CIAM Directory Services 2 — Questions and Answers
Question 1: Which LDAP attribute is used to store the distinguished name of a group's members in Active Directory?
- memberOf
- member (Correct answer)
- groupMembership
- uniqueMember
Correct answer: member
The 'member' attribute on a group object stores the DNs of its members, while 'memberOf' is a back-link attribute on the user object.
Question 2: What is the purpose of the Global Catalog in Active Directory?
- Stores full replicas of all objects in the forest for disaster recovery
- Provides a partial replica of all objects in the forest to enable cross-domain searches (Correct answer)
- Caches user credentials to allow offline authentication
- Maintains a list of all domain controllers in the forest
Correct answer: Provides a partial replica of all objects in the forest to enable cross-domain searches
The Global Catalog holds a partial, read-only replica of all objects across all domains in the forest, enabling fast cross-domain searches without referrals.
Question 3: In an LDAP directory, what does a 'referral' response indicate?
- The requested object was found and returned
- The client's credentials were rejected
- The directory server does not hold the requested entry and points to another server (Correct answer)
- The entry has been deleted and a tombstone exists
Correct answer: The directory server does not hold the requested entry and points to another server
A referral (result code 10) tells the client that the target server does not have the requested data and provides a URL pointing to a server that may.
Question 4: Which replication topology model does Active Directory Sites and Services use by default to connect domain controllers?
- Full mesh
- Ring
- Hub and spoke
- KCC-generated spanning tree (Correct answer)
Correct answer: KCC-generated spanning tree
The Knowledge Consistency Checker (KCC) automatically generates a bidirectional ring/spanning-tree replication topology between domain controllers within and between sites.
Question 5: What does the 'tombstoneLifetime' attribute in Active Directory control?
- How long a user account remains disabled before deletion
- How long deleted objects are retained before being permanently purged (Correct answer)
- The maximum age of Kerberos tickets
- The time limit for password resets
Correct answer: How long deleted objects are retained before being permanently purged
Tombstone lifetime defines how long deleted objects remain in the directory (default 180 days) so replication can propagate deletions before the object is fully purged.
Question 6: Which LDAP operation is used to move an entry from one part of the directory tree to another?
- Modify
- ModifyDN (Correct answer)
- Move
- Rename
Correct answer: ModifyDN
The ModifyDN operation changes an entry's RDN or moves it to a new parent DN, effectively relocating it within the directory information tree.
Question 7: In Azure Active Directory, what is the function of 'Pass-through Authentication' (PTA)?
- Synchronizes password hashes to the cloud for authentication
- Validates user passwords directly against on-premises AD in real time (Correct answer)
- Federates authentication to a third-party identity provider
- Caches credentials locally on Azure AD Connect agents
Correct answer: Validates user passwords directly against on-premises AD in real time
PTA forwards sign-in requests to lightweight on-premises agents that validate the password directly against local AD without storing any credentials in Azure.
CIAM Directory Services 2
Which LDAP attribute is used to store the distinguished name of a group's members in Active Directory?