Identity Threat Detection and Response focuses on identity risk, particularly in directory environments such as Active Directory. To evaluate AD objects, relationships, permissions, and risky identity configura tions, ITDR needs directory-level data rather than raw packet captures or firewall summaries. Option B (Running LDAP queries) is correct because LDAP queries are the standard mechanism for collecting structured AD domain information for identity-risk analysis.
Why the other options are incorrect:
A. Scanning network ports: Port scanning discovers open TCP/UDP services on hosts. ITDR needs AD identity data, so it queries the directory instead of scanning network sockets.
C. Analyzing firewall logs: Firewall logs show network sessions and policy outcomes. They do not expose AD object relationships, permissions, or identity hygiene the way LDAP directory queries do.
D. Packet sniffing: Packet sniffing captures traffic on the wire. ITDR is not passively sniffing packets here; it gathers structured domain information from Active Directory.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit