Which of the following statements pertaining to Kerberos is TRUE?

A.
Kerberos uses public key cryptography.

B.
Kerberos uses X.509 certificates.

C.
Kerberos is a credential-based authentication system.

D.
Kerberos was developed by Microsoft.

Explanation:
Kerberos uses symmetric key cryptography and provides end-to-end security. Although it allows the use of
passwords for authentication, it was designed specifically to eliminate the need to transmit passwords over the
network. Most Kerberos implementations work with shared secret keys.
Kerberos uses a credential-based mechanism as the basis for identification and authentication. Kerberos
credentials are referred to as tickets.
Incorrect Answers:
A: Kerberos does not use public key cryptography (asymmetric); it uses symmetric key cryptography.
B: Kerberos does not use X.509 certificates. X.509 certificates are used in public key cryptography.
D: Kerberos was not developed by Microsoft; it was developed in the mid-1980s as part of MIT’s Project
Athena.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 209