Why is it important to have at least a level 2 NTP server running in your environment?

Question

Options

• AIn order to provide News Transfer Protocol services
• BSo that all logging devices maintain a consistent time
• CYou require a level 1 NTP server, not level 2
• DYou require a level 2 NNTP server, not NTP server

• A
  13% (6)
• B
  78% (35)
• C
  2% (1)
• D
  7% (3)

Explanation

Option B is correct because NTP (Network Time Protocol) ensures all devices on a network share a synchronized clock. Consistent timestamps are critical for log correlation during security incident analysis - if devices have drifted clocks, tracing an attack across multiple log sources becomes unreliable or impossible. A Stratum 2 NTP server syncs from a Stratum 1 (atomic clock-based) source and then serves time locally, providing reliable synchronization without requiring every device to reach an external Stratum 1 server directly.

Why the distractors are wrong:

• A is a made-up definition - NTP stands for Network Time Protocol, not "News Transfer Protocol." (NNTP is the News protocol.)
• C is incorrect because Stratum 1 servers typically sync directly from hardware clocks (GPS, atomic) and are not commonly deployed inside enterprise environments - Stratum 2 is the practical standard for internal use.
• D inverts two concepts: NNTP (Usenet newsgroups) and NTP are completely unrelated protocols. The question is specifically about time synchronization.

Memory tip: Think of NTP Stratum levels like a relay race - Stratum 1 gets time from atomic clocks, Stratum 2 receives from Stratum 1 and serves your network. For logging integrity, remember: "Same time = same story."

No community discussion yet for this question.