Directory Services and LDAP Quiz

1.What is a directory server, and what is it optimized for?

• A transactional database optimized for frequent writes
• A system that stores information about network objects and is optimized for hierarchical lookups
• A dedicated server that only stores user passwords
• A caching layer that sits in front of a real database

2.How does LDAP relate to Active Directory?

• LDAP and Active Directory are the same thing, just two names for one system
• LDAP is the protocol clients use to talk to a directory server; AD is one implementation of a directory server that speaks it
• LDAP is a feature that only exists inside Active Directory
• Active Directory is the protocol, and LDAP is Microsoft's product that implements it

3.What does an LDAP bind operation actually establish?

• Which attributes a subsequent search query will return
• The authentication state of the session, before any query is honored
• The TCP port the LDAP session will use for the rest of the connection
• Whether the domain controller is reachable on the network

4.What is the key difference between a simple bind and a SASL bind?

• A simple bind uses TCP and a SASL bind uses UDP
• A simple bind sends a username and password directly to the server; a SASL bind delegates authentication to another mechanism, most often Kerberos
• A simple bind can only ever be anonymous
• SASL binds are an older, deprecated version of simple binds

5.Why does a plain LDAP bind on port 389 pose a security risk?

• Because port 389 is always blocked by default on domain controllers
• Because a simple bind sends the username and password in cleartext unless the connection is upgraded to LDAPS or protected with StartTLS
• Because port 389 only accepts anonymous binds
• Because LDAP on port 389 cannot process search requests, only binds

6.Why can a tool like BloodHound enumerate a domain using a low-privileged account, with no exploit involved?

• Because BloodHound exploits a vulnerability in the LDAP protocol itself
• Because any authenticated domain user can bind and query most of the directory by default
• Because BloodHound requires domain administrator credentials to run
• Because anonymous LDAP binds are enabled on every domain controller by default