SSCP Access Controls Practice Question
An organization uses Kerberos for single sign-on. When a user logs in, they receive a Ticket Granting Ticket (TGT). What is the primary purpose of the TGT?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To obtain service tickets for accessing resources
The TGT is obtained from the Authentication Server (AS) and is used to request service tickets from the Ticket Granting Server (TGS) without re-entering credentials, enabling SSO.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To encrypt all network traffic
Why it's wrong here
The TGT is encrypted with the Key Distribution Centre's secret key and proves the user's prior authentication; it does not encrypt network traffic, which Kerberos session keys or transport protocols handle. It is tempting because Kerberos encrypts authentication exchanges, but traffic confidentiality is a separate concern from ticket issuance.
- ✓
To obtain service tickets for accessing resources
Why this is correct
The TGT is issued by the Authentication Service after initial credential validation and is presented to the Ticket Granting Service to request service tickets. It proves the user's identity without re-entering credentials, enabling single sign-on for subsequent resource access.
- ✗
To provide a digital signature for emails
Why it's wrong here
A TGT is encrypted with the KDC's secret key and presented to obtain service tickets; it carries no signing key or message hash, so it cannot sign email. It is tempting because Kerberos does issue cryptographic material, but the correct choice for email signing is a digital certificate, not a TGT.
- ✗
To authenticate the user to the network
Why it's wrong here
Authentication occurs during the initial AS exchange, where credentials are validated and the TGT issued; the TGT then proves that authentication to the KDC when requesting service tickets. It is tempting because the TGT represents the authenticated session, but its purpose is obtaining service tickets, not performing authentication itself.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. In a Kerberos environment, what is the primary function of the Ticket Granting Ticket (TGT)?
medium- A.To store the user's password hash securely
- ✓ B.To request service tickets from the Ticket Granting Service (TGS)
- C.To provide a session key for encrypting communications
- D.To authenticate the user to the Key Distribution Center (KDC)
Why B: The TGT is obtained after initial authentication and is used to request service tickets for various resources without re-authenticating.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.