Version 4.1 - 3.8 NTP
NTP is rather simple and the questions on it are rather common. The Network Time Protocol is a "networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks." Well, that's what it was invented for, but today it's used not only on unreliable and untrusted networks, but also between devices on a reliable LAN. Cisco's doc on Configuring NTP (in this link on a N7K) shows all of the nitty gritty details.
If you've administered an Active Directory network, you know that time synchronization is important. The "correct" time is not as important as the "same" time. The interoperating devices need to all agree on the time. Normally all your windows desktops and servers synchronize their time with the Domain Controllers. "The W32Time service was originally implemented for the purpose of the Kerberos version 5 authentication protocol, which required time to be within 5 minutes of the correct value to prevent replay attacks." Network devices synchronize their time with routers and usually a specific device in the network serves as the GPS NTP Server.
One thing I have never understood is why these things don't have an LED display on them. It just seems a little odd that you would be standing next to the most accurate clock in the Data Center and have to be a machine connected on the network to know what time it is.
You should understand the clock strata, but not memorize anything specific. I've never seen a question on anything that specific and I've been tested on ntp for decades by Microsoft, Cisco and multiple other vendors. Any question I have ever seen on ntp from Cisco always shows you the output of "show ntp association" or "show ntp status" and wants you to answer questions based on the output.
You can find example output of both of these commands on Cisco's NTP Troubleshooting page. The output for the question I expect to see will probably look like this:
USSP-B33S-SW01#sho ntp status
Clock is synchronized, stratum 2, reference is 10.4.2.254
nominal freq is 250.0000 Hz, actual freq is 250.5630 Hz, precision is 2**18
reference time is D36968F7.7E3019A9 (02:12:07.492 UTC Fri May 25 2012)
clock offset is 417.2868 msec, root delay is 2.85 msec
root dispersion is 673.42 msec, peer dispersion is 261.80 msec
Not exactly like that, but something similar. They will ask stuff like which device is the master, which stratum is device X, and are the clocks synchronized? You will want to know about the sanity tests for ntp. And with this being the security exam, you will definitely want to know about ntp association authentication.
The Cisco Best Practices for NTP White Paper.