trap 3: The NTP service is not enabled on R1; the 'ntp server' command only…

The 'ntp server' command indeed enables the NTP service and starts the daemon. If NTP were not enabled, the 'show ntp status' command would return an error or indicate that NTP is not running, rather than showing detailed status fields. The output confirms NTP is running but unsynchronized.

A
The NTP authentication key configured on R1 does not match the one on the server.
Why wrong: While an authentication mismatch would prevent synchronization, the router would still receive NTP packets from the server, and show ntp associations would likely show the server as reachable but with a status of 'reject' or 'bad auth.' The exhibit shows no reference clock at all, indicating no NTP packets are arriving.
B
The system time on R1 is set to an epoch that is too far from the server's time, causing NTP to refuse to synchronize.
Why wrong: NTP can handle any time difference, although a very large offset (e.g., >1000 seconds by default) might trigger a panic and require manual stepping. However, in that case, the server would still be reachable and the output might show the server as a candidate but with a large offset; it would not result in 'no reference clock' and a persistent unsynchronized state without any peer communication.
C
The NTP service is not enabled on R1; the 'ntp server' command only defines a server but does not start the NTP process.
Why wrong: The 'ntp server' command indeed enables the NTP service and starts the daemon. If NTP were not enabled, the 'show ntp status' command would return an error or indicate that NTP is not running, rather than showing detailed status fields. The output confirms NTP is running but unsynchronized.
D
The router cannot reach the NTP server 10.1.1.100 at UDP port 123 due to a routing issue or an access list.
The exhibit clearly shows 'no reference clock' and stratum 16, which indicates that R1 has not received any NTP packets from the configured server. This is a classic symptom of network unreachability—the router’s NTP requests are not making it to the server or responses are not coming back, often caused by a missing route or an ACL filtering UDP 123.

Read the full network assurance explanation →

Question 11mediummulti select

Which two statements accurately describe Syslog in a Cisco network environment?

Trap 1: Syslog is primarily used to assign IP addresses to hosts.

This is wrong because DHCP, not Syslog, assigns addressing information to clients.

Trap 2: Syslog automatically prevents switching loops.

This is wrong because loop prevention is handled by STP, not Syslog.

Trap 3: Syslog replaces the need for any monitoring system.

This is wrong because Syslog is useful, but it does not eliminate the value of broader monitoring tools.

A
Syslog can send device event messages to a centralized logging server.
This is correct because centralized message collection is one of Syslog’s main purposes.
B
Syslog is primarily used to assign IP addresses to hosts.
Why wrong: This is wrong because DHCP, not Syslog, assigns addressing information to clients.
C
Syslog messages become easier to correlate when device clocks are synchronized.
This is correct because consistent timestamps improve the value of centralized logs.
D
Syslog automatically prevents switching loops.
Why wrong: This is wrong because loop prevention is handled by STP, not Syslog.
E
Syslog replaces the need for any monitoring system.
Why wrong: This is wrong because Syslog is useful, but it does not eliminate the value of broader monitoring tools.