156-215.81.20 Identity Awareness Practice Test 3 — 15 Questions

Question 1

What is the primary benefit of using 'Identity Sharing' between multiple Check Point Security Gateways?

Accepted Answer

To allow users to roam between gateways without re-authenticating.. Identity Sharing allows gateways to exchange user-to-IP mapping information, effectively creating a unified identity awareness environment. This is critical in large networks where a user might roam between different gateway segments. By sharing this data, the security policy remains consistent for the user regardless of which gateway they connect through, preventing the need for redundant authentication processes and improving the overall security posture and user experience.

Answer

To reduce the load on the Security Management Server.

Answer

To enforce user access restrictions at the Management Server level.

Answer

To replace the need for AD Query on all gateways.

Question 2

Which TWO settings are required when configuring the 'Active Directory Query' method in the Identity Awareness blade?

Accepted Answer

The IP address of the Domain Controller.. To configure AD Query, the administrator must provide the gateway with the necessary credentials to read security logs and identify the target domain controller. These two components—the specific Domain Controller and the service account with adequate permissions—are fundamental. Without them, the gateway lacks the administrative authorization required to query the remote logs, and it would be unable to map IP addresses to user accounts.

Answer

A list of all users in the Active Directory.

Answer

The public DNS server IP address.

Answer

An installed Identity Agent on the Domain Controller.

Question 3

Which of the following describes the function of the 'Identity Awareness Gateway' in a load-sharing cluster?

Accepted Answer

It synchronizes identity tables across all cluster members.. In a load-sharing cluster, identity information must be synchronized across all cluster members to maintain consistent policy enforcement. If a member receives a packet, it must know the identity of the source IP address immediately. By synchronizing the identity table, the cluster ensures that whichever member handles the traffic, it can apply the same user-based access rules without requiring the user to re-authenticate or re-map their identity.

Answer

It only synchronizes identity data during a failover event.

Answer

Each member maintains its own independent identity table.

Answer

It forces traffic to only one node for identity processing.

Question 4

Which of the following is a recommended best practice when using Identity Awareness for internal network security?

Accepted Answer

Create rules based on user groups rather than IP addresses.. The most effective way to secure an internal network using Identity Awareness is to implement a 'least privilege' approach combined with granular user-group rules. By defining policies that only allow specific users access to the resources they need to perform their job functions, administrators significantly reduce the internal attack surface. This prevents lateral movement by attackers who might compromise a single machine, as their access remains limited to the authorized user's permissions.

Answer

Enable all Identity Awareness sources on all gateways.

Answer

Only use Captive Portal for all users.

Answer

Disable logging to improve gateway performance.

Question 5

An administrator wants to ensure that mobile devices are correctly identified. Which method is most appropriate for mobile device identity identification in a Wi-Fi environment?

Accepted Answer

Captive Portal. Captive Portal or integration with an MDM (Mobile Device Management) system is most appropriate for mobile devices. Unlike Windows PCs that can join a domain and use AD Query, mobile devices are typically not domain-joined. Using Captive Portal ensures that regardless of the device type or OS, the user must authenticate, allowing the firewall to associate their mobile session with a known identity for consistent security policy application.

Answer

AD Query

Answer

Identity Agent

Answer

Browser-based transparent authentication

Question 6

Refer to the exhibit. Why are users on non-domain machines labeled as 'unknown'?

Accepted Answer

AD Query cannot identify non-domain machines.. The current configuration only enables AD Query, which specifically relies on Windows domain login events. Non-domain machines do not participate in the domain login process, so the domain controller never generates the security logs required for AD Query to function. Because Captive Portal and Identity Agents are disabled, there is no secondary or fallback method available to identify these non-domain users, resulting in an 'unknown' identity status for their traffic.

Answer

The firewall policy is too restrictive.

Answer

The Identity Awareness blade is malfunctioning.

Answer

The network is using NAT.

Question 7

An administrator configures Identity Awareness using Active Directory Query to authenticate domain users. After deployment, users report intermittent authentication failures, and logs show that the Security Gateway fails to query the Domain Controllers due to insufficient privileges. Which account permission must be granted to resolve this issue without granting Domain Administrator rights?

Accepted Answer

Read permissions on user objects and membership in the Event Log Readers security group.. Identity Awareness Active Directory Query requires specific read permissions on the Active Directory container objects and membership in the Event Log Readers group to parse security event logs successfully. Granting full domain admin privileges violates security best practices, making targeted permission delegation essential for enterprise compliance and least-privilege enforcement.

Answer

Membership in the Domain Admins group and full control over the root domain partition.

Answer

Membership in the Enterprise Admins group and Schema Admins group.

Answer

Full administrative control over the Built-in Administrators local group on the gateway.

Question 8

Refer to the exhibit. An administrator reviews the Identity Awareness status of a user workstation using CLI commands on the Security Gateway. What does the 'Identity Source: Identity Agent' field specifically indicate about how this user's identity was acquired?

Accepted Answer

A client application installed on the user workstation actively authenticated to the Security Gateway.. The Identity Agent source indicates that a lightweight client is installed on the endpoint device, actively communicating user credentials and state directly to the Security Gateway. This method offers high reliability and supports advanced features like post-connection accounting and explicit sign-out.

