LPIC-1 NTP firewall rules Practice Question
A company manages a cluster of 50 web servers running Ubuntu 20.04. The servers are configured to synchronize time with an internal NTP server at 10.0.0.100 using the default ntpd. The NTP server itself syncs with external stratum 2 servers. Recently, the security team implemented a restrictive iptables firewall on all servers, allowing only essential services. Several servers in the 10.0.1.0/24 network now report time drift and ntpq -p shows all peers with '?' status. A network engineer runs tcpdump on one affected server and sees no NTP replies from 10.0.0.100. The NTP server's firewall is configured to allow inbound NTP from 10.0.0.0/24 only. The engineer also notes that the server's /etc/ntp.conf contains the line 'restrict 10.0.0.100' (which is incorrect) and that ntpq -crv shows 'sync target not reachable'. Which single action will most directly resolve the synchronization issue for the affected servers?
⚠ Common exam trap
Candidates often focus on the client's firewall or the incorrect restrict line, but the most direct cause is the NTP server's firewall misconfiguration. Even if the client allows outbound traffic, the server drops requests from the wrong subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the NTP server's firewall to allow inbound NTP from 10.0.1.0/24.
The affected servers are in the 10.0.1.0/24 network, but the NTP server's firewall only allows inbound NTP from 10.0.0.0/24. Even if the client's firewall permits outbound UDP to port 123, the server will drop the requests because they originate from an unauthorized subnet. Therefore, modifying the NTP server's firewall to accept NTP traffic from 10.0.1.0/24 directly resolves the synchronization issue. Option A (client firewall fix) is necessary but not sufficient because the server will still block the requests. Option B fixes the incorrect restrict line but does not address the firewall. Option D is irrelevant as routing is not the problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add an iptables rule on the affected server to accept outbound UDP packets to 10.0.0.100 port 123.
Why it's wrong here
This addresses the client's outbound firewall, but the NTP server's firewall will still drop requests from the 10.0.1.0/24 subnet. Thus, it is not sufficient alone.
- ✗
Remove the line 'restrict 10.0.0.100' from /etc/ntp.conf.
Why it's wrong here
Removing the incorrect restrict line is a secondary fix. However, even with correct client firewall and restrict line, the server firewall still blocks requests from the wrong subnet.
- ✓
Modify the NTP server's firewall to allow inbound NTP from 10.0.1.0/24.
Why this is correct
Correct. The NTP server's firewall only permits inbound NTP from 10.0.0.0/24. Since the affected servers are in 10.0.1.0/24, adding a rule to allow their subnet directly resolves the issue.
- ✗
Add a static route on the affected server for 10.0.0.100 via a different gateway.
Why it's wrong here
Adding a static route is unnecessary because routing is not the problem; the packets reach the server but are dropped by its firewall.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 527 original LPIC-1 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.