To monitor the authentication service of an Active Directory Domain Controller, which type of NetScaler monitor should be used?

• A. The TCP monitor with the LDAP Base DN parameters configured in the Special Parameters.
• B. A custom LDAP monitor with the LDAP Script Name, Base DN, Bind DN, Filter, Attribute and Password parameters configured in the Special Parameters.
• C. The Ping monitor with the Active Directory Domain Controller in the Special Parameters.
• D. The RADIUS monitor with the Base DN, Bind DN, Filter, Attribute and Password parameters configured in the Special Parameters.

Answer: (B)

Monitoring Active Directory authentication on NetScaler requires an LDAP-based check that actually performs an LDAP bind and a search against AD. A simple TCP probe only tests connectivity to the port and cannot verify that LDAP operations or authentication work. The Ping option checks reachability, not the service itself, and a RADIUS monitor targets a different protocol altogether.

A custom LDAP monitor is designed for this scenario. By configuring the LDAP Script Name, Base DN, Bind DN, Filter, Attribute, and Password in the Special Parameters, the monitor can log in to AD using a service account (Bind DN and Password), search within the directory (Base DN with the Filter), and verify that the expected data is returned (Attribute). This confirms that the authentication service is functioning as AD expects, not just that the server is reachable.