CV0-003 Question #30: Real Exam Question with Answer & Explanation

Question

Options

• ADirectory services requires the use of NTP servers.
• BThe VMs are insufficiently licensed.
• CThere is a directory services outage.
• DThere is a time synchronization issue.

Explanation

Kerberos authentication, used by Active Directory for network logins, requires clock skew between client and domain controller to be within 5 minutes. Without NTP configured on the new VMs, time drift causes Kerberos to reject authentication tickets while local accounts remain unaffected.

Common mistakes.

• A. This restates a dependency rather than identifying a cause - it describes what directory services needs rather than naming the resulting failure condition of time being out of sync.
• B. Licensing issues would not selectively block network credential authentication while allowing local account logins to succeed simultaneously.
• C. A directory services outage would prevent all domain authentication from reaching controllers, but the specific clue of missing NTP servers points to a time synchronization failure rather than a service-level outage.

Concept tested. Kerberos clock skew requirement for Active Directory authentication

Reference. https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/kerberos-authentication-problems-if-not-synchronized

No community discussion yet for this question.