156-215.81.20 Identity Awareness — 15 Questions

Question 1

Which TWO of the following statements accurately describe the functionality of the Identity Awareness 'Identity Collector'?

Accepted Answer

It communicates with Active Directory to retrieve identity information.. The Identity Collector is a dedicated software component that enhances performance by offloading identity acquisition from the Security Gateway. It retrieves identity data from various sources like Active Directory or Cisco ISE and pushes this information to the Gateway. This architecture is vital for large-scale environments where high traffic loads on the gateway would otherwise be negatively impacted by intensive identity polling operations and external communication overhead.

Answer

It must be installed directly on the Security Gateway.

Answer

It eliminates the need for any Identity Awareness configuration on the Gateway.

Answer

It only supports integration with Microsoft Active Directory.

Question 2

Which THREE of the following are valid Identity Awareness 'Identity Sources' that can be used to identify users?

Accepted Answer

Active Directory Query. Check Point Identity Awareness supports multiple sources to ensure flexibility in diverse network architectures. By combining sources, administrators can create a robust identity-based security strategy. These sources allow the firewall to map IP addresses to specific users, enabling granular security policies that are context-aware and adaptive to the changing needs of the business, regardless of whether the users are on managed or unmanaged endpoints.

Answer

External Database via SQL connection

Answer

SNMP Traps from Switches

Question 3

An administrator notices that some users are identified correctly while others show as 'unknown'. What is the most likely reason for this discrepancy in an Identity Awareness environment using AD Query?

Accepted Answer

The gateway cannot read logs for these specific IP addresses.. The 'unknown' status typically occurs when the Identity Awareness mechanism cannot successfully map a specific IP address to a user. This often happens if the user is not logging into the domain, or if the traffic is originating from a source that is not covered by the defined AD Query configuration, such as a segment without domain-joined machines or restricted access to logs.

Answer

The Identity Awareness blade is not installed.

Answer

The users are using a proxy server.

Answer

The Security Gateway is overloaded.

Question 4

Refer to the exhibit. An administrator receives this error on a client machine. Which configuration error on the gateway is the most likely cause?

Accepted Answer

The gateway identity certificate is invalid.. This error signifies that the client-side Identity Agent cannot establish a handshake with the Security Gateway. The most common cause is that the 'Identity Awareness' blade is not configured to accept traffic on the required ports (typically 443/80 for captive portal or custom ports for agents) or that the gateway's IP address/certificate is not trusted by the client agent. Proper configuration of the gateway's identity settings is essential for this communication.

Answer

The user is not in the AD group.

Answer

The user password has expired.

Answer

The agent is too old.

Question 5

When designing an Identity Awareness deployment utilizing Terminal Servers, an administrator must select the appropriate tracking mechanisms to ensure accurate user identification. Which TWO mechanisms are natively supported by Check Point Identity Awareness for Terminal Server environments? (Choose two)

Accepted Answer

Identity Agent for Terminal Servers utilizing port allocation algorithms.. Terminal Servers share a single IP address among multiple concurrent users, requiring specialized tracking mechanisms to differentiate traffic. Check Point natively supports Identity Agent for Terminal Servers and RADIUS Accounting to map port ranges and user sessions correctly, preventing attribution errors in multi-user environments.

Answer

Browser-based Captive Portal authentication for every outgoing HTTP request.

Answer

Active Directory Query polling of security event logs for user logon sessions.

Answer

Transparent Kerberos ticket inspection directly at the firewall kernel level.

Question 6

An administrator notices that Active Directory Query is failing to resolve user identities for a newly established subnet of workstations. The Security Gateway and Domain Controllers can communicate via ICMP, but queries fail. Which TWO troubleshooting steps should the administrator perform to resolve this issue? (Choose two)

Accepted Answer

Verify that TCP ports 135, 445, and ephemeral ports are allowed between the gateway and Domain Controllers.. AD Query relies on proper RPC, SMB, and WMI communication channels between the Security Gateway and Domain Controllers. Verifying firewall rules, network routing, and specific service permissions ensures that the gateway can successfully poll security logs without being blocked by intermediate network security controls.

