nerdexam
CompTIA

CV0-003 · Question #466

All the virtual server instances within an organization's private cloud environment are having trouble logging into the Kerberos realm. Upon investigation, the CSA notices the time stamps are…

The correct answer is C. Check the NTP server synchronization. Kerberos authentication depends on synchronized clocks across all systems; when timestamps diverge beyond the default 5-minute tolerance, tickets are rejected, making NTP synchronization the root cause to verify.

Troubleshooting

Question

All the virtual server instances within an organization's private cloud environment are having trouble logging into the Kerberos realm. Upon investigation, the CSA notices the time stamps are different on the server virtual instances. Which of the following should be the CSA's NEXT step to resolve this issue?

Options

  • ACheck the Kerberos token time stamp.
  • BCheck the NTP server to see when it last rebooted.
  • CCheck the NTP server synchronization.
  • DCheck the virtual server time display format.

How the community answered

(17 responses)
  • A
    6% (1)
  • B
    6% (1)
  • C
    76% (13)
  • D
    12% (2)

Why each option

Kerberos authentication depends on synchronized clocks across all systems; when timestamps diverge beyond the default 5-minute tolerance, tickets are rejected, making NTP synchronization the root cause to verify.

ACheck the Kerberos token time stamp.

Checking Kerberos token timestamps only re-confirms the symptom of time mismatch that has already been identified, rather than investigating the underlying cause.

BCheck the NTP server to see when it last rebooted.

Knowing when the NTP server last rebooted provides historical context but does not reveal whether time synchronization is currently functioning correctly across clients.

CCheck the NTP server synchronization.Correct

Kerberos embeds timestamps in its ticket-granting mechanism to prevent replay attacks, requiring all participating systems to be within approximately 5 minutes of each other. Since the CSA has already identified that virtual server timestamps differ, checking NTP server synchronization is the logical next step to determine why time distribution is failing and to resolve the authentication failures across the environment.

DCheck the virtual server time display format.

The time display format is a cosmetic setting and does not affect Kerberos authentication, which depends on actual epoch time values, not their presentation format.

Concept tested: Kerberos authentication dependency on NTP time synchronization

Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview

Topics

#Kerberos authentication#NTP synchronization#time sync#identity services

Community Discussion

No community discussion yet for this question.

Full CV0-003 Practice