Mutual authentication

Mutual authentication means verification runs in both directions. The usual web pattern is one-way: the server proves its identity with a certificate and the user proves theirs with a password, but the user never checks they are talking to the genuine service beyond trusting TLS. Mutual authentication closes that gap: the client authenticates to the server and the server authenticates back to the client before any data flows.

Kerberos is the exam’s canonical example. When a client presents a service ticket, the service proves it could decrypt the ticket by returning the client’s timestamp encrypted under the session key, so each side has demonstrated possession of the right secret. Certificate-based mutual TLS achieves the same property with client certificates. The threat it defeats is server impersonation: a rogue service cannot harvest credentials from a client that demands proof of identity first.

Exam relevance: when a question asks which protocol or property prevents a client from being tricked by a fake server, mutual authentication is the concept, and Kerberos is the protocol answer in a Windows domain context. Also expect it as the differentiator between Kerberos and simpler password-based schemes that authenticate the user only.