The IT administrator for a large university uses an LDAP directory service to manage user access to vario To ensure the directory's security, which of the following measures should the administrator implement? Implement Simple Bind with plaintext transmission of distinguished name and password. Set up LDAP Secure (LDAPS) with a digital certificate on port 636 for secure user credential exchan Use the basic LDAP protocol without any additional security mechanisms. Allow anonymous access to the directory for easy user onboarding.

To ensure the security of the LDAP directory service, the IT administrator should implement measures that protect user credentials and data from unauthorized access and potential interception. Let's evaluate each of the provided options: 1. **Implement Simple Bind with plaintext transmission of distinguished name and password.** - **Security Risk:** Simple Bind transmits credentials in plaintext, making them susceptible to interception and unauthorized access. This method is insecure, especially over untrusted networks. 2. **Set up LDAP Secure (LDAPS) with a digital certificate on port 636 for secure user credential exchange.** - **Security Advantage:** LDAPS encrypts the entire LDAP communication using SSL/TLS, ensuring that credentials and data are securely transmitted. Using a digital certificate adds an additional layer of trust and verification, protecting against man-in-the-middle attacks. 3. **Use the basic LDAP protocol without any additional security mechanisms.** - **Security Risk:** Basic LDAP does not provide encryption or authentication mechanisms beyond simple checks, leaving data and credentials exposed to potential threats. 4. **Allow anonymous access to the directory for easy user onboarding.** - **Security Risk:** Allowing anonymous access can expose sensitive directory information to unauthorized users, increasing the risk of data breaches and misuse. **Best Practice:** The most secure and recommended approach is **Option 2**. By setting up LDAPS with a digital certificate on port 636, the administrator ensures that all LDAP communications are encrypted and authenticated, significantly enhancing the directory's security. **Final Recommendation:** **Set up LDAP Secure (LDAPS) with a digital certificate on port 636 for secure user credential exchange.**