Configure LDAP CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After configuring LDAP for a new SVM, the administrator runs 'vserver services name-service ldap test' and receives an error indicating that the LDAP server is unreachable. The administrator has verified that the server address is correct and that the SVM's LIFs have network connectivity to the LDAP server. What should the administrator check next?

   • AEnsure that the bind credentials are correct.
   • BDisable LDAP referral chasing.
   • CVerify that the LDAP server is listening on the configured port and that no firewall is blocking the connection.
   • DCheck the LDAP schema mapping for correctness.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security auditor requires that all LDAP communications between ONTAP and the company's OpenLDAP servers be encrypted using TLS. The OpenLDAP servers use self-signed certificates. The storage administrator needs to configure the LDAP client in ONTAP to trust these certificates. What is the correct procedure?

   • ADisable certificate validation in the LDAP client security settings to allow the self-signed certificate to be accepted.
   • BConvert the self-signed certificates to a public CA-signed certificate before configuring ONTAP.
   • CInstall the self-signed CA certificate on each ONTAP node in the cluster and configure the LDAP client to use port 636 with certificate validation enabled.
   • DUse port 389 with StartTLS and do not configure any certificates, as StartTLS does not require certificate validation.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large enterprise has ONTAP clusters in multiple regions. The LDAP infrastructure uses a global catalog that returns referrals to regional LDAP servers. The storage team has enabled LDAP referral chasing on all clusters. However, users in one region report that authentication is slow and sometimes times out. The LDAP client configuration points to the global catalog server. What is the most likely cause of the performance issue?

   • AThe bind credentials are being rejected, causing repeated authentication attempts.
   • BThe referral chasing is causing ONTAP to make multiple round trips to regional servers, increasing latency.
   • CThe LDAP schema mapping is incorrect, causing ONTAP to perform additional queries.
   • DThe LDAP server address is incorrect, causing ONTAP to retry connections.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization uses a custom LDAP directory (not Active Directory) for user authentication to ONTAP. The directory stores user IDs in the 'uid' attribute and group memberships in the 'memberOf' attribute. The storage team has created an LDAP client configuration, but authentication fails. The 'vserver services name-service ldap show' command shows the configuration is active. What is the most likely cause of the authentication failure?

   • AThe LDAP referral chasing is disabled.
   • BThe LDAP schema mapping is not configured to map 'uid' to the ONTAP user name attribute and 'memberOf' to the group attribute.
   • CThe LDAP server port is set to 389 instead of 636.
   • DThe bind credentials are using the wrong password.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is migrating from a legacy NIS environment to LDAP for user authentication on ONTAP. The LDAP server is a custom directory that does not support LDAPS but does support StartTLS. The security team requires encrypted LDAP traffic. The storage team has configured the LDAP client with port 389 and enabled StartTLS. However, the 'vserver services name-service ldap test' command fails with a certificate validation error. The LDAP server uses a self-signed certificate. What should the administrator do to resolve the issue while maintaining security?

   • ASwitch to LDAPS on port 636, even though the server does not support it.
   • BUse a different LDAP server that supports LDAPS.
   • CDisable certificate validation in the LDAP client security settings to allow the connection.
   • DInstall the self-signed certificate on each ONTAP node and configure the LDAP client to trust it.
   Reveal Solution Discussion Select an answer first