A city finds unconstrained Kerberos authentication delegation enabled on a web server account. Why is that significant?
Select an answer to reveal the explanation.
Short Explanation
Unconstrained delegation on a web box is like giving the front desk a master key that copies every visitor's badge. Compromise that server and impersonation options explode. Review and remove dangerous delegation on app tiers.
Full Explanation
Unconstrained Kerberos delegation on a web or application server account allows that host, if compromised, to reuse tickets of users who authenticate to it—greatly enlarging the impact of credential theft and impersonation. A city web server account with unconstrained authentication delegation is therefore a high-severity AD design finding: compromise of a citizen-facing or internal web tier can escalate into broader directory impersonation risk.
Unconstrained delegation is not required for HTTPS certificate binding. Delegation flags are not informational-only; they are actionable abuse terrain when mis-set. Unconstrained delegation can exist on member servers—it is not limited to domain controllers.
Exam caveat: prefer constrained or resource-based models where delegation is required, and eliminate unconstrained delegation on web tiers when possible. CPTS AD questions reward recognizing delegation class and blast radius.
Operational check: enumerate accounts with unconstrained delegation, prioritize web/app servers, remove or constrain flags via change control, and verify municipal apps still function with safer delegation patterns. Removing unconstrained delegation on web tiers is one of the highest-leverage civic AD hardening moves when those servers see broad user authentication.