Explanation/Reference:
If direct integration with AD is not currently possible, use the following instructions to configure a local MIT KDC to trust your AD server:
1. Run an MIT Kerberos KDC and realm local to the cluster and create all service principals in this realm.
2. Set up one-way cross-realm trust from this realm to the Active Directory realm. Using this method, there is no need to create service principals in Active Directory, but Active Directory principals (users) can be authenticated to Hadoop.
Incorrect Answers:
B: The complication with Kerberos authentication is that your organization needs to have a Kerberos KDC (Key Distribution Center) server setup already, which will then link to your corporate LDAP or Active Directory service to check user credentials when they request a Kerberos ticket.
References: https://www.cloudera.com/documentation/enterprise/5-8-x/topics/ cdh_sg_hadoop_security_active_directory_integrate.html#topic_15_1