CISSP Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  An entry in the directory

  Why this is correct

  The Distinguished Name (DN) serves as the unique identifier for every individual entry within an LDAP directory. It specifies the exact, unambiguous path from the root of the Directory Information Tree (DIT) down to that specific entry, composed of a sequence of Relative Distinguished Names (RDNs). This hierarchical naming ensures that no two entries can share the same DN, guaranteeing absolute uniqueness across the entire directory and enabling precise referencing for all operations.

• ✗

  The root of the directory

  Why it's wrong here

  While the root of the directory, often referred to as the Root DSE (Directory Service Agent Specific Entry), is indeed an entry, the Distinguished Name (DN) is not exclusively for it. The Root DSE itself has a DN (often a null string or a specific base DN), but the fundamental purpose of a DN is to uniquely identify *any* entry, regardless of its position or special status within the Directory Information Tree (DIT). Therefore, identifying only the root is too narrow a scope for the DN's universal identification function.

• ✗

  The schema of the directory

  Why it's wrong here

  The schema defines the structural rules and constraints for an LDAP directory, specifying what types of entries can exist, what attributes they can possess, and the syntax for those attributes. It dictates the permissible object classes and attribute types, essentially providing the blueprint for the directory's content and ensuring data consistency. However, the schema does not identify specific data instances or entries; rather, it governs their creation and validity, making it distinct from the unique identification function of a DN.

• ✗

  A group within the directory

  Why it's wrong here

  A group is merely one specific type of entry within an LDAP directory, typically defined by an objectClass like 'groupOfNames' or 'groupOfUniqueNames'. While every group, as an entry, possesses a unique Distinguished Name (DN) to identify it, the DN's function is not limited to groups. It universally identifies any entry, whether it's a user, a computer, an organizational unit, or any other object stored in the directory, making this option too restrictive and not representative of the DN's broader purpose.

Go deeper

Related to this question