hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Is troubleshooting an authentication failure for…
A security engineer is troubleshooting an authentication failure for a Windows domain user. The user receives 'Access denied' when trying to access a file server. The Kerberos ticket-granting ticket was successfully obtained. What is the most likely issue?
⚠ Common exam trap
Many exam-takers confuse authentication (Kerberos TGT success) with authorization (resource permissions), assuming a successful TGT implies full access, when in fact Kerberos only proves identity and does not grant resource-level rights.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user does not have permission to the file server resource
Since the Kerberos ticket-granting ticket (TGT) was successfully obtained, the user has authenticated to the domain and the Kerberos authentication process is functioning correctly. The 'Access denied' error at the file server indicates that the user lacks the necessary permissions on the specific resource (share or NTFS), which is a separate authorization step after successful authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file server is not trusted for delegation
Why it's wrong here
Delegation in Kerberos is a specific capability where a service (e.g., a web server) needs to impersonate a client to access resources on *another* server (e.g., a database server) on behalf of that client. This "double-hop" scenario requires the intermediate service account to be trusted for delegation. For a direct user access attempt to a file server, delegation settings are irrelevant to the initial authentication or authorization process.
- ✓
The user does not have permission to the file server resource
Why this is correct
This scenario describes an authorization failure, not a Kerberos authentication failure. The user successfully obtained a Service Ticket from the Key Distribution Center (KDC) for the file server, indicating successful authentication. However, when the user presented this valid ticket to the file server, the server's Access Control Lists (ACLs) for the requested resource denied access, resulting in an "Access Denied" message.
- ✗
The user account is locked out
Why it's wrong here
If a user account were locked out, the initial Kerberos authentication process would fail at the very first step. The user would be unable to obtain a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC), preventing any subsequent attempts to request service tickets or access resources. Since the context implies an attempt to access a file server resource, the user must have successfully obtained a TGT.
- ✗
Time skew between client and domain controller
Why it's wrong here
Kerberos protocol is highly sensitive to time synchronization to prevent replay attacks. A significant time difference (skew) between the client and the Key Distribution Center (KDC) would cause the KDC to reject the client's initial authentication request for a Ticket Granting Ticket (TGT). The fact that the user was able to proceed to attempt resource access indicates that the time synchronization was within the acceptable tolerance for Kerberos.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Kerberos
Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to verify the identity of users and services in a secure, non-repudiable way.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.