CompTIA Server+ SK0-005 Practice Question

While deploying a SAML identity-provider appliance in a screened subnet, you bind the device to a domain controller on TCP port 389 so it can query Active Directory for user authentication. The domain join succeeds, but only users from the controller's own domain can log on; accounts that live in other domains of the same forest are not found. Firewall logs confirm that traffic on ports 389, 53 and 88 is allowed. To enable the appliance to perform forest-wide LDAP searches without opening SMB or RPC services, which single destination port should you ask the security team to allow through the firewall?