StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory · Monitoring and troubleshooting | Troubleshoot Windows Server issues

Practice question 506 of 506 · hard

Users access a service by its DNS name, and Kerberos fails after the service identity is changed. The same service SPN is present on both the old and new accounts. What should be corrected?

Choose the single best answer.

  1. A.Add the same SPN to every service account so a domain controller can choose any valid password
  2. B.Identify the duplicate SPN and register the intended service SPN uniquely on the correct account, then retest with appropriate tickets
  3. C.Purge tickets without correcting either duplicate account registration and assume future ticket requests will choose the right key
  4. D.Switch users to the server IP and assume that guarantees the same service-name Kerberos behavior
Show the answer and explanation

✓ Correct answer

  • Identify the duplicate SPN and register the intended service SPN uniquely on the correct account, then retest with appropriate tickets

The requested SPN must identify the correct account uniquely so the service can receive a ticket for its key. More duplicates increase ambiguity; IP access can alter Kerberos behavior; purging the cache without correcting SPN ownership leaves the cause for future requests.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.