Cisco ISE can use an LDAP directory as an external identity source, and the connection settings cover the port, the bind account and the directory search base. For a directory of 400,000 entries in which only the workforce subtree holds employees, which LDAP connection design delivers encrypted binding, read-only access and a search scope limited to workforce entries?
Select an answer to reveal the explanation.
Short Explanation
Use LDAPS on port 636 with a read-only bind account to encrypt the connection and prevent changes. Set the search base to the workforce subtree, like checking one folder instead of the whole directory.
Full Explanation
The configuration fits because each requirement maps to a separate setting. LDAPS on port 636 encrypts the LDAP connection, including the bind and search traffic; ISE must trust the certificate chain presented by the LDAP server for the TLS handshake to succeed. A dedicated account with read-only directory permissions limits what ISE can do if the account is misused. Setting the search base to the workforce subtree limits the portion of the directory searched. The actual lookup performance also depends on the directory structure, indexes and query. Binding as a directory administrator does not meet the read-only requirement if that account has write permissions. Simple bind on port 389 without TLS does not encrypt the connection. Searching from the directory root uses a broader search base and may involve more entries, although performance depends on the directory and its configuration. Attribute names differ between directory schemas, so confirm that the login attribute ISE uses matches the one your directory publishes. Test authentication and check the live log to confirm that the user search resolves from the workforce branch.