When deploying Kerberos and LDAP services for FusionlnsightHD products, what is the following description correct? (Multiple choices)

Option A is correct because Kerberos requires a backend database of principals (users and services) to function. When using LDAP for this purpose, the LDAP service must be deployed, configured, and populated before Kerberos can be configured to use it for authentication. This is a fundamental dependency in the deployment sequence.
Option D is correct because a primary advantage of directory services like LDAP is centralization. Huawei FusionInsight HD is designed to integrate into enterprise environments and explicitly supports connecting to an existing external LDAP or Active Directory server. This allows a single, central LDAP service to manage identities for multiple FusionInsight clusters and other applications, simplifying user management.

B. The word "must" makes this statement incorrect. While co-locating services is one deployment option, FusionInsight fully supports connecting to an LDAP service running on a different node or an external corporate directory.
C. This statement describes a benefit of co-location, but it's not a universally required or always optimal deployment strategy. In high-availability or large-scale environments, services might be separated for resilience and load distribution.

1. Huawei FusionInsight HD 6.5.1 Administrator Guide: In the section "Security Management > Interconnecting to an LDAP Server," the guide outlines the prerequisites. It states that before configuration, "The LDAP server has been installed and started, and the user and group information to be synchronized has been configured." This confirms the dependency stated in option A.

2. Huawei FusionInsight HD 6.5.1 Administrator Guide: The existence of the entire chapter "Interconnecting to an LDAP Server" demonstrates the platform's capability to connect to an external, and therefore potentially shared, directory service. This supports the architectural capability described in option D. The guide details steps to connect to existing enterprise directories, which by definition are shared resources.

3. Huawei FusionInsight HD Product Documentation: In sections describing security architecture and deployment planning, the documentation presents connecting to an existing enterprise directory as a standard option. This flexibility invalidates the strict requirement in option B and shows that the performance benefit in option C is just one factor in a larger set of architectural decisions.