156-215.81.20 Identity Awareness Practice Test 2 — 15 Questions

Question 1

A security administrator is deploying Identity Awareness on a Check Point R81.20 Security Gateway. The organization wants to identify users without installing any software on the user computers and without requiring the gateway to be a domain member. Which Identity Awareness method should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AD Query. The correct answer is AD Query. This method allows the Security Gateway to query Active Directory directly using LDAP, without requiring any software on user computers and without the gateway being a domain member. It is a standard Identity Awareness method that uses a privileged account to retrieve user and group information, making it suitable for environments where the gateway cannot be joined to the domain.

Answer

RADIUS Accounting

Answer

Identity Collector

Answer

Identity Agents

Question 2

An administrator is deploying Identity Awareness in a Check Point R81.20 environment. The company uses both domain-joined Windows workstations and non-domain-joined Linux servers. The administrator wants to ensure that users on both types of systems are identified. Which two methods should be configured to meet this requirement? (Choose two.)

Accepted Answer

Browser-Based Authentication for the Linux servers.. For domain-joined Windows workstations, AD Query is a standard and effective method to obtain user identity from Active Directory. For non-domain-joined Linux servers, Browser-Based Authentication provides a seamless way to identify users without installing unsupported agents. Combining these two methods covers both system types and ensures comprehensive identity awareness.

Answer

Terminal Server Agent on the Linux servers.

Answer

Identity Agent installed on the Linux servers.

Answer

RADIUS Accounting for both Windows and Linux systems.

Question 3

A security administrator manages a Check Point R81.20 Security Gateway that protects a network where users authenticate through a Captive Portal. The administrator wants to prevent users from having to log in again every time their IP address changes due to DHCP lease renewal. Which Identity Awareness configuration should be implemented?

Accepted Answer

Deploy the Identity Agent on user endpoints and enable 'IP Address Change' detection.. The Identity Agent is specifically designed to maintain identity sessions across IP address changes by communicating directly with the gateway. When a user's IP changes, the agent updates the gateway with the new mapping, so the user remains identified without re-authenticating. This is more efficient and seamless than relying on Captive Portal timeouts or external accounting, which do not automatically handle dynamic IP updates.

Answer

Use RADIUS accounting to track user sessions and update IP mappings.

Answer

Enable 'Authenticate with Active Directory' and configure LDAP integration.

Answer

Configure the Captive Portal to use 'Session Persistence' and set the timeout to a longer duration.

Question 4

A security administrator has configured Identity Awareness on a Security Gateway using AD Query. Users report that after changing their passwords, they are still identified as the old user in the logs. The administrator verifies that the gateway can reach the domain controllers. What is the most likely cause of this issue?

Accepted Answer

The Identity Awareness cache has not yet expired and still holds the old user session.. AD Query maintains a cache of user sessions to reduce repeated queries to Active Directory. When a user's session changes, such as after a password change or logoff, the cache may still hold the old identity until the timeout expires. This is a common cause of stale user information in logs, and adjusting the cache timeout or clearing sessions resolves it.

Answer

The Security Gateway's Identity Awareness blade is not licensed for password change events.

Answer

The user's account has been disabled in Active Directory, preventing updates.

Answer

The domain controller is not configured to forward security events to the gateway.

Question 5

A security administrator needs to configure Identity Awareness on a Check Point R81.20 Security Gateway so that users are identified by reading security event logs from domain controllers. Which Identity Awareness method should be selected?

Accepted Answer

Active Directory Query. Active Directory Query is the Identity Awareness method that directly reads Windows security event logs from domain controllers. It requires configuring the gateway with credentials that have read access to those logs and specifying the domain controllers to query. This method is ideal when the environment already has Active Directory and the administrator wants automatic, transparent user identification.

Answer

Browser-Based Authentication

Answer

RADIUS Accounting

Answer

Identity Collector

Question 6

An administrator is troubleshooting Identity Awareness on an R81.20 Security Gateway. Users are intermittently identified as 'unknown' even though AD Query is configured and the service account is valid. The administrator suspects that the issue is related to the way identities are shared with other gateways. Which two statements about Identity Awareness identity sharing are correct? (Choose two.)

Accepted Answer

Identity Sharing allows a Security Gateway to share identified users with other gateways in the same management domain.. Identity Sharing allows gateways to exchange identified user information, ensuring consistent policy enforcement across distributed environments. It is configured per gateway and can be enabled independently, allowing flexible deployment. It does not require uniform methods or automatic synchronization, so proper configuration is essential to avoid unidentified users.

Answer

Identity Sharing can only be used with the Identity Collector method.

Answer

Identity Sharing requires that all gateways use the same Identity Awareness method.

Answer

Identity Sharing automatically synchronizes user identities across all gateways without additional configuration.

Question 7

A security administrator is troubleshooting an Identity Awareness deployment that uses Identity Collector. Users on a specific subnet are intermittently identified as 'unknown' in the logs, while users on other subnets are consistently identified. The Identity Collector service is running and has a valid connection to the Security Gateway. What is the most likely cause of this intermittent identification failure?

Accepted Answer

The Security Gateway is not configured to accept identity information from the Identity Collector for that subnet.. The most likely cause is that the Security Gateway is not configured to accept identity information for that specific subnet. Identity Collector sends data, but the gateway must have the correct network objects and Identity Awareness settings to process it. A missing or misconfigured subnet definition would result in users on that subnet being unidentified while others remain unaffected.

Answer

The Identity Collector service account lacks permissions to read security logs on the domain controllers for that subnet.

Answer

The Security Gateway's Identity Awareness cache is full and cannot store new sessions for that subnet.

Answer

The domain controllers for that subnet are not forwarding events to the Identity Collector.

