What is LDAP (Lightweight Directory Access Protocol), which port does it use, and what is the security implication of using LDAP vs. LDAPS?

• A.LDAP uses TCP port 389 with built-in AES encryption; LDAPS on 636 provides an additional layer of encryption.
• B.LDAP uses TCP (and UDP) port 389 for directory service queries (user authentication, group lookups, attribute queries against Active Directory or OpenLDAP). LDAPS (LDAP over TLS) uses TCP port 636. Without TLS, LDAP credentials and directory data are transmitted in cleartext - a significant risk in environments where network sniffing is possible. LDAPS or LDAP STARTTLS (also port 389 with the STARTTLS extension) should be used for all authentication traffic.
• C.LDAP uses UDP port 389 for all queries; TCP 389 is only used for LDAP connection-oriented session management.
• D.LDAPS on port 636 uses self-signed certificates by default and provides no stronger security than LDAP on 389.