Eccouncil Exam 312-50 Topic 11 Question 104 Discussion

Actual exam question for Eccouncil's 312-50 exam

Question #: 104
Topic #: 11

Being a Certified Ethical Hacker (CEH), a company has brought you on board to evaluate the safety measures in place for their network system. The company uses a network time protocol server in the demilitarized zone.

During your enumeration, you decide to run a ntptrace command. Given the syntax: ntptrace [-n] [-m maxhosts] [servername/IP_address], which command usage would best serve your objective to find where the NTP server obtains the time from and to trace the list of NTP servers connected to the network?

Antptrace -m 5 192.168.1.1

Btptrace 192.1681.

Cntptrace -n localhost

Dntptrace -n -m 5 192.168.1.1
Explanation:
The command usage that would best serve your objective to find where the NTP server obtains the time from and to trace the list of NTP servers connected to the network is ntptrace -n -m 5 192.168.1.1. This command usage works as follows:
ntptrace is a tool that determines where a given NTP server gets its time from, and follows the chain of NTP servers back to their master time source.For example, a stratum 0 server, which is a device that directly obtains the time from a physical source, such as an atomic clock or a GPS receiver1.
-n is a flag that outputs host IP addresses instead of host names.This can be useful if the host names are not resolvable or if the IP addresses are more informative1.
-m 5 is a flag that specifies the maximum number of hosts to be traced.This can be useful to limit the output and avoid tracing irrelevant or unreachable hosts1.
192.168.1.1 is the IP address of the NTP server in the demilitarized zone, which is the starting point of the trace.This can be useful to find out the source and the path of the time synchronization for the network system1.
By using this command usage, the output will show the IP addresses, the stratum, the offset, the sync distance, and the reference ID of each NTP server in the chain, up to five hosts.This can provide valuable information about the accuracy, the reliability, and the security of the time service for the network system1.
The other options are not as suitable as option D for the following reasons:
A . ntptrace -m 5 192.168.1.1: This option is similar to option D, but it does not use the -n flag, which means that it will output host names instead of IP addresses.This can be less useful if the host names are not resolvable or if the IP addresses are more informative1.
B . tptrace 192.1681.: This option is incorrect because it uses a wrong tool name and a wrong IP address. tptrace is not a valid tool name, and 192.1681. is not a valid IP address.The correct tool name is ntptrace, and the correct IP address is 192.168.1.11.
C . ntptrace -n localhost: This option is not effective because it uses localhost as the starting point of the trace, which means that it will only show the local host's time source.This can be useful to check the local host's time configuration, but it does not help to find out the time source and the trace of the NTP server in the demilitarized zone, which is the objective of this scenario1.

Show Suggested Answer

Suggested Answer: D

1: ntptrace - trace a chain of NTP servers back to the primary source

by Lenny at Mar 22, 2025, 07:36 AM

Limited Time Offer

25%

27 days ago

Hmm, D seems like the way to go. The -n and -m flags should give me the IP addresses and limit the trace, just what I need to find the NTP server's time source.

upvoted 0 times