CISSP GLOSSARY · IDENTITY & ACCESS MANAGEMENT
Kerberos
The ticket-based network authentication protocol tested in CISSP Domain 5: a trusted KDC issues a TGT, then service tickets, using symmetric encryption so passwords never cross the wire.
Kerberos is the authentication protocol behind Active Directory and a CISSP Domain 5 staple. The moving parts to know cold: the Key Distribution Center (KDC) with its Authentication Service and Ticket Granting Service, the Ticket Granting Ticket (TGT) you receive at logon, and the service tickets you present to each server you access.
The exam tests the properties, not the packet layout. Kerberos uses symmetric encryption, provides mutual authentication (client and server verify each other), and never sends the password across the network. Its classic weak points are just as testable: the KDC is a single point of failure, and the whole protocol depends on loosely synchronised clocks because tickets carry timestamps to resist replay attacks.
Exam relevance: if a question mentions tickets, a KDC, or mutual authentication in a Windows domain, the answer is Kerberos. Its attack chain (golden ticket, silver ticket, Kerberoasting) is where Domain 5 scenario questions go next.