A school-district AirWatch Cloud Connector can no longer bind to Active Directory after a new host firewall is applied. Which rule restores directory integration securely?
Select an answer to reveal the explanation.
Short Explanation
The connector only needs a secure handshake with the directory, not a walk through every classroom subnet. LDAPS to the domain controllers is the path; open LDAP to the whole campus is not.
Full Explanation
When a school-district AirWatch Cloud Connector can no longer bind to Active Directory after a host firewall change, restore directory integration by allowing LDAPS from the ACC host to domain controllers only—not LDAP 389 from ACC to the whole campus. The connector needs a secure handshake with the directory, not a walk through every classroom subnet. Allowing LDAP 389 from ACC to every campus subnet fails by concept because it uses clear-text bind broadly and treats the entire campus as a domain-controller search domain. Disabling the ACC host firewall and relying on the campus core ACL fails because host hardening on ACC is part of connector security posture, not optional when a core ACL exists. Opening SMB from ACC to all file servers so it can read user home folders fails because SMB is unrelated to directory bind and expands lateral access. Exam caveat: ACC directory integration is LDAPS to DCs; campus-wide LDAP, firewall-off, and SMB are wrong control planes. Operational check: from ACC, bind successfully over LDAPS to designated DCs, confirm LDAP 389 campus-wide remains blocked, and verify SMB to file servers was not opened for directory reasons. List DC addresses in the district ACC firewall standard so the next hardening pass does not break enrollment bind again.