N10-005 · Question #587
Which of the following MUST be kept synchronized in order for Kerberos to work?
The correct answer is C. Time. Kerberos authentication requires all participating systems to have synchronized clocks because timestamps are embedded in tickets to prevent replay attacks.
Question
Which of the following MUST be kept synchronized in order for Kerberos to work?
Options
- ACertificate
- BTicket
- CTime
- DToken
How the community answered
(40 responses)- A3% (1)
- B5% (2)
- C93% (37)
Why each option
Kerberos authentication requires all participating systems to have synchronized clocks because timestamps are embedded in tickets to prevent replay attacks.
Certificates are used in PKI-based authentication systems, not Kerberos, which relies on shared secret keys and tickets.
Tickets are issued dynamically by the Key Distribution Center and are not synchronized between nodes - they are requested and consumed per session.
Kerberos tickets contain timestamps and are only valid within a configurable time window, typically 5 minutes. If clocks drift beyond this threshold, the KDC will reject authentication requests, treating them as potential replay attacks. Time synchronization via NTP is therefore a mandatory operational requirement for any Kerberos deployment.
Tokens are associated with token-based authentication systems such as TOTP or hardware tokens, not Kerberos.
Concept tested: Kerberos time synchronization requirement
Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Topics
Community Discussion
No community discussion yet for this question.