In the Kerberos policy, what is the maximum lifetime for a user ticket?

In the Kerberos policy, what is the maximum lifetime for a user ticket?

• A. 3 hours
• B. 180 minutes
• C. 1 minute
• D. 3 days

Answer: (A)

In Kerberos, tickets are time-bound to limit how long a stolen credential could be misused. A user ticket (the TGT) has a maximum lifetime set by policy, which defines the longest period that ticket can remain valid before a new authentication is required. Setting this to three hours provides a balance: it allows users to stay logged in for a reasonable period without re-authenticating, while keeping the exposure window short enough to reduce risk if the ticket is compromised. After those three hours (or if renewal isn’t permitted or is exhausted), the user must re-authenticate to obtain a fresh TGT. Service tickets, issued for specific services, generally have shorter lifetimes and can be renewed within policy, but the overall maximum for the user ticket remains the limiting factor.

In Kerberos, tickets are time-bound to limit how long a stolen credential could be misused. A user ticket (the TGT) has a maximum lifetime set by policy, which defines the longest period that ticket can remain valid before a new authentication is required. Setting this to three hours provides a balance: it allows users to stay logged in for a reasonable period without re-authenticating, while keeping the exposure window short enough to reduce risk if the ticket is compromised. After those three hours (or if renewal isn’t permitted or is exhausted), the user must re-authenticate to obtain a fresh TGT. Service tickets, issued for specific services, generally have shorter lifetimes and can be renewed within policy, but the overall maximum for the user ticket remains the limiting factor.