CISSP Identity and Access Management Practice Question
In Kerberos, which component issues ticket-granting tickets (TGTs) after verifying the user's credentials?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication Server (AS)
The Authentication Server (AS) is responsible for issuing TGTs after verifying the user's password or other credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication Server (AS)
Why this is correct
The Authentication Server (AS) is the initial point of contact for a Kerberos client seeking authentication within a realm. It is responsible for verifying the user's identity, typically by validating a password or other credentials against its secure database. Upon successful authentication, the AS issues a Ticket Granting Ticket (TGT) to the client, which is encrypted with the Ticket Granting Server's (TGS) secret key, allowing the client to request subsequent service tickets without re-transmitting its password.
- ✗
Domain Controller
Why it's wrong here
A Domain Controller is a server role specific to Microsoft Active Directory environments, responsible for managing user accounts, authenticating users, and enforcing security policies within a Windows domain. While a Domain Controller typically hosts the Kerberos Key Distribution Center (KDC) service in a Windows network, it is an implementation detail of a directory service rather than a fundamental component of the Kerberos protocol itself. Kerberos is a protocol that can be implemented independently of Active Directory, making 'Domain Controller' a specific product term, not a universal Kerberos component.
- ✗
Ticket Granting Server (TGS)
Why it's wrong here
The Ticket Granting Server (TGS) is a component of the Kerberos Key Distribution Center (KDC) that is responsible for issuing service tickets, not Ticket Granting Tickets (TGTs). After a client obtains a TGT from the Authentication Server (AS), it presents this TGT to the TGS when requesting access to a specific network service. The TGS then validates the TGT and issues a service ticket, encrypted with the target service's secret key, enabling the client to authenticate directly to that service.
- ✗
Key Distribution Center (KDC)
Why it's wrong here
The Key Distribution Center (KDC) is the overarching logical entity in a Kerberos realm that acts as a trusted third party, providing both authentication and ticket-granting services. It comprises two distinct functional components: the Authentication Server (AS) and the Ticket Granting Server (TGS). While the KDC as a whole facilitates the entire Kerberos authentication process, it is specifically the Authentication Server (AS) component within the KDC that issues the initial Ticket Granting Tickets (TGTs).
Go deeper
Related to this question
Learn chapter
Legal, Regulatory, and Compliance Issues
Key term
Kerberos
Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to verify the identity of users and services in a secure, non-repudiable way.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.