CISSP Identity and Access Management Practice Question
In Kerberos authentication, what is the purpose of the Ticket Granting Ticket (TGT)?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To prove the user's identity to the Ticket Granting Service (TGS)
The TGT is obtained from the AS and used to request service tickets from the TGS without re-entering credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To prove the user's identity to the Ticket Granting Service (TGS)
Why this is correct
The Ticket Granting Ticket (TGT) serves as a crucial credential, issued by the Authentication Server (AS), that the client presents to the Ticket Granting Service (TGS). It contains the user's identity and a session key, encrypted with the TGS's secret key, proving the user has been successfully authenticated by the AS. This allows the TGS to trust the client's request for service tickets without requiring re-authentication to the AS for each new service.
- ✗
To store the user's password hash
Why it's wrong here
The TGT does not store the user's password hash; instead, it contains information like the user's principal name, a timestamp, and a session key for secure communication with the TGS. Storing password hashes directly within a client-side credential like the TGT would be a significant security vulnerability, exposing sensitive authentication material. User password hashes are securely stored and managed solely by the Key Distribution Center (KDC) for initial authentication.
- ✗
To encrypt all communication between client and server
Why it's wrong here
While the TGT facilitates secure communication, its primary purpose is not to encrypt all communication between the client and a server directly. The TGT itself is a credential that *contains* a session key for communication with the TGS, but separate, unique session keys are generated and distributed for encrypting actual data traffic between the client and specific resource servers. These service-specific session keys, derived during the service ticket acquisition process, handle the end-to-end encryption.
- ✗
To authenticate the user to the resource server directly
Why it's wrong here
The Ticket Granting Ticket (TGT) is specifically designed for authenticating the user to the Ticket Granting Service (TGS), not directly to a resource server. To access a resource server, the client first uses the TGT to request a service ticket from the TGS. This service ticket, which is distinct from the TGT, is then presented to the resource server for authentication and authorization to access the desired service.
Go deeper
Related to this question
Learn chapter
Incident Response and Business Continuity
Key term
Kerberos
Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to verify the identity of users and services in a secure, non-repudiable way.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.