A transit domain configures extremely long Kerberos ticket lifetimes. What conceptual risk should the report call out?
Select an answer to reveal the explanation.
Short Explanation
A stolen subway day-pass that lasts a year is a gift to anyone who snags it. Long Kerberos lifetimes stretch how long a grabbed ticket stays useful. Tighten the clock; do not treat "less auth chatter" as free security.
Full Explanation
Kerberos ticket lifetimes bound how long a stolen TGT or service ticket remains useful. Extremely long lifetimes in a transit domain increase the reusable window for ticket theft—pass-the-ticket and related techniques stay viable longer against systems that move riders and staff credentials. The report should call out over-long lifetimes as expanding the useful life of stolen tickets, not as a performance free lunch.
Long lifetimes do not eliminate the need for service-account password rotation; those controls address different secrets. Kerberos does not ignore lifetime policy after one daily authentication—lifetimes and renewals remain material. Longer tickets do not always improve security by reducing auth traffic; they trade chatter for longer theft utility.
Exam caveat: balance usability against stolen-ticket lifetime; document policy values (max ticket age/renewal) against hardening baselines. CPTS AD themes often pair ticket theft with lifetime and delegation context.
Operational check: read domain Kerberos policy maximum lifetime/renewal settings, compare to municipal hardening standards, shorten where justified, and verify critical service accounts still function through a controlled policy pilot.