N10-009 Question 70
Single answerLDAP: 389A systems administrator deploys a new internal web application that authenticates users against the company's directory service. Users report that logins fail only when they are connected through a recently updated firewall segment, while users on the local server VLAN can still sign in normally. A packet capture from a failing client shows connection attempts to the directory server's IP address on TCP port 389 being reset. Which firewall change is the most appropriate to restore authentication for these users while keeping the rule set as limited as possible?
- A
Allow outbound and return LDAP traffic on TCP 389 between the affected client segment and the directory server
- B
Allow HTTPS on TCP 443 between the affected client segment and the directory server
- C
Allow DNS zone transfers on TCP 53 between the affected client segment and the directory server
- D
Allow SMB file sharing on TCP 445 between the affected client segment and the directory server
Show answer and explanation
Correct answer: A
Explanation
The key evidence is the packet capture showing connection attempts to the directory server on TCP 389 being reset. LDAP, the Lightweight Directory Access Protocol, uses port 389 by default for standard directory queries and authentication exchanges. In a segmented network, if authentication works locally but fails across a firewall, a blocked or reset LDAP session is a strong indicator that the firewall is filtering TCP 389. The most appropriate response is to allow only the required LDAP traffic between the affected source network and the directory server rather than broadly opening unrelated ports. As a best practice, administrators should permit the minimum necessary ports and scope rules to specific source and destination networks. Standard references such as the IANA service name and port number registry list ldap on TCP/UDP 389, and vendor firewall guidance generally recommends tightly scoped rules for directory services.
- A. Correct.
Correct. LDAP commonly uses TCP port 389 for directory queries and authentication requests when not using LDAPS. Since the packet capture shows resets on TCP 389 and the issue only affects clients crossing the updated firewall, the most targeted fix is to permit LDAP traffic between that client network and the directory server. This aligns directly with the observed symptom and avoids opening unrelated services.
- B. Incorrect.
Incorrect. TCP 443 is used for HTTPS, not standard LDAP. A candidate might choose this if they assume all authentication traffic is web-based because the application is accessed in a browser, but the scenario specifically states the application authenticates against a directory service and the capture shows failures on TCP 389.
- C. Incorrect.
Incorrect. DNS can use port 53, but DNS zone transfers are not related to LDAP authentication. Someone might pick this because directory-based environments often depend on DNS, especially in enterprise networks, but the evidence points specifically to blocked LDAP sessions on port 389 rather than a name resolution issue.
- D. Incorrect.
Incorrect. TCP 445 is used for SMB/CIFS file sharing and related Microsoft services, not LDAP directory lookups. This is a plausible distractor because Windows environments often use several directory-related services together, but opening SMB would not address resets seen on LDAP port 389.