Answer

The gateway queried the Active Directory Domain Controller security event logs using WMI.

Answer

The user successfully completed a web-based Captive Portal challenge in their browser.

Answer

The gateway intercepted a Kerberos ticket exchange via passive network sniffing.

Question 9

When configuring Access Control policies based on Identity Awareness roles, an administrator places an identity-based rule above a traditional IP-based rule. A user authenticated via Identity Awareness attempts to access a blocked server. The rule base evaluates the connection and matches the user against the identity rule. What happens to the connection?

Accepted Answer

The action specified in the matched identity-based rule is immediately enforced.. Check Point Security Gateways evaluate Access Control rules in a top-down manner. Once a packet matches the criteria of an upper rule—including user identity attributes—action is immediately enforced, and lower rules are bypassed. Proper rule ordering is critical to prevent unintended access permissions.

Answer

The connection is evaluated against the lower IP-based rule if the identity role contains conflicting parameters.

Answer

The gateway drops the packet because IP-based rules always take precedence over identity rules.

Answer

The user is forced to re-authenticate via Captive Portal to confirm their authorization.

Question 10

A security administrator is using Identity Awareness with Identity Agents in 'Browser-Based' mode. Users report they are prompted for authentication twice. What is the most likely cause?

Accepted Answer

Captive Portal is enabled for the same traffic.. When using browser-based authentication alongside Identity Agents, the gateway might trigger a Captive Portal authentication if the Identity Agent hasn't fully communicated the user's identity, or if there is a conflict in policy enforcement. This double-prompting often indicates that the browser-based authentication policy overlaps with the agent-based authentication method, causing the system to challenge the user through both mechanisms consecutively.

Answer

The Identity Agent is misconfigured.

Answer

The Domain Controller is slow to respond.

Answer

Active Directory replication delay.

Question 11

Which command is used to clear the user sessions in the Identity Awareness database on a Security Gateway?

Accepted Answer

pdp session revoke all. The 'pdp' (Policy Decision Point) command is the primary CLI utility for managing Identity Awareness. Specifically, 'pdp session revoke' allows administrators to manually terminate individual user sessions or clear the entire database. This is a vital task when testing identity policies or when a user's session appears stuck, preventing them from accessing resources correctly due to an outdated identity mapping in the gateway's active cache.

Answer

fw tab -t user_auth -x

Answer

cpstop && cpstart

Answer

identity_clear

Question 12

What is the primary function of the 'Identity Collector' in a distributed Identity Awareness environment?

Accepted Answer

Offloading identity collection from the Gateway.. The Identity Collector is a dedicated software component that offloads the task of querying directory services (like Active Directory) from the Security Gateway. By centralizing the collection of identity events, it reduces the load on the gateway's CPU and allows for the integration of multiple identity sources, such as Cisco ISE or Windows Event Logs, into a single, unified feed for the security gateways.

Answer

Encrypting all user traffic.

Answer

Providing endpoint antivirus protection.

Answer

Enforcing access policies on the user.

Question 13

An administrator is troubleshooting an issue where users are identified as 'Unknown' despite having Identity Awareness enabled. What is the first logical step to investigate?

Accepted Answer

Check 'pdp monitor' output.. The most effective first step is to check if the gateway is correctly receiving identity information from the sources. Using the command 'pdp monitor' allows the administrator to see the current status of all configured identity sources. If the source shows as 'Disconnected' or 'Failed', the problem lies in the connectivity or credentials used for the identity source, rather than a policy-level filtering issue.

Answer

Restart the security gateway.

Answer

Review the Access Control policy.

Answer

Reinstall the Identity Agent.

Question 14

An administrator has configured Identity Awareness with Terminal Server Agent on a Terminal Server. Users report that after disconnecting from a Remote Desktop session and reconnecting, they are sometimes identified as the previous user. What is the most likely cause of this issue?

Accepted Answer

The Terminal Server Agent maps users to session IDs, and when a session ID is reused without a proper logoff event, the previous user's identity can persist.. The correct answer is that the Terminal Server Agent maps users to session IDs, and if a session ID is reused without a proper logoff event, the previous user's identity can persist. This can happen when users disconnect instead of logging off, leaving the session in a disconnected state. When the session ID is later assigned to a new user, the agent may not have processed a logoff for the old user, causing misidentification.

Answer

The Terminal Server Agent is not configured to monitor session state changes.

Answer

The Security Gateway is not receiving updates from the Terminal Server Agent due to a network issue.

Answer

The Identity Awareness blade is not enabled on the Security Gateway.

Question 15

An administrator is configuring Identity Awareness on a Check Point R81.20 Security Gateway using the Identity Collector. The administrator wants to ensure that the Identity Collector can retrieve user identity information from Active Directory. Which two components are required for the Identity Collector to function? (Choose two.)

Accepted Answer

A dedicated server or virtual machine to run the Identity Collector. The two required components are a user account with read permissions to Active Directory and a dedicated server or virtual machine to run the Identity Collector. The Identity Collector uses the account to authenticate and retrieve identity events from domain controllers, and it must run on a separate server that has network connectivity to both Active Directory and the Security Gateway.

Answer

The Terminal Server Agent installed on all domain controllers

Answer

The Security Gateway must be a member of the Active Directory domain

Answer

A RADIUS server configured for accounting