CISSP Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Distinguished Name (DN)

  Why this is correct

  The Distinguished Name (DN) serves as the absolute and unambiguous identifier for every entry within an LDAP directory. It is a sequence of Relative Distinguished Names (RDNs) that traces a unique path from the root of the directory information tree (DIT) down to the specific entry. This hierarchical structure ensures that no two entries can possess the exact same DN, guaranteeing global uniqueness across the entire LDAP directory service.

• ✗

  Relative Distinguished Name (RDN)

  Why it's wrong here

  The Relative Distinguished Name (RDN) identifies an entry uniquely only within its immediate parent container in the LDAP directory tree. It consists of one or more attributes from the entry itself, such as cn=John Doe or uid=jdoe, and forms the most specific component of an entry's full Distinguished Name. While an RDN must be unique among its siblings, it is not globally unique across the entire directory, as the same RDN value can exist under different parent containers.

• ✗

  Organizational Unit (OU)

  Why it's wrong here

  An Organizational Unit (OU) is a structural object class in LDAP, primarily used as a container to organize other entries, such as users, groups, or other OUs, within a directory. While OUs help structure the directory information tree hierarchically and can be part of an entry's Distinguished Name, an OU itself is not an attribute that uniquely identifies a specific individual entry. It merely denotes a location or grouping within the directory.

• ✗

  Common Name (CN)

  Why it's wrong here

  The Common Name (CN) is a frequently used attribute within LDAP entries, often representing the most common or familiar name for an object, such as a person's full name or a device's hostname. While 'cn' is a common component of a Relative Distinguished Name (RDN) and thus part of a Distinguished Name, it is not inherently unique across the entire LDAP directory. Multiple entries in different organizational units or even within the same container (if the RDN uses other attributes) could share the same 'cn' value.

Go deeper

Related to this question