SY0-301 · Question #561
LDAP and Kerberos are commonly used for which of the following?
The correct answer is D. To utilize single sign-on capabilities. LDAP and Kerberos work together to enable single sign-on by providing directory lookups and ticket-based authentication respectively. While LDAP alone can query directories, the combination of both protocols is associated with SSO implementations.
Question
LDAP and Kerberos are commonly used for which of the following?
Options
- ATo perform queries on a directory service
- BTo store usernames and passwords for Federated Identity
- CTo sign SSL wildcard certificates for subdomains
- DTo utilize single sign-on capabilities
How the community answered
(26 responses)- B8% (2)
- C4% (1)
- D88% (23)
Why each option
LDAP and Kerberos work together to enable single sign-on by providing directory lookups and ticket-based authentication respectively. While LDAP alone can query directories, the combination of both protocols is associated with SSO implementations.
LDAP alone performs directory queries, but Kerberos is an authentication protocol - not a query tool - so 'A' does not accurately describe both protocols together.
Neither LDAP nor Kerberos is specifically designed to store credentials for federated identity, which is typically handled by SAML or OAuth/OIDC protocols.
SSL wildcard certificate signing is performed by Certificate Authorities using PKI, not by LDAP or Kerberos.
LDAP provides the directory service backend for user lookups while Kerberos provides the ticket-granting authentication mechanism. Together they form the foundation of SSO systems such as Active Directory, where Kerberos issues authentication tickets and LDAP resolves user attributes. This pairing allows users to authenticate once and gain access to multiple resources without re-entering credentials.
Concept tested: LDAP and Kerberos single sign-on integration
Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Topics
Community Discussion
No community discussion yet for this question.