CISSP Identity and Access Management Practice Question
During a Kerberos authentication process, the client receives a Ticket Granting Ticket (TGT) from the Authentication Server (AS). Later, the client presents the TGT to the Ticket Granting Server (TGS) to request a service ticket. Which of the following best describes the purpose of the TGT?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It allows the client to request additional service tickets without re-authentication.
The TGT is a credential that proves the user has been authenticated by the AS and is allowed to request service tickets without re-entering credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It verifies the client's IP address to prevent replay attacks.
Why it's wrong here
The TGT itself does not verify the client's IP address to prevent replay attacks. While some Kerberos implementations or network configurations might incorporate IP checks at various stages, the primary mechanism Kerberos uses to prevent replay attacks on tickets, including the TGT, is the inclusion of timestamps and nonces. These elements ensure that tickets and authenticators have a limited validity period and are unique, making it difficult for an attacker to reuse captured credentials.
- ✓
It allows the client to request additional service tickets without re-authentication.
Why this is correct
The Ticket Granting Ticket (TGT) is a crucial component that facilitates single sign-on within a Kerberos realm. Once a client successfully authenticates to the Authentication Service (AS) and receives a TGT, this ticket serves as proof of their identity to the Ticket Granting Service (TGS). This allows the client to subsequently request service tickets for various network services without needing to re-enter their password or re-authenticate to the KDC for each new service.
- ✗
It encrypts the session key between the client and the target service.
Why it's wrong here
The TGT does not encrypt the session key between the client and the target service. Instead, the TGT contains a session key that is shared between the client and the Ticket Granting Service (TGS), encrypted with the TGS's secret key. The session key for communication between the client and the target service is generated by the TGS when a service ticket is requested, and this specific session key is then encrypted within the service ticket using the target service's secret key.
- ✗
It authenticates the user to the target service directly.
Why it's wrong here
The TGT's role is not to directly authenticate the user to the target service. Instead, the TGT is presented by the client to the Ticket Granting Service (TGS) as proof of initial authentication to obtain a service ticket. It is this service ticket, along with an authenticator generated by the client, that is then presented to the target service to establish a secure, mutually authenticated session. The TGT itself never leaves the client's control to be sent to a service.
Go deeper
Related to this question
Learn chapter
Asset Security: Classification and Handling
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Kerberos
Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to verify the identity of users and services in a secure, non-repudiable way.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.