SY0-501 · Question #289
A security administrator is tasked with implementing centralized management of all network devices. Network administrators will be required to logon to network devices using their LDAP credentials…
The correct answer is B. CN=company, CN=com, OU=netadmin, DC=192.32.10.233. This question tests knowledge of centralized AAA (Authentication, Authorization, and Accounting) for network device management using directory services. The correct answer identifies the LDAP Distinguished Name (DN) format used to bind to an LDAP/Active Directory server for…
Question
A security administrator is tasked with implementing centralized management of all network devices. Network administrators will be required to logon to network devices using their LDAP credentials. All command executed by network administrators on network devices must fall within a preset list of authorized commands and must be logged to a central facility. Which of the following configuration commands should be implemented to enforce this requirement?
Options
- ALDAP server 10.55.199.3
- BCN=company, CN=com, OU=netadmin, DC=192.32.10.233
- CSYSLOG SERVER 172.16.23.50
- DTACAS server 192.168.1.100
How the community answered
(24 responses)- A13% (3)
- B75% (18)
- C8% (2)
- D4% (1)
Why each option
This question tests knowledge of centralized AAA (Authentication, Authorization, and Accounting) for network device management using directory services. The correct answer identifies the LDAP Distinguished Name (DN) format used to bind to an LDAP/Active Directory server for credential authentication.
While 'LDAP server 10.55.199.3' points to an LDAP server by IP address, it alone does not provide the directory binding path (Distinguished Name) needed to actually authenticate users against the LDAP directory structure.
The string 'CN=company, CN=com, OU=netadmin, DC=192.32.10.233' is an LDAP Distinguished Name (DN), which is the required syntax for specifying the directory path to authenticate users against an LDAP/Active Directory server. This DN format (using CN, OU, and DC attributes) is how network devices reference the LDAP directory to validate administrator credentials. Implementing this configuration ties device login authentication directly to the centralized LDAP credential store, satisfying the centralized management requirement.
A SYSLOG server handles log forwarding for command accounting but does not provide authentication or authorization of administrator credentials against LDAP, so it only partially addresses one requirement.
TACACS+ (note the answer contains a typo 'TACAS') is a valid AAA protocol for centralized device management, but the question specifically states LDAP credentials are required, and TACACS+ is a separate protocol that does not natively use LDAP DN syntax for directory binding.
Concept tested: LDAP Distinguished Name syntax for centralized AAA
Source: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/distinguished-names
Topics
Community Discussion
No community discussion yet for this question.