CV0-003 Question #466: Real Exam Question with Answer & Explanation

The correct answer is C: Check the NTP server synchronization.. Kerberos authentication depends on synchronized clocks across all systems; when timestamps diverge beyond the default 5-minute tolerance, tickets are rejected, making NTP synchronization the root cause to verify.

Troubleshooting

Question

All the virtual server instances within an organization's private cloud environment are having trouble logging into the Kerberos realm. Upon investigation, the CSA notices the time stamps are different on the server virtual instances. Which of the following should be the CSA's NEXT step to resolve this issue?

Options

ACheck the Kerberos token time stamp.
BCheck the NTP server to see when it last rebooted.
CCheck the NTP server synchronization.
DCheck the virtual server time display format.

Explanation

Kerberos authentication depends on synchronized clocks across all systems; when timestamps diverge beyond the default 5-minute tolerance, tickets are rejected, making NTP synchronization the root cause to verify.

Common mistakes.

A. Checking Kerberos token timestamps only re-confirms the symptom of time mismatch that has already been identified, rather than investigating the underlying cause.
B. Knowing when the NTP server last rebooted provides historical context but does not reveal whether time synchronization is currently functioning correctly across clients.
D. The time display format is a cosmetic setting and does not affect Kerberos authentication, which depends on actual epoch time values, not their presentation format.

Concept tested. Kerberos authentication dependency on NTP time synchronization

Reference. https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview

Topics

#Kerberos authentication#NTP synchronization#time sync#identity services

Community Discussion

No community discussion yet for this question.

Full CV0-003 Practice