hardMultiple ChoiceObjective-mapped
SSCP Practice Question: A Windows workstation is unable to authenticate…
A Windows workstation is unable to authenticate to a Kerberos-based application. The time on the workstation is 5 minutes ahead of the domain controller. What is the impact?
⚠ Common exam trap
Many exam-takers assume the default clock skew is 10 minutes (as in some older implementations) or that a 5-minute difference is acceptable, but the SSCP exam expects you to know the exact default value of 5 minutes and that reaching that limit causes authentication to fail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication will fail because the time difference exceeds the default Kerberos clock skew limit
Kerberos authentication relies on timestamps to prevent replay attacks. The default maximum clock skew allowed between a client and a domain controller is 5 minutes (as defined in RFC 4120). Since the workstation is exactly 5 minutes ahead, it meets the threshold, but any additional delay or network latency can cause the timestamp to exceed the limit, resulting in authentication failure. Therefore, the user will be unable to authenticate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user would be prompted for credentials but authentication would proceed
Why it's wrong here
If time skew is exceeded, the Ticket Granting Server will reject the request, preventing authentication altogether.
- ✓
Authentication will fail because the time difference exceeds the default Kerberos clock skew limit
Why this is correct
Kerberos allows a maximum skew of 5 minutes by default; a 5-minute difference may cause rejection or succeed only if within tolerance.
- ✗
Only NTLM authentication would be affected
Why it's wrong here
NTLM is not time-sensitive; Kerberos is the protocol that requires time synchronization.
- ✗
No impact; Kerberos can tolerate up to 10 minutes of skew
Why it's wrong here
The default maximum skew in Windows is 5 minutes, not 10; a 5-minute difference may be at the limit.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.