What does LDAP stand for?
LDAP stands for Lightweight Directory Access Protocol. A protocol for querying and changing directory services such as Active Directory. LDAPS protects it with TLS.
LDAP is the protocol clients use to search and update a directory: a tree of entries such as users, groups and computers. It listens on TCP 389. Sent in the clear it exposes credentials, so it is protected either with LDAPS on TCP 636 or with StartTLS on the standard port. The current version, LDAPv3, is defined in RFC 4511.
LDAP in practice: an example
A VPN gateway needs to know whether a user belongs to the Remote-Staff group. It binds to the directory with a service account, searches for the user's entry and reads the group membership. The same lookup against Active Directory works because Active Directory speaks LDAP.
What LDAP is confused with
LDAP vs Active Directory: what is the difference?
Active Directory is a directory service, a product. LDAP is one of the protocols used to talk to it. You query Active Directory using LDAP.
LDAP vs RADIUS: what is the difference?
LDAP reads and writes directory data. RADIUS carries authentication requests from network devices; the RADIUS server often checks the credentials against an LDAP directory. What RADIUS stands for
Which exams cover LDAP?
LDAP is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 4.5 (Security Operations).
- Network+ N10-009: 1.0 (Networking Concepts); 4.0 (Network Security).
- A+ 220-1201 and 220-1202: 220-1201 2.0 (Networking).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. An application sends directory queries, including a bind password, across the network unencrypted on TCP 389. What is the standard fix?
- Move the service to UDP 53
- Use LDAPS on TCP 636 or StartTLS
- Disable the directory
- Change the bind account name
Show the answer
B. Use LDAPS on TCP 636 or StartTLS. LDAP over TLS protects the bind credentials and the query results. Renaming the account does nothing for data sent in the clear.
2. Which statement is correct?
- LDAP is a directory product sold by Microsoft
- LDAP is a protocol for accessing directory services
- LDAP replaces DNS
- LDAP only works on wireless networks
Show the answer
B. LDAP is a protocol for accessing directory services. LDAP is a vendor-neutral protocol. Directory products such as Active Directory implement it.
Sources: RFC 4511: Lightweight Directory Access Protocol (LDAP): The Protocol; NIST glossary: LDAP. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.