Which of the following statements about ipa-getkeytab is correct?

Question

Options

• AThe command does not delete the old keytab if it exists.
• BExported Kerberos keytabs can not be used for NFSv4.
• CThe lifetime of the new Kerberos Ticket is twelve hours.
• Dipa-get keytab does not support subcommands.
• EGenerating a new Kerberos ticket revokes all existing tickets.

• A
  94% (29)
• C
  3% (1)
• E
  3% (1)

Explanation

ipa-getkeytab appends new keytab entries to an existing keytab file rather than overwriting or deleting it, which is why A is correct - this "additive" behavior is intentional so administrators don't accidentally lose credentials for services still using older key versions.

B is wrong because Kerberos keytabs are precisely how NFSv4 achieves secure authentication via its sec=krb5 (and krb5i, krb5p) mount options - keytab support for NFSv4 is a core FreeIPA use case.

C is wrong because ipa-getkeytab retrieves keytabs (long-term credential stores), not Kerberos tickets, and ticket lifetimes are set by KDC policy - the "twelve hours" figure is fabricated.

D is wrong because ipa-getkeytab does support multiple options (-s, -p, -k, -P, etc.); the distractor conflates "options/flags" with "subcommands" to create confusion.

E is wrong because generating a new keytab rotates the key for that specific principal, potentially invalidating existing service tickets for that principal - it does not revoke all tickets system-wide.

Memory tip: Think of ipa-getkeytab as a filing cabinet - it adds new folders (key entries) without shredding the old ones. "get" = get and keep, not get and replace.

No community discussion yet for this question.