When using Kerberos as the authentication method for Pathfinder, which two settings must be validated on the DNS server? (Choose two.)

Question

Options

• ADNS forwarders
• BReverse DNS zone
• CReverse DNS records
• DAD DS-integrated zones

• A
  12% (3)
• B
  85% (22)
• D
  4% (1)

Explanation

Kerberos authentication requires mutual hostname verification, which depends on reverse DNS lookups. The Reverse DNS zone (B) must exist on the DNS server so the zone can host PTR records, and the Reverse DNS records (C) must be present within that zone so that IP addresses resolve back to their correct hostnames - without both, Kerberos ticket validation fails because it cannot confirm the identity of the service or client by IP-to-hostname mapping.

DNS forwarders (A) are incorrect because forwarders only direct unresolved queries to upstream servers for external name resolution - they play no direct role in Kerberos authentication within the local domain. AD DS-integrated zones (D) are a replication and security best practice for Active Directory environments but are not a Kerberos-specific requirement; standard primary zones work fine as long as the reverse zone and records are properly configured.

Memory tip: Think "Kerberos checks both directions." Forward DNS maps names → IPs, but Kerberos specifically needs reverse DNS (the zone to host it + the records inside it) to verify IPs → names, preventing impersonation. If either the container (zone) or the entries (records) are missing, Kerberos breaks.

No community discussion yet for this question.