hardMultiple ChoiceObjective-mapped
Kerberos Time Synchronization: A Must for Remote Authentication
You are the security administrator for a healthcare organization that uses a Windows Active Directory domain. The organization has recently implemented a new electronic health record (EHR) system that requires users to authenticate before accessing patient data. The EHR system uses Kerberos for authentication. Users report that they can access the EHR system from their office workstations, but when they attempt to access it remotely via VPN, they receive an 'Access Denied' error. The VPN uses RADIUS for authentication and assigns IP addresses from a separate subnet. The EHR server is in the same domain as the workstations. You verify that the users are able to connect to the VPN successfully and can access other internal resources. What is the most likely cause of the issue?
Quick Answer
The remote user's system clock being out of sync with the domain controller is the most likely cause because Kerberos authentication depends on tightly synchronized time between the client and the domain controller. The protocol has a default maximum clock skew tolerance of just five minutes, and once that tolerance is exceeded, the domain controller rejects the ticket request outright, producing an access-denied response even though the credentials themselves are valid. This scenario is a good illustration of why Kerberos failures can be misleading to troubleshoot: the VPN connection succeeds because RADIUS authentication doesn't depend on time synchronization the same way, and other internal resources may work if they don't require a fresh Kerberos ticket exchange, so everything looks fine right up until the EHR system specifically demands strict time-based validation. Remote and VPN-connected machines are especially prone to this problem because they aren't always joined to the same reliable time source as machines sitting on the corporate LAN, and even a small amount of clock drift accumulates quickly on a laptop that's been disconnected or asleep. The fix is to ensure the client is synchronizing its clock against the domain's time hierarchy. Whenever a question describes authentication that works everywhere except one Kerberos-dependent service, and the environment involves remote or VPN-connected clients, time synchronization should be the first thing you suspect.
⚠ Common exam trap
The trap here is that candidates focus on network connectivity or VPN configuration (like port forwarding) rather than the time synchronization requirement of Kerberos, assuming that successful VPN connection implies all authentication protocols will work seamlessly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The remote user's system clock is not synchronized with the domain controller.
Kerberos authentication is highly sensitive to time skew; the default maximum tolerance is 5 minutes (RFC 4120). When users connect via VPN, their system clocks may drift from the domain controller's time, especially if they are not synchronized with the domain's time source. This time difference causes Kerberos to reject the ticket request, resulting in an 'Access Denied' error even though the VPN connection itself is successful.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EHR server is not joined to the domain.
Why it's wrong here
The server is in the same domain, otherwise office access would fail.
- ✗
The VPN does not forward Kerberos traffic to the domain controller.
Why it's wrong here
Other resources are accessible, so Kerberos traffic is likely forwarded.
- ✓
The remote user's system clock is not synchronized with the domain controller.
Why this is correct
Kerberos requires time sync; VPN issues often corrupt time sync.
- ✗
The user's account is not in the EHR application's access group.
Why it's wrong here
Users can access from office, so group membership is correct.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Windows workstation is unable to authenticate to a Kerberos-based application. The time on the workstation is 5 minutes ahead of the domain controller. What is the impact?
hard- A.The user would be prompted for credentials but authentication would proceed
- ✓ B.Authentication will fail because the time difference exceeds the default Kerberos clock skew limit
- C.Only NTLM authentication would be affected
- D.No impact; Kerberos can tolerate up to 10 minutes of skew
Why B: Kerberos authentication relies on timestamps to prevent replay attacks. The default maximum clock skew allowed between a client and a domain controller is 5 minutes (as defined in RFC 4120). Since the workstation is exactly 5 minutes ahead, it meets the threshold, but any additional delay or network latency can cause the timestamp to exceed the limit, resulting in authentication failure. Therefore, the user will be unable to authenticate.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.