CV0-002 · Question #466
All the virtual server instances within an organization's private cloud environment are having trouble logging into the Kerberos realm. Upon investigation, the CSA notices the time stamps are differen
The correct answer is C. Check the NTP server synchronization.. When virtual servers experience Kerberos login issues due to differing timestamps, the immediate next step is to verify the NTP server synchronization for all affected instances.
Question
All the virtual server instances within an organization's private cloud environment are having trouble logging into the Kerberos realm. Upon investigation, the CSA notices the time stamps are different on the server virtual instances. Which of the following should be the CSA's NEXT step to resolve this issue?
Options
- ACheck the Kerberos token time stamp.
- BCheck the NTP server to see when it last rebooted.
- CCheck the NTP server synchronization.
- DCheck the virtual server time display format.
How the community answered
(29 responses)- A7% (2)
- B14% (4)
- C76% (22)
- D3% (1)
Why each option
When virtual servers experience Kerberos login issues due to differing timestamps, the immediate next step is to verify the NTP server synchronization for all affected instances.
Checking the Kerberos token timestamp might confirm the time difference is an issue, but it does not solve the underlying problem of unsynchronized clocks.
Checking when the NTP server last rebooted does not directly address whether the client virtual servers are correctly synchronizing their time with it.
Kerberos authentication is highly sensitive to time synchronization between clients, servers, and the Key Distribution Center (KDC). If the timestamps on the virtual server instances are different, it indicates a time skew which causes tickets to be rejected and results in login failures. The next logical step is to check the NTP (Network Time Protocol) server synchronization for all involved virtual servers to ensure they are all set to use and are correctly syncing with a reliable time source.
The time display format (e.g., 12-hour vs. 24-hour) does not affect the underlying timestamp value or synchronization, which is critical for Kerberos.
Concept tested: Kerberos time synchronization troubleshooting
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/kerberos-authentication-problems-time-skew
Topics
Community Discussion
No community discussion yet for this question.