Which ports do the CyberArk Identity Connector require to be opened to support using Active...

The Identity Connector communicates with the CyberArk Identity tenant using outbound HTTPS (TCP 443). CyberArk states the connector’s internet connections are outbound and use TCP 80/443 (with 443 being the standard requirement).

For AD/LDAP authentication using LDAPS, the connector host must be able to reach the Domain Controller on TCP 636 (LDAPS).

Why the others are incorrect:

The Identity Connector design is outbound; you do not open inbound 443 from the tenant to the connector host (so D is wrong).

LDAPS traffic is between the connector host and the domain controller, not the CyberArk tenant directly to your DC (so C and E are wrong).