CIAM Directory Services 3 — Questions and Answers
Question 1: What is the default port for LDAPS (LDAP over SSL/TLS)?
- 389
- 636 (Correct answer)
- 3268
- 3269
Correct answer: 636
LDAPS uses TCP port 636 for standard domain connections, while port 3269 is used for LDAPS connections to the Global Catalog.
Question 2: Which feature in Active Directory allows administrators to recover accidentally deleted objects without restoring from backup?
- Shadow Copies
- Active Directory Recycle Bin (Correct answer)
- System State Restore
- Authoritative Restore
Correct answer: Active Directory Recycle Bin
The AD Recycle Bin, introduced in Windows Server 2008 R2, preserves deleted objects with all their attributes intact, allowing restoration through PowerShell or the ADAC.
Question 3: In LDAP, what does the 'scope' parameter 'subtree' mean in a search operation?
- Search only the base entry specified
- Search the base entry and its immediate children only
- Search the base entry and all entries in the subtree below it (Correct answer)
- Search all entries in the directory regardless of base
Correct answer: Search the base entry and all entries in the subtree below it
A subtree search returns the base entry and all entries in the entire subtree beneath it, which is the broadest search scope available.
Question 4: What is 'schema' in the context of directory services?
- The hierarchical structure of organizational units in the directory
- The formal definition of object classes and attribute types the directory can store (Correct answer)
- The set of access control policies applied to directory objects
- The replication agreement between domain controllers
Correct answer: The formal definition of object classes and attribute types the directory can store
The schema defines the rules for what types of objects can exist, what attributes they can have, and what data types those attributes hold.
Question 5: Which protocol does Azure AD Connect use to synchronize identities from on-premises Active Directory to Azure AD?
- SAML 2.0
- OAuth 2.0
- Microsoft Identity Integration Server protocol with AAD Sync rules (Correct answer)
- SCIM 2.0
Correct answer: Microsoft Identity Integration Server protocol with AAD Sync rules
Azure AD Connect uses its own synchronization engine with configurable sync rules to replicate objects from on-premises AD to Azure AD via the Microsoft sync protocol.
Question 6: What is the purpose of an 'Organizational Unit' (OU) in Active Directory?
- To separate domains within a forest
- To group objects for the application of Group Policy and delegation of administrative control (Correct answer)
- To create trust relationships between forests
- To partition the directory for replication efficiency
Correct answer: To group objects for the application of Group Policy and delegation of administrative control
OUs are containers used to organize directory objects and are the smallest scope at which Group Policy can be linked and administrative permissions can be delegated.
Question 7: In a directory service context, what is 'federation' with an external IdP primarily used for?
- Synchronizing directory objects between two domains
- Allowing users from an external organization to authenticate using their own identity provider (Correct answer)
- Replicating schema changes across forests
- Providing offline access to directory resources
Correct answer: Allowing users from an external organization to authenticate using their own identity provider
Directory federation enables cross-organizational single sign-on by establishing trust so that an external IdP can assert authenticated user identities to local services.
CIAM Directory Services 3
What is the default port for LDAPS (LDAP over SSL/TLS)?