Examkin

Question

Difficulty: Very hardCommon Ports and Protocols

An enterprise network administrator is troubleshooting directory service integration between an internal web proxy and an Active Directory Domain Controller. Authentication using implicit SSL encryption (LDAPS) over TCP port 636 functions correctly. However, automated directory synchronization tasks configured on the proxy to use explicit TLS encryption (STARTTLS) fail to establish a secure connection. Network packet captures confirm that the proxy initiates communication over the default unencrypted LDAP port before issuing the STARTTLS upgrade command, but traffic is blocked by an intermediate firewall ACL. Which of the following transport protocols and destination port combinations must be permitted on the firewall to allow STARTTLS directory synchronization to succeed?

  1. TCP port 389Answer
  2. B
    UDP port 389
  3. C
    TCP port 636
  4. D
    TCP port 3269

Answer

TCP port 389
Explicit TLS (STARTTLS) allows a client to establish an initial connection over the standard unencrypted port (TCP port 389 for LDAP) and issue a command to upgrade the active channel to TLS encryption. For STARTTLS negotiation to succeed, the firewall ACL must permit TCP port 389.

Step-by-Step Solution

1
Analyze the protocol handshake mechanism for explicit TLS (STARTTLS).
Recognize that STARTTLS is an explicit security extension that begins session negotiation over the default unencrypted service port before initiating a TLS upgrade.
Explicit TLS requires initial access to the unencrypted service port to send the protocol upgrade request.
2
Identify the standard port number associated with unencrypted directory services.
Determine that standard LDAP operates on port 389.
Lightweight Directory Access Protocol (LDAP) uses port 389 as its standard listener port.
3
Evaluate transport layer requirements for TLS session negotiation.
Select TCP over UDP for session state establishment.
TLS state handshakes and data integrity enforcement require the connection-oriented reliability offered by TCP.

Key Concept

Explicit TLS (STARTTLS) vs Implicit TLS Port Behavior
Rate this question

Topics

Common Ports and Protocols

More questions from this topic