Kerberos vs. RADIUS vs. SAML: Picking the Right One on the Security+ Exam

Kerberos, RADIUS, and SAML all show up on the CompTIA Security+ (SY0-701) exam as answers to the same underlying question: how does this user or device prove who they are? The trouble is that scenario questions rarely name the protocol directly — they describe a situation and expect you to recognize which one fits. This guide is built around that recognition problem: a quick fingerprint for each protocol, the exact clues that point to one over the others, and where the three fit together in a real network rather than competing for the same job.

Each of these has a full deep-dive elsewhere on this site, so this article stays focused on telling them apart under exam pressure rather than re-explaining the internals.

The One-Line Fingerprint for Each

• Kerberos — ticket-based authentication inside a single Windows domain. You log in once at your desk and reach file shares, printers, and internal apps without typing your password again. See our full Kerberos guide for the KDC, tickets, and Kerberoasting.
• RADIUS — the AAA protocol that decides whether a device gets onto the network in the first place: Wi-Fi, VPN, or a wired switch port. It's the back-end decision-maker behind 802.1X. Our AAA Explained guide covers RADIUS in depth, including its TACACS+ comparison.
• SAML — an XML-based federation standard that lets you log into a separate organization's web application using your own company's credentials, without that application ever seeing your password. See our SAML Explained guide and our broader Federation Explained guide covering SAML, OAuth, and OIDC together.

Scenario Clues That Point to Kerberos

Think "inside the building, inside the domain." Kerberos is the right answer when the scenario describes:

• A user already logged into a domain-joined Windows machine reaching internal resources without re-entering credentials.
• Authentication failing network-wide right after a system's clock drifted — Kerberos enforces a five-minute time tolerance by default, and clock skew is the classic exam trigger.
• Terms like KDC, ticket-granting ticket, krbtgt, or port 88.
• An attack scenario naming Kerberoasting, Golden Ticket, or pass-the-ticket.

Scenario Clues That Point to RADIUS

Think "getting onto the network," not "what I can do once I'm on it." RADIUS is the right answer when the scenario describes:

• A laptop or phone authenticating to a corporate Wi-Fi SSID in enterprise mode.
• A remote user authenticating to a VPN concentrator before a tunnel is established.
• A switch port blocking traffic until a device authenticates — this is 802.1X, and RADIUS is almost always the authentication server making the decision behind it.
• Terms like UDP 1812/1813, shared secret, NAS (network access server), or supplicant/authenticator.

Watch for the classic distractor: a question that describes RADIUS behavior but is really testing whether you know TACACS+ is the one that encrypts the entire payload and separates authentication from authorization — RADIUS only encrypts the password and bundles those two As together.

Scenario Clues That Point to SAML

Think "crossing an organizational boundary on the web." SAML (or federation more broadly) is the right answer when the scenario describes:

• An employee clicking a link to a vendor's portal, a benefits site, or a SaaS application and landing there already logged in, using corporate credentials.
• A browser redirect to a separate login page before bouncing back to the original application — that redirect is the identity provider (IdP) doing the authenticating.
• Terms like assertion, identity provider, service provider / relying party, or XML.
• An attack scenario naming Golden SAML, where a stolen token-signing key lets an attacker forge assertions for any user.

If the scenario instead mentions an access token letting an app act on a user's behalf (not logging them in), that's OAuth, not SAML — a distinction CompTIA tests directly, covered in the Federation guide linked above.

How the Three Actually Work Together

A real enterprise network doesn't pick one of these — it layers them, and the exam increasingly expects you to see the whole stack in one scenario:

• An employee's laptop joins the office Wi-Fi: 802.1X and RADIUS decide whether the device gets on the network at all.
• Once connected, the employee logs into their domain-joined machine: Kerberos issues tickets for file shares, internal apps, and printers for the rest of the day.
• The employee then opens a third-party SaaS tool, like an expense system or a benefits portal: SAML (or OIDC) federates that login back to the same corporate identity, so no separate password ever gets created at the vendor.

Three different trust boundaries — the network edge, the internal domain, and the outside world — and a different protocol built for each one. None of them is a substitute for the others, which is exactly why CompTIA tests all three rather than picking a favorite.

Key Takeaways

• Kerberos: ticket-based SSO inside one Windows domain. Watch for KDC, tickets, port 88, and clock-skew failures.
• RADIUS: AAA for getting a device onto the network — Wi-Fi, VPN, or 802.1X-controlled ports. Watch for UDP 1812/1813 and shared secrets.
• SAML: XML-based federation that lets a separate organization's web app trust your home organization's login, without ever seeing your password.
• The fastest way to tell them apart on a scenario question: ask whether the trust boundary is inside one domain (Kerberos), at the network's edge (RADIUS), or across organizations on the web (SAML).
• They aren't competitors — a single employee's day typically touches all three, each guarding a different boundary.