Securing LDAP Against Anonymous Queries with NTLM
Which of the following protocols can be used to secure an LDAP service against anonymous queries?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests knowledge of authentication protocols used in Windows environments, specifically distinguishing between those that can enforce identity for directory services versus those that cannot.
NTLM is the correct protocol for securing LDAP services against anonymous queries by enforcing authentication. This page explains how NTLM integrates with directory services to prevent unauthenticated access.
Candidates often select RADIUS or SSO because they are authentication-related, failing to recognize the specific context of Windows Active Directory and LDAP integration where NTLM (or Kerberos) is the native mechanism.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
NTLM (NT LAN Manager) is an authentication protocol used in Microsoft Windows networks. In the context of Active Directory, which uses LDAP as its directory service interface, NTLM (along with Kerberos) provides the mechanism for users to authenticate. By requiring NTLM authentication, the LDAP server ensures that clients must identify themselves before performing queries, effectively blocking anonymous binds or queries.Why the Other Options Are Wrong
RADIUS is a network protocol for remote dial-up and wireless network access; it does not natively secure LDAP queries within a Windows domain environment. WPA is a security standard for wireless networks (Wi-Fi) and has no role in authenticating directory service queries. SSO (Single Sign-On) is a concept or architecture allowing users to log in once, not a specific protocol that secures the LDAP transport itself.Community Comment Notes
The community consensus strongly favors NTLM, noting that it enforces authentication requirements on LDAP servers. As user pindinga1 noted, "By enabling NTLM... anonymous queries can be prevented." Users correctly identify that while LDAP itself supports anonymous binds by default, enabling NTLM authentication negates this capability for authenticated sessions.Exam Strategy
Focus on understanding the specific authentication protocols associated with major directory services. For Microsoft Active Directory, remember Kerberos and NTLM as the primary authentication mechanisms for LDAP.
Frequently Asked Questions
Can LDAP work without any authentication?
Yes, LDAP supports anonymous binds by default, but this allows anyone to query the directory. Authentication protocols like NTLM or Kerberos are needed to restrict this.
Why isn't RADIUS used to secure LDAP?
RADIUS is primarily for network access control (like Wi-Fi or VPN), whereas NTLM/Kerberos are native to the Windows domain environment where LDAP resides.