N10-009 Question 80
Single answerLDAPS: 636A systems administrator is integrating a new HR application with the company's Active Directory for user authentication. The application fails to connect when configured for secure directory lookups, and packet captures show the server attempting to reach the domain controller on TCP port 636. Standard LDAP queries on port 389 work successfully. Which of the following is the most likely issue preventing the secure connection?
- A
A firewall is blocking HTTPS traffic on TCP port 443 between the application server and the domain controller
- B
The domain controller does not have a valid certificate installed for LDAPS
- C
The client must use UDP port 636 instead of TCP port 636 for encrypted LDAP traffic
- D
The application should use Kerberos on TCP port 88 instead of LDAPS for secure directory queries
Show answer and explanation
Correct answer: B
Explanation
LDAPS is LDAP over SSL/TLS and commonly uses TCP port 636 for encrypted directory communication. In Microsoft Active Directory environments, successful LDAPS connections require the domain controller to have a valid certificate that supports server authentication and matches client trust requirements. A common real-world failure scenario is that LDAP on port 389 works, but LDAPS on 636 fails because the certificate is missing, expired, untrusted, or misconfigured. This aligns with Microsoft guidance for enabling LDAP over SSL/TLS in Active Directory Domain Services, which states that a suitable certificate must be installed on the domain controller. From a Network+ perspective, the key applied knowledge is recognizing that port 636 indicates LDAPS and that transport security depends on proper certificate-based TLS negotiation, not just open connectivity.
- A. Incorrect.
Incorrect. LDAPS uses TCP port 636, not HTTPS on TCP port 443. Although both use TLS, blocking 443 would not directly prevent an LDAPS session to a domain controller unless the application were specifically using a web-based API instead of LDAP.
- B. Correct.
Correct. LDAPS requires the directory server, such as a domain controller, to present a valid server certificate so the TLS session can be established on TCP port 636. If the certificate is missing, expired, improperly issued, or otherwise invalid, the secure LDAP bind or query will fail even though standard LDAP on port 389 may still work.
- C. Incorrect.
Incorrect. LDAP and LDAPS use TCP, not UDP, for session-based directory communication. Suggesting UDP 636 reflects a common misconception that secure services simply mirror ports across protocols. LDAPS specifically operates over TCP 636.
- D. Incorrect.
Incorrect. Kerberos on TCP/UDP port 88 is used for authentication in Active Directory environments, but it is not a replacement for LDAPS when an application is explicitly performing secure LDAP directory queries. The issue described is with establishing an encrypted LDAP session, not with Kerberos ticketing.