Question 8

A security administrator has configured Identity Awareness using Active Directory Query on a Check Point R81.20 Security Gateway. Users report that after changing their password, they are unable to access resources requiring identity-based rules. What is the most likely reason?

Accepted Answer

The Identity Awareness configuration uses a service account whose password expired, preventing AD queries.. Active Directory Query depends on a service account to query AD. If that account's password expires or is changed, the gateway cannot authenticate and retrieve user information. Users will then be unidentified, and identity-based rules will block access. The solution is to update the service account password in the Identity Awareness configuration or set it to never expire.

Answer

The user's identity session has expired and needs to be re-established, but the password change caused the session to be invalidated.

Answer

The user's group membership has not yet replicated to the domain controller that the gateway queries.

Answer

The Active Directory Query method caches credentials and does not update until the gateway is rebooted.

Question 9

An administrator is configuring Identity Awareness on a Check Point R81.20 Security Gateway using the Identity Collector method. Which two components are required for this deployment? (Choose two.)

Accepted Answer

A Trusted Communication (SIC) connection between the Identity Collector and the Security Gateway. The Identity Collector method requires a Windows server to run the collector service and a trusted SIC connection between that server and the Security Gateway. The collector receives identity events from sources like Active Directory or RADIUS and forwards them over SIC. Other components such as a RADIUS server or a web portal are optional and depend on the identity sources configured.

Answer

A web portal for user authentication

Answer

A RADIUS server for user authentication

Answer

A dedicated Management Server for Identity Awareness

Question 10

A security administrator is configuring Identity Awareness on a Check Point R81.20 Security Gateway. The administrator wants to allow users to authenticate using their existing Active Directory credentials without deploying any software on user computers. Which Identity Awareness method should be used?

Accepted Answer

Active Directory Query. Active Directory Query is the only method that transparently uses existing Active Directory credentials without requiring any software on user computers. The gateway queries AD for user and group information based on the source IP address of the traffic. Users simply log in to their domain as usual, and the gateway identifies them. This method is ideal for environments where endpoint software deployment is not desired.

Answer

Captive Portal

Answer

RADIUS Accounting

Answer

Identity Agent

Question 11

An administrator configures Identity Awareness in a Check Point environment using Active Directory Query. Users report that access policies based on user groups fail intermittently for workstations after users lock their screens. Which underlying mechanism causes this authentication loss?

Accepted Answer

AD Query relies on periodic polling of domain controller security logs and may miss rapid logon state transitions or idle timeouts.. Active Directory Query relies on polling Windows security event logs to track user logon sessions through Kerberos and NTLM ticket activity. When a workstation locks or goes idle, specific session events might not immediately refresh the gateway cache, causing temporary identity loss. Understanding this limitation helps administrators combine AD Query with browser-based Captive Portal or terminal servers to ensure robust identity persistence across all network segments.

Answer

The Identity Awareness daemon purges user entries immediately when the workstation screensaver activates.

Answer

Kerberos ticket-granting service renewal failures occur during idle periods, forcing the Security Gateway to drop user mappings.

Answer

The Security Management Server revokes the user's identity certificate when network traffic ceases for more than sixty seconds.

Question 12

An administrator needs to implement Identity Awareness to control access based on user groups. Which authentication method should be configured to ensure seamless transparency for users already logged into a Windows domain without requiring manual credentials input?

Accepted Answer

AD Query. Active Directory Query (AD Query) is the ideal mechanism for seamless transparent authentication. By querying the AD Security Event Logs, the Security Gateway identifies user logons without requiring agents on endpoints. This method is crucial for modern enterprise environments where user productivity is high and manual login prompts would cause significant friction, while still maintaining granular access control policies based on user group memberships.

Answer

Captive Portal

Answer

Identity Agent

Answer

Browser-Based Authentication

Question 13

Refer to the exhibit. An administrator is troubleshooting an issue where 'bob' is unable to access resources. Based on the CLI output, what is the most likely cause for the connectivity failure?

Accepted Answer

The security policy is blocking the traffic.. The CLI output confirms that 'bob' is actively mapped to IP 10.0.0.5 via AD Query with a timeout remaining. Since the identity mapping is confirmed, the issue is not with the Identity Awareness blade itself but rather with the security policy rules. The gateway correctly identifies the user, so the administrator should focus on firewall policy rule matching and the specific network permissions defined for bob's group.

Answer

The AD Query source is failing to communicate.

Answer

The user session has timed out.

Answer

The Identity Awareness blade is disabled.

Question 14

Which of the following is the primary purpose of the Identity Awareness 'Captive Portal' feature?

Accepted Answer

To provide authentication for users not identified by transparent methods.. The Captive Portal serves as a fallback authentication mechanism for users who are not automatically identified by transparent methods like AD Query or Identity Agents. It presents a web page to the user, forcing them to authenticate before granting access to network resources. This ensures that even unmanaged devices or users who cannot be identified through automated means can still have their traffic logged and controlled by the gateway.

Answer

To hide the identity of the user from internal logging servers.

Answer

To automatically install Identity Agents on client machines.

Answer

To encrypt traffic between the user and the internal file servers.

Question 15

Refer to the exhibit. An administrator is configuring RADIUS authentication for Identity Awareness. What is the cause of this error log?

Accepted Answer

The RADIUS server and gateway have mismatched encryption keys.. The 'shared secret mismatch' error explicitly indicates that the RADIUS client (the Security Gateway) and the RADIUS server are using different keys to encrypt their communications. This is a common configuration error in AAA setups. Both the gateway and the server must have an identical, correctly typed shared secret string, or the authentication handshake will be rejected by the server for security reasons.

Answer

The RADIUS server is down.

Answer

The firewall policy is blocking RADIUS traffic.

Answer

The user password is incorrect.