N10-009 Question 66
Single answerNTP: 123A systems administrator notices that Kerberos authentication is intermittently failing for remote users after several branch office firewall upgrades. Investigation shows the client PCs can reach internal application servers, but their clocks are drifting and are no longer synchronizing with the company time source. The time source is an internal NTP server at 10.20.30.15, and branch firewalls currently allow outbound DNS (53), HTTPS (443), and SMTP (25) only. Which firewall change is MOST likely to resolve the time synchronization issue while following standard protocol usage?
- A
Allow UDP 123 from branch clients to 10.20.30.15
- B
Allow TCP 123 from branch clients to 10.20.30.15
- C
Allow UDP 161 from branch clients to 10.20.30.15
- D
Allow TCP 443 from 10.20.30.15 to branch clients
Show answer and explanation
Correct answer: A
Explanation
The most likely fix is to allow UDP port 123 from the branch clients to the internal NTP server. Network Time Protocol (NTP) is the standard protocol for clock synchronization and uses UDP 123. In real environments, inaccurate system time can cause authentication failures, especially with Kerberos, which relies on time skew remaining within a limited tolerance. This makes NTP reachability a practical troubleshooting step when authentication begins failing after firewall changes. Standard vendor and protocol documentation consistently identifies NTP as using UDP 123, while nearby ports and protocols such as SNMP (UDP 161) or HTTPS (TCP 443) serve different purposes and would not restore time synchronization.
- A. Correct.
Correct. NTP typically uses UDP port 123 for time synchronization between clients and servers. If branch clients cannot reach the internal NTP server on UDP 123, their clocks may drift, which can lead to authentication issues such as Kerberos failures because Kerberos depends on reasonably synchronized time between systems.
- B. Incorrect.
Incorrect. Port 123 is associated with NTP, but standard NTP communication uses UDP, not TCP, for normal client-server time synchronization. Choosing TCP 123 reflects a common misconception of matching the right port number but the wrong transport protocol.
- C. Incorrect.
Incorrect. UDP 161 is used by SNMP for management polling, not NTP. This distractor is plausible because both are infrastructure-related UDP services, but opening SNMP would not allow clients to synchronize time.
- D. Incorrect.
Incorrect. TCP 443 is HTTPS and is already allowed outbound according to the scenario. NTP does not use HTTPS for standard time synchronization, and allowing inbound TCP 443 from the NTP server to clients would not address the actual protocol requirement.