NTP Security Features: Authentication and Access Lists

350-401 By islever Editorial Last updated

Configure and verify infrastructure security features

Short answer

BE NTP security relies on symmetric key authentication and access list-based restrictions to control time source trust and network access.

Question

Which two security features are available when implementing NTP? (Choose two.)
  1. encrypted authentication mechanism
  2. symmetric server passwords Correct Answer
  3. clock offset authentication
  4. broadcast association mode
  5. access list-based restriction scheme Correct Answer

Key Takeaways

The exam tests the ability to distinguish between actual NTP security controls (authentication, ACLs) and synchronization modes or non-existent features.

This question examines NTP security mechanisms, specifically authentication and access control. The correct features are symmetric key authentication and access list-based restriction.

Common mistake: Candidates often select 'encrypted authentication' because they confuse hashing with encryption, or choose 'broadcast mode' as a security feature when it is actually a less secure sync method.

Expert Analysis

Why the Answer Is Correct

NTP provides two primary security mechanisms: authentication and access control. Option B, symmetric server passwords (implemented via MD5 or SHA keys), ensures that the device only synchronizes with trusted time sources. Option E, access list-based restriction scheme, allows administrators to filter NTP traffic based on IP addresses, preventing unauthorized devices from sending time updates.

Why the Other Options Are Wrong

Option A is incorrect because NTP uses cryptographic hashing (MD5/SHA) for authentication, not encryption; the payload is not encrypted. Option C is invalid as there is no such feature called 'clock offset authentication.' Option D describes a synchronization association type, which is generally considered less secure due to lack of inherent authentication, not a security feature itself.

Community Comment Notes

Community consensus strongly supports options B and E. Users noted that while MD5 is a hash function, it serves the purpose of authentication in this context. One commenter clarified that broadcast mode is a sync mode, not a security feature, and another confirmed that access lists are a standard method for restricting NTP peers.

Exam Strategy

When reviewing NTP security, focus on the difference between authentication (verifying identity via keys) and authorization/access control (filtering via ACLs). Remember that NTP does not encrypt data streams by default.

Frequently Asked Questions

Does NTP use encryption for authentication?

No. NTP uses cryptographic hashing algorithms like MD5 or SHA to authenticate messages. It does not encrypt the NTP packet payload.

Is broadcast mode a security feature?

No. Broadcast is an association mode for distributing time. It is often considered less secure because it lacks built-in authentication mechanisms compared to client-server or peer modes.

More 350-401 FAQ →

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. 2847bec 👍 2
    A. encrypted authentication mechanism NTP uses MD5 hashing, NOT encryption. It is authentication, but not encrypted, so this is incorrect. C. clock offset authentication No such feature exists in NTP. D. broadcast association mode This is a synchronization mode, not a security feature. (Also considered less secure because it has no built-in authentication.)
  2. JackDRipper 👍 2
    Granted that answer "a" is a little skewed, all other answers are outright wrong. MD5 is a cryptographic hash function... close enough. The answers provided are correct... A and E.
  3. CCNPWILL 👍 2
    Given answers are 100% correct.
  4. pelat27520 👍 1
    A. You can configure the device to authenticate the time sources to which the local clock is synchronized. When you enable NTP authentication, the device synchronizes to a time source only if the source carries one of the authentication keys specified by the ntp trusted-key command. The device drops any packets that fail the authentication check and prevents them from updating the local clock. NTP authentication is disabled by default. E. You can control access to NTP services by using access groups. Specifically, you can specify the types of requests that the device allows and the servers from which it accepts responses. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5500/sw/system_management/7x/b_5500_System_Mgmt_Config_7x/configuring_ntp.pdf

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide