350-501 Security and Services Practice Question
An SP engineer is configuring NTP authentication on IOS XR routers in the management plane. Which TWO statements about NTP authentication are correct? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NTP authentication uses pre-shared keys to authenticate time sources
NTP authentication uses a symmetric key (MD5 or SHA) to authenticate NTP packets. The key must be trusted on the client. NTP authentication does not encrypt packets; it only provides integrity. Multiple keys can be configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NTP authentication is only supported on IOS XR, not on classic IOS
Why it's wrong here
NTP authentication is supported on multiple platforms.
- ✓
NTP authentication uses pre-shared keys to authenticate time sources
Why this is correct
A key is configured and used to authenticate NTP packets.
- ✗
Only one NTP authentication key can be configured on a router
Why it's wrong here
Multiple keys can be configured.
- ✗
NTP authentication encrypts the NTP packets to ensure confidentiality
Why it's wrong here
NTP authentication does not encrypt; it only provides authentication.
- ✓
The NTP client must have the key configured and marked as trusted
Why this is correct
The client needs the same key and must trust it.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-501 question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-501 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-501 exam.