hardMultiple Choice
Kerberos: Ticket-Based Authentication for Single Sign-On
An organization wants to implement a centralized authentication system that supports single sign-on and uses tickets. Which technology should they choose?
Quick Answer
The answer is Kerberos, the correct choice for implementing a centralized authentication system that supports single sign-on and uses tickets. Kerberos achieves this through a ticket-based authentication protocol that relies on a trusted third-party Key Distribution Center (KDC), which issues time-limited tickets to users after an initial authentication, allowing them to access multiple services without re-entering credentials. On the Systems Security Certified Practitioner SSCP exam, this concept tests your understanding of authentication protocols and SSO mechanisms, often appearing in questions that contrast Kerberos with alternatives like LDAP or RADIUS—a common trap is confusing Kerberos’s ticket-granting tickets with simple password hashing. Remember the memory tip: “Kerberos keeps credentials cached in tickets, not transmitted,” which highlights its core security advantage.
⚠ Common exam trap
Many candidates confuse LDAP (a directory protocol) with authentication, or assume SAML's SSO capability uses tickets, when in fact Kerberos is the only option that explicitly uses tickets as its core mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Kerberos
Kerberos is the correct choice because it is a ticket-based authentication protocol that provides single sign-on (SSO) capabilities. It uses a trusted third-party Key Distribution Center (KDC) to issue time-limited tickets, allowing users to authenticate once and access multiple services without re-entering credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
LDAP
Why it's wrong here
LDAP is a directory access protocol for storing and querying identity data; it issues no authentication tickets and provides no SSO session mechanism. It would be the right choice for a central identity store queried by other services. Ticket-based SSO requires Kerberos, which issues TGTs and service tickets.
- ✓
Kerberos
Why this is correct
Kerberos issues time-stamped tickets through a Key Distribution Centre, letting users authenticate once and access multiple services without resending credentials. This directly satisfies the stem's twin requirements: centralised authentication plus ticket-based single sign-on. Microsoft Entra ID uses token-based protocols instead, so it does not meet the ticket criterion.
- ✗
SAML
Why it's wrong here
SAML is an XML-based federation standard for exchanging authentication assertions between an identity provider and service providers; it issues assertions, not tickets, and does not itself provide Kerberos-style SSO. SAML suits cross-domain web SSO. Ticket-based SSO within a realm requires Kerberos.
- ✗
RADIUS
Why it's wrong here
RADIUS centralises authentication, authorisation and accounting for network access, but it forwards credentials and returns accept/reject attributes; it issues no tickets and does not deliver SSO sessions. RADIUS fits VPN or 802.1X access control. Ticket-based SSO requires Kerberos, whose TGT enables service tickets.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which two components are integral to a Kerberos authentication system? (Select TWO)
medium- A.Authentication Server (AS)
- ✓ B.Key Distribution Center (KDC)
- ✓ C.Ticket Granting Ticket (TGT)
- D.Certificate Authority (CA)
- E.Security Assertion Markup Language (SAML)
Why B: The Key Distribution Center (KDC) (B) is a core component of Kerberos because it hosts both the Authentication Server and the Ticket Granting Server, issuing the cryptographic material (session keys and tickets) that clients and services use to authenticate. The Ticket Granting Ticket (TGT) (C) is likewise integral: it is the credential the KDC's Authentication Server returns after the initial AS-REQ/AS-REP exchange, and the client presents it to the Ticket Granting Server to obtain service tickets without re-entering credentials. By contrast, the Authentication Server (A) is only a subcomponent within the KDC rather than a separate integral component, and it is not marked correct here. A Certificate Authority (D) belongs to public-key infrastructure (X.509/PKI) and is not part of Kerberos's symmetric-key ticket model, while SAML (E) is an XML-based federation protocol for web single sign-on, unrelated to Kerberos's native authentication exchanges.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.