When configuring a Kerberos SSO object, what is the primary requirement for the Service Principal Name (SPN)?

Question

Options

• AThe SPN must be globally unique across all domains.
• BThe SPN must be registered in Active Directory's Service Principal Name list.
• CThe SPN must contain the IP address of the Kerberos Key Distribution Center (KDC).
• DThe SPN must include the user's password for secure authentication.

• A
  5% (2)
• B
  90% (37)
• C
  2% (1)
• D
  2% (1)

Explanation

Option B is correct because the SPN must be registered in Active Directory so that the Kerberos Key Distribution Center (KDC) can locate the service and issue the appropriate service ticket - without this registration, clients cannot authenticate to the service via Kerberos. Option A is wrong because SPNs must be unique within a domain/forest, not globally across all domains worldwide. Option C is wrong because SPNs identify services (e.g., HTTP/server.domain.com), not network locations like IP addresses - the KDC address is configured separately. Option D is wrong because Kerberos is specifically designed to avoid transmitting passwords; it uses encrypted tickets instead, so an SPN never contains a password.

Memory tip: Think of an SPN as a service's "name tag" pinned to the AD bulletin board - if it's not posted there, Kerberos can't find the service to hand out tickets for it.

No community discussion yet for this question.