Answer

Check that the Identity Agent executable is running on every workstation in the new subnet.

Answer

Reconfigure the Captive Portal redirection port from HTTP 80 to HTTPS 443.

Answer

Disable Kerberos ticket decryption on the gateway to force NTLM fallback authentication.

Question 7

Which Identity Awareness method is best suited for an environment where users utilize non-domain joined devices and require seamless authentication without client software?

Accepted Answer

Captive Portal. Captive Portal is the optimal solution here because it intercepts web traffic and prompts users for credentials via a browser, independent of the underlying OS or domain status. This method allows administrators to enforce identity-based security policies for guests or BYOD users, ensuring that security perimeters are maintained even when traditional Active Directory integration via Identity Agent or AD Query is not feasible for the endpoint.

Answer

Identity Agent

Answer

AD Query

Answer

Browser-Based Authentication (WIA)

Question 8

An administrator notices that Identity Awareness is not correctly identifying users from a specific subnet. The gateway is configured with AD Query. Which log source should the administrator check to verify the gateway is receiving successful login events?

Accepted Answer

Domain Controller Security logs. The Identity Awareness gateway uses the Security Event Logs on the Domain Controllers to map identities. By verifying these logs, the administrator can confirm if the AD Query collector is successfully reaching the domain controller and parsing relevant logon events (Event ID 4624/4768). If these logs are missing or encrypted, the gateway cannot associate the user identity with the source IP address, resulting in failed identity identification.

Answer

Gateway Kernel logs

Answer

Identity Agent debug logs

Answer

SmartDashboard audit logs

Question 9

Which TWO of the following are prerequisites for configuring Identity Awareness with AD Query?

Accepted Answer

Configure a service account with Read access to Security Event logs.. To implement AD Query, the gateway must have a clear network path to the Domain Controllers to read logs, and the account used for this query must have sufficient privileges. AD Query is a passive method, so it does not require client-side agents, but it does require that the Active Directory environment is healthy and that logs are generated and accessible to the Security Gateway's Identity Collector service.

Answer

Install Identity Agent on all clients.

Answer

Ensure WMI is enabled on all endpoints.

Answer

Configure DNS for all user segments.

Question 10

Which THREE of the following are valid Identity Awareness sources for identifying users?

Accepted Answer

AD Query. Check Point Identity Awareness supports multiple sources to map an IP address to a user identity. These sources are prioritized by the gateway. Administrators must select the appropriate sources based on their network architecture, such as using AD Query for passive collection or Identity Agents for active endpoint verification, or even integrating with third-party identity providers to build a comprehensive security policy.

Answer

IP-to-MAC Binding

Answer

SNMP Traps

Question 11

Which object type should an administrator use in a Firewall rule to restrict access based on Active Directory group membership?

Accepted Answer

Access Role Object. When using Identity Awareness, you can drag and drop objects directly from the 'User Directory' node in the SmartConsole into the source field of an Access Control policy rule. These objects represent Active Directory groups. Using them allows the firewall to perform identity-based filtering, ensuring that only authenticated users belonging to the authorized group can access specific network resources defined in the destination.

Answer

Network Object

Answer

Host Object

Answer

Service Object

Question 12

A security administrator has deployed a single Security Gateway running R81.20 with Identity Awareness configured to use the Terminal Server Agent method. Users authenticate to a Citrix XenApp terminal server, which then reports their identities to the Gateway. After several weeks in production, the administrator notices that user-to-IP mappings remain valid long after users disconnect, causing stale identities to be matched against firewall rules. The administrator verifies that the Terminal Server Agent is running and heartbeating normally, and that the Gateway is receiving updates. What is the MOST likely cause of the stale identity mappings?

