In a compromised Active Directory environment, which port and tool combination is typically used to interrogate LDAP on a Domain Controller?

In a compromised Active Directory environment, which port and tool combination is typically used to interrogate LDAP on a Domain Controller?

• A. 22 and PuTTY
• B. 389 and ldp.exe
• C. 443 and curl
• D. 53 and dig

Answer: (B)

LDAP interrogation on a Domain Controller uses the LDAP protocol over port 389, and a built-in Windows LDAP client like ldp.exe is typically used to connect, bind with credentials, and run searches to enumerate AD objects such as users, groups, and their attributes. This pairing is common in compromised AD environments because it provides direct access to the directory data you want to map and extract. Other options don’t fit because SSH on port 22 with PuTTY is for remote shell access, not LDAP; HTTPS on port 443 with curl targets web services, not directory data; and DNS on port 53 with dig is for name resolution, not querying AD objects. LDAPS on port 636 exists, but the standard, unencrypted LDAP path on 389 with a tool like ldp.exe is the typical method for interrogation.

LDAP interrogation on a Domain Controller uses the LDAP protocol over port 389, and a built-in Windows LDAP client like ldp.exe is typically used to connect, bind with credentials, and run searches to enumerate AD objects such as users, groups, and their attributes. This pairing is common in compromised AD environments because it provides direct access to the directory data you want to map and extract. Other options don’t fit because SSH on port 22 with PuTTY is for remote shell access, not LDAP; HTTPS on port 443 with curl targets web services, not directory data; and DNS on port 53 with dig is for name resolution, not querying AD objects. LDAPS on port 636 exists, but the standard, unencrypted LDAP path on 389 with a tool like ldp.exe is the typical method for interrogation.