This is the number of REQUIRED PDC emulators in a domain.
What is one?
100
Domain controllers are the servers that store and run this.
What is the active directory database?
100
This is an account under which an operating system, process, or service runs.
What is a service account?
100
Kerberos can improve overall authentication performance by using the current client ticket proving that the client is authenticated. This is the second way that kerberos can improve performance.
What is what is double-hop authentication?
200
Name two benefits to using Managed Service Accounts.
What is - To simplify administration, MSAs provide automatic password management and simplified SPN management?
200
Kerberos is more secure than NTLM and also more complex. The reason for the added complexity is this.
What is kerberos requires a service principal name for the domain account?
200
This is the default authentication protocol for non-domain joined computers.
What is NT Lan Manager (NTLM)?
200
When creating accounts for operating systems, processes, and services, you should always configure them with these two things in mind.
What is using strong passwords and granting the least rights possible?
200
This is a computer network authentication protocol that allows hosts to prove their identity securely over a non-secure network.
What is kerberos?
300
There are two restrictions for adding Service Principal Names (SPNs) to an account. List them.
What are domain administrative privilege and access to run ADSI edit from a domain controller?
300
This uses a challenge-response mechanism for authentication in which clients can prove their identities without sending a password to the server.
What is NTLM - NT Lan Manager?
300
In kerberos, you can configure this action. This action will restrict which services are allowed to delegate user credentials by specifying which service a kerberos ticket can be forwarded.
What is constrained delegation?
300
Use this tool to add a SPN to an account.
What is adsi edit?
300
This service needs to be accurate and properly synchronized between systems for kerberos to work properly.
What is the time service?
400
If a client submits a service ticket request for an SPN that does not exist in the identity store, this happens.
What is - the client receives an access denied error?
400
This kerberos setting defines how long a service or user ticket can be renewed.
What is maximum lifetime for user ticket renewal?
400
With Kerberos, security and authentication are based on this technology.
What is a secret-key designated to every host on the network?
400
This kerberos authentication method forwards kerberos tickets from one service to a supporting service.
What is double-hop authentication?
400
This kerberos setting defines the maximum time skew that can be tolerated between a ticket's timestamp and the current time at the KDC.
What is maximum tolerance for computer clock synchronization?
500
A service or application that is secured by kerberos must have this in the domain.
What is an identity?
500
The Service Principal Name (SPN) consists of these three components.
What are service class, host name, and port number?
500
This is the default maximum lifetime for a kerberos TGT user ticket.
What is 10 hours?
500
This is an account that emulates a Network Service account that has the name NT Service\servicename.
What is a virtual account?
500
Domain controllers and clients must be in close time synchronization. This is the maximum time lapse allowed.