A user logs into a Kerberos realm and receives a TGT. Later, the user requests a service ticket for a print server. What key is the service ticket encrypted with?

A randomly generated session key

The print server's long-term key

A small business wants to set up a PKI for internal use. They have limited IT staff and want to minimize administrative overhead. They need to issue certificates for internal web servers and email signing. Which PKI deployment model is most appropriate?

A two-tier hierarchy with an offline root and an online issuing CA

Use self-signed certificates for all services

A single CA that acts as both root and issuing CA, with the CA server kept offline except for issuance

Use a public CA for all internal certificates

A security administrator is configuring a service to use Kerberos authentication. The service runs under a domain account. What must the administrator do to allow clients to request service tickets for this service?

Register a service principal name (SPN) for the service account in Active Directory

Set the service account's password to never expire

Configure the service to use a certificate instead of a password

Add the service account to the Domain Admins group

A company has two Kerberos realms: CORP.EXAMPLE.COM and DEV.EXAMPLE.COM. A user in CORP needs to access a service in DEV. A cross-realm trust has been established. What must the user's client do to obtain a service ticket for the DEV service?

Ask the CORP AS to issue a service ticket for the DEV service

Request a referral ticket from the CORP TGS for the DEV realm, then present it to the DEV TGS to obtain a service ticket

Contact the DEV AS directly with the user's password to obtain a TGT for the DEV realm

Use the CORP TGT to encrypt a service ticket request and send it directly to the DEV service

In Kerberos, what is the purpose of a session key?

To encrypt communication between the client and the service for a single session

To authenticate the client to the AS during initial login

To encrypt the user's password for storage

To sign the TGT to prove its authenticity

EC-CouncilCertified Encryption Specialist

Domain 4Objective 2

PKI Infrastructure and Kerberos Authentication ECES Practice Questions (Page 2)

Part of the Applications of Cryptography domain, which makes up ~25% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

7concepts

Questions 6–10

6application · medium
A user logs into a Kerberos realm and receives a TGT. Later, the user requests a service ticket for a print server. What key is the service ticket encrypted with?
Select an answer first
7application · medium
A small business wants to set up a PKI for internal use. They have limited IT staff and want to minimize administrative overhead. They need to issue certificates for internal web servers and email signing. Which PKI deployment model is most appropriate?
Select an answer first
8application · medium
A security administrator is configuring a service to use Kerberos authentication. The service runs under a domain account. What must the administrator do to allow clients to request service tickets for this service?
Select an answer first
9application · medium
A company has two Kerberos realms: CORP.EXAMPLE.COM and DEV.EXAMPLE.COM. A user in CORP needs to access a service in DEV. A cross-realm trust has been established. What must the user's client do to obtain a service ticket for the DEV service?
Select an answer first
10foundation · easy
In Kerberos, what is the purpose of a session key?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.