In Kerberos, to whom is the service ticket typically delivered?

• A. Verifier
• B. Supplicant
• C. Service
• D. Kerberos server

Answer: (B)

In Kerberos, the service ticket is issued to the client that wants to access a service. The client (often called the supplicant) first proves its identity to the Kerberos server to obtain a ticket-granting ticket, then uses that to request a service ticket. The Kerberos server returns the service ticket to the client, who then presents it to the target service to authenticate. The service ticket is not delivered directly to the service by the Kerberos server; it’s carried by the client and shown to the service during the access request. The service itself will check the ticket using its own secret key to verify the client’s identity.