N10-009 Question 67
Single answerNTP: 123A network administrator notices that domain member workstations at a branch office are showing certificate warnings and inconsistent log timestamps after a firewall replacement. The branch uses an internal time server at 10.20.30.15, and clients are configured to synchronize time with it. Other application traffic is working normally. The administrator suspects the new firewall is blocking the required time-synchronization traffic. Which firewall rule should be added to restore time synchronization with the least privilege?
- A
Allow UDP 123 from branch clients to 10.20.30.15
- B
Allow TCP 123 from branch clients to 10.20.30.15
- C
Allow UDP 53 from branch clients to 10.20.30.15
- D
Allow TCP 443 from branch clients to 10.20.30.15
Show answer and explanation
Correct answer: A
Explanation
This scenario tests practical recognition of NTP traffic requirements and the operational impact of time drift. NTP is used to synchronize clocks across networked devices and standardly operates over UDP port 123. When time synchronization fails, organizations commonly see certificate validation problems, Kerberos or authentication issues, and mismatched log timestamps. The least-privilege approach is to allow only the required protocol and port between the necessary hosts, in this case, UDP 123 from branch clients to the internal NTP server at 10.20.30.15. This aligns with standard NTP behavior documented in vendor and protocol references, including RFC 5905 for NTPv4 and common firewall best practices of permitting only required ports, protocols, and destinations.
- A. Correct.
Correct. Network Time Protocol (NTP) uses UDP port 123 for time synchronization. If clients are configured to sync with the internal time server at 10.20.30.15, permitting UDP 123 from the clients to that server is the appropriate least-privilege rule. This directly addresses the symptoms of time drift, certificate validation issues, and inaccurate event timestamps.
- B. Incorrect.
Incorrect. A common misconception is that all client-server applications use TCP. Standard NTP uses UDP port 123, not TCP 123, for normal time synchronization. Allowing TCP 123 would not restore standard NTP communication in this scenario.
- C. Incorrect.
Incorrect. UDP 53 is used for DNS queries, not time synchronization. Someone might choose this because name resolution problems can also affect connectivity, but the scenario states that other traffic is working and specifically points to clock-related issues tied to synchronization with a known internal time server.
- D. Incorrect.
Incorrect. TCP 443 is used for HTTPS, not NTP. This distractor is plausible because certificate warnings are mentioned, but those warnings are a result of incorrect system time rather than a need for encrypted web traffic to the time server.