A library's LDAP configuration allows anonymous or overly broad read of sensitive directory attributes. What should the tester flag?
Select an answer to reveal the explanation.
Short Explanation
LDAP that talks too freely is like a receptionist who hands out employee files to anyone who asks. That disclosure greases recon and can leak sensitive attributes. Tighten who can read what.
Full Explanation
When a library’s LDAP configuration allows anonymous or overly broad read of sensitive directory attributes, the tester should flag excessive LDAP readability that aids reconnaissance and may leak sensitive attributes—directory information disclosure. Anonymous LDAP read is not required for every modern AD deployment and can often be restricted. Directory attribute exposure is not harmless; LDAP can reveal group and identity data useful to attackers. Broad LDAP read does not automatically enable BitLocker recovery and should not be praised as resilience. Exam caveat: information disclosure findings stand even without immediate privilege escalation. Operational check: test anonymous and authenticated read permissions from the approved segment under RoE, identify sensitive attributes exposed, recommend binding requirements and ACLs that least-privilege directory reads, and retest after library directory hardening. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.