210-250 · Question #113
How does NTP help with security monitoring?
The correct answer is A. It synchronizes the time of day so that you can correlate events when you receive system logs. NTP synchronizes clocks across network devices so that log events from multiple systems can be accurately correlated during security investigations.
Question
How does NTP help with security monitoring?
Options
- AIt synchronizes the time of day so that you can correlate events when you receive system logs.
- BIt enables you to look up the IP addresses a browser navigated to using the FQON.
- CIt allows you receive system-generated email traffic from log servers.
- DIt uses TCP, which allows you to see the HTTP conversations between servers and clients.
How the community answered
(31 responses)- A94% (29)
- B3% (1)
- D3% (1)
Why each option
NTP synchronizes clocks across network devices so that log events from multiple systems can be accurately correlated during security investigations.
NTP ensures all network devices report a consistent, accurate timestamp, which is critical for constructing attack timelines by correlating log entries from firewalls, IDS sensors, and servers. Without synchronized clocks, log entries from different devices cannot be reliably sequenced. NTP is therefore a foundational dependency for SIEM and log correlation platforms.
Resolving IP addresses from fully qualified domain names is a function of DNS, not NTP.
Delivering system-generated email from log servers is handled by SMTP or alerting integrations in logging tools, not NTP.
NTP operates over UDP port 123 and has no role in TCP session inspection or viewing HTTP conversations between clients and servers.
Concept tested: NTP role in security log event correlation
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-12/configuration_guide/sys-mgmt/b_1612_sys_mgmt_9300_cg/configuring_ntp.html
Topics
Community Discussion
No community discussion yet for this question.