CISSP Identity and Access Management Practice Question
In Kerberos authentication, which component issues a Ticket Granting Ticket (TGT) after verifying the user's credentials?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication Server (AS)
The Authentication Server (AS) verifies the user's credentials and issues a TGT, which the user can then use to request service tickets from the TGS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Domain Controller
Why it's wrong here
A Domain Controller, particularly in a Windows Active Directory environment, is a server that can host the Kerberos Key Distribution Center (KDC). While it provides the physical or logical infrastructure for Kerberos services, the Domain Controller itself is not the specific Kerberos component responsible for issuing tickets. The KDC's Authentication Server (AS) sub-component performs this cryptographic function, making 'Domain Controller' too broad a term.
- ✗
Ticket Granting Server (TGS)
Why it's wrong here
The Ticket Granting Server (TGS) is a crucial logical component within the Kerberos Key Distribution Center, but its specific role is to issue *service tickets* to clients. These service tickets grant access to specific application services after the client has already obtained a Ticket Granting Ticket (TGT) from the Authentication Server (AS). Therefore, the TGS is not the component that issues the initial TGT.
- ✗
Key Distribution Center (KDC)
Why it's wrong here
The Key Distribution Center (KDC) is the central authority in a Kerberos realm, comprising two logical components: the Authentication Server (AS) and the Ticket Granting Server (TGS). While the KDC *as a whole* facilitates ticket distribution, it is the AS component *within* the KDC that specifically authenticates the user and issues the initial Ticket Granting Ticket (TGT). Thus, KDC is too general a term for the specific issuer of the TGT.
- ✓
Authentication Server (AS)
Why this is correct
The Authentication Server (AS) is the precise Kerberos component responsible for the initial authentication of a user or service principal. Upon successful authentication, typically involving a shared secret (like a password hash), the AS issues a Ticket Granting Ticket (TGT) to the client. This TGT is then used by the client to request service tickets from the Ticket Granting Server (TGS) without needing to re-authenticate with the AS, streamlining subsequent access.
Go deeper
Related to this question
Learn chapter
Legal, Regulatory, and Compliance Issues
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Kerberos
Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to verify the identity of users and services in a secure, non-repudiable way.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.