Exam SK0-005 topic 1 question 65 discussion

I think the answer C was a typo 636 is the secure port for LDAP and would be correct, however given the options, A is correct

Port 389 is commonly associated with LDAP (Lightweight Directory Access Protocol), which is used for directory services. Since the web server should not be conducting LDAP-related activities, it's concerning that outbound traffic is being observed on this port. To harden the server and ensure that it's not misused for unintended purposes, the best approach would be to: A. Disable port 389 on the server.

aaaaaaaaaaaa

OS Hardening Hardening the server should start with hardening the operating system. This involves a series of steps that should result in a server that offers a minimum of attack points to a hacker. Let's look at six steps that can lead to this result. Disable Unused Services/Close Unneeded Ports Any services that are not required on the server should be disabled. Only those required for the server to perform its role in the network should be left on. The easiest way to do this is to install a host firewall on the system and adopt a “disable by default” policy with respect to services by closing the port used for the service. Then manually enable any you need. Ref. CompTIA Server+ Study Guide: Exam SK0-005 Troy McMillan

We all want to give the test the answer it wants but if you discover a server handling traffic that is outside of its scope of operation, you need to shut down the offending port ASAP. Complete security scans and try to find out what the nature of that traffic was.

This is solely a web server so should be ports for HTTPS. There should not be any traffic leaving the server on 389externally and its LDAP traffic so definitely a concern. Port 389 can be disabled. Not to mention LDAPS would be 636 not 637. http://ports.my-addr.com/tcp_port-udp_port-application-and-description.php?port=637

For this, sense this only needs web traffic hosted, only port 80 & 443 need to be open, port 389 can be closed... I would just disable it. The better answer would be a more specific firewall rule set, but given the options, I would choose A.

A or C??