Accepted Answer

The Identity Awareness session timeout for Terminal Server Agent identities is set to a large value, and the Gateway relies on that timeout rather than the agent's disconnect notification to expire the mapping.. Stale Terminal Server Agent identities typically stem from the Identity Awareness session timeout being too generous. The Gateway expires agent-reported identities based on that timeout rather than immediately acting on a disconnect event, so a high value keeps mappings alive after users log off. Lowering the timeout restores accurate identity matching and prevents firewall rules from being evaluated against disconnected users.

Answer

The Gateway's Identity Awareness blade is configured with Active Directory Query as a secondary method, and AD Query results are overwriting the Terminal Server Agent mappings with outdated data.

Answer

The Terminal Server Agent is installed on the Gateway itself instead of on the terminal server, so it cannot detect user logoff events and therefore never signals the Gateway to remove the identity.

Answer

The Terminal Server Agent communicates with the Gateway over port 443, but the Gateway's identity sessions are only refreshed when the user performs a new logon; disconnection events are not transmitted by default.

Question 13

A security administrator manages a Check Point R81.20 Security Gateway that enforces identity-based rules for users in an Active Directory domain. The organization wants to avoid installing any software on user computers and does not want to deploy a separate Identity Collector. Which Identity Awareness method should the administrator configure on the Security Gateway?

Accepted Answer

Identity Awareness using the Security Gateway's membership in the Active Directory domain. The correct answer is to configure Identity Awareness using the Security Gateway's membership in the Active Directory domain. This method allows the gateway to read Windows Security event logs directly from domain controllers using its own domain computer account, requiring no endpoint agents and no separate Identity Collector. It is a native Check Point feature that simplifies deployment in environments where the gateway can be joined to the domain.

Answer

Identity Agents

Answer

AD Query

Answer

LDAP Query

Question 14

A security administrator manages a Check Point R81.20 Security Gateway that enforces identity-based rules for users authenticating through a Captive Portal. Users complain that they must log in every morning even though the portal shows a session timeout of 480 minutes. After reviewing the gateway configuration, the administrator notices that the Identity Awareness blade is set to use the 'AD Query' method only. Which action should the administrator take to resolve the frequent re-authentication?

Accepted Answer

Enable the Identity Collector to receive session events from Active Directory domain controllers.. The Identity Collector method is designed to receive real-time session events from Active Directory, ensuring that the Identity Awareness database reflects current user logons. In this scenario, the gateway uses only AD Query, which polls AD periodically but does not receive immediate logon/logoff notifications, leading to session timeouts and re-authentication. Enabling Identity Collector addresses the root cause by providing continuous session updates.

Answer

Add a second Security Gateway to the cluster to ensure session persistence.

Answer

Configure the gateway to use RADIUS accounting to track user sessions.

Answer

Increase the Captive Portal session timeout to 1440 minutes in the Identity Awareness blade settings.

Question 15

A security administrator manages a Security Gateway where Identity Awareness is configured with both AD Query and Identity Agents (Captive Portal). Users who log into their domain-joined laptops via AD Query are also prompted by the Captive Portal, causing duplicate identity records and confusing session logs. Which action resolves this without disabling either acquisition method entirely?

Accepted Answer

Configure the Identity Agent deployment to exclude subnets or machines covered by AD Query using the 'Identity Agents' blade's network exclusion settings.. Scoping acquisition methods by network is the supported way to prevent two mechanisms from identifying the same user. Excluding the domain-joined subnet from Identity Agent/Captive Portal leaves AD Query authoritative for domain logins while the portal continues to serve non-domain clients, removing duplicate session records without sacrificing either method's coverage.

Answer

Disable the Captive Portal on the gateway and rely solely on Identity Agents installed on the domain-joined laptops.

Answer

Clear the Identity Awareness database with 'pep clear sessions' and restart the gateway so only one method registers.

Answer

Increase the AD Query refresh interval so the Captive Portal times out before AD Query runs.