312-50V11 · Question #719
Log monitoring tools performing behavioral analysis have alerted several suspicious logins on a Linux server occuring during non-business hours. After further examination of all login activities, it i
The correct answer is A. NTP. NTP (Network Time Protocol) is the standard protocol on Linux systems responsible for synchronizing system clocks with authoritative time sources. A stopped or misconfigured NTP service can cause the system clock to drift significantly.
Question
Log monitoring tools performing behavioral analysis have alerted several suspicious logins on a Linux server occuring during non-business hours. After further examination of all login activities, it is notices that none of the logins have occurred during typical work hours. A Linux administrator who is investigating this problem realized the system time on the Linux server is wrong by more than twelve hours. What protocol used on Linux serves to synchronize the time has stopped working?
Options
- ANTP
- BTimeKeeper
- COSPF
- DPPP
How the community answered
(23 responses)- A87% (20)
- B4% (1)
- C9% (2)
Why each option
NTP (Network Time Protocol) is the standard protocol on Linux systems responsible for synchronizing system clocks with authoritative time sources. A stopped or misconfigured NTP service can cause the system clock to drift significantly.
NTP (Network Time Protocol) is the protocol used on Linux systems to synchronize the local system clock with remote time servers. When the NTP daemon (ntpd or chronyd) stops working, the system clock drifts freely, which can cause time-sensitive log analysis tools to flag legitimate logins as suspicious due to incorrect timestamps. A drift of over 12 hours is consistent with a failed NTP sync over an extended period.
TimeKeeper is not a real or standardized Linux time synchronization protocol - it does not exist as a recognized networking or system service.
OSPF (Open Shortest Path First) is a link-state routing protocol used for IP routing, not for time synchronization.
PPP (Point-to-Point Protocol) is a data link layer protocol used for direct connections between two network nodes, not for time synchronization.
Concept tested: NTP time synchronization on Linux systems
Source: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite
Topics
Community Discussion
No community discussion yet for this question.