It is recommended to use Apache Tomcat version shipped as part of a NCM release & not upgrade the same manually, as the NCM application functionality is validated & supported with the shipped tomcat version.
NCM Application / its services makes use of Tomcat at multiple paths:
1) ncm-as service uses Tomcat from $VOYENCE_HOME/ncmcore
2) ncm-msa service uses Tomcat from $VOYENCE_HOME/ncmmsa
3) DDT (Device Drivers Toolkit), sysadmin console (if installed) & Report Advisor (if installed) make use of Tomcat from $TOMCAT_HOME (default - /usr/tomcat/apache-tomcat-x.x.x)