hardMultiple ChoiceObjective-mapped
Kerberos: Ticket-Based Authentication for Single Sign-On
An organization wants to implement a centralized authentication system that supports single sign-on and uses tickets. Which technology should they choose?
Quick Answer
The answer is Kerberos, the correct choice for implementing a centralized authentication system that supports single sign-on and uses tickets. Kerberos achieves this through a ticket-based authentication protocol that relies on a trusted third-party Key Distribution Center (KDC), which issues time-limited tickets to users after an initial authentication, allowing them to access multiple services without re-entering credentials. On the Systems Security Certified Practitioner SSCP exam, this concept tests your understanding of authentication protocols and SSO mechanisms, often appearing in questions that contrast Kerberos with alternatives like LDAP or RADIUS—a common trap is confusing Kerberos’s ticket-granting tickets with simple password hashing. Remember the memory tip: “Kerberos keeps credentials cached in tickets, not transmitted,” which highlights its core security advantage.
⚠ Common exam trap
Many candidates confuse LDAP (a directory protocol) with authentication, or assume SAML's SSO capability uses tickets, when in fact Kerberos is the only option that explicitly uses tickets as its core mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Kerberos
Kerberos is the correct choice because it is a ticket-based authentication protocol that provides single sign-on (SSO) capabilities. It uses a trusted third-party Key Distribution Center (KDC) to issue time-limited tickets, allowing users to authenticate once and access multiple services without re-entering credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
LDAP
Why it's wrong here
LDAP is a directory protocol, not a ticket-based authentication system.
- ✓
Kerberos
Why this is correct
Kerberos uses a ticket-granting system for SSO.
- ✗
SAML
Why it's wrong here
SAML is for federated identity and uses assertions, not tickets.
- ✗
RADIUS
Why it's wrong here
RADIUS is for network access authentication, not typically ticket-based SSO.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which two components are integral to a Kerberos authentication system? (Select TWO)
medium- A.Authentication Server (AS)
- ✓ B.Key Distribution Center (KDC)
- ✓ C.Ticket Granting Ticket (TGT)
- D.Certificate Authority (CA)
- E.Security Assertion Markup Language (SAML)
Why B: The Key Distribution Center (KDC) is the core component of a Kerberos authentication system, responsible for issuing tickets and managing session keys. The Ticket Granting Ticket (TGT) is a temporary credential obtained from the Authentication Server (AS) within the KDC, used to request service tickets without re-entering credentials. Both are integral to the Kerberos protocol (RFC 4120) for secure, ticket-based authentication.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.