156-215.81.20 Identity Awareness Practice Test 4 — 15 Questions

Question 1

A company wants users on managed Windows endpoints to be identified by Identity Awareness without requiring them to open a browser or wait for an AD event log poll. The endpoints are domain-joined and already managed by the organization. Which acquisition method meets this requirement most directly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identity Agent installed on each managed endpoint. An endpoint-resident Identity Agent authenticates the logged-in user to the gateway automatically, providing immediate identification with no browser prompt and no dependency on AD event polling. For centrally managed, domain-joined Windows endpoints, this is the most direct way to achieve seamless, prompt-free identity acquisition.

Answer

Captive Portal with single sign-on enabled

Answer

AD Query configured against the domain controllers

Answer

RADIUS Accounting configured on the gateway

Question 2

A security administrator manages a Check Point R81.20 environment with a Security Gateway and a separate Identity Collector. Users authenticate through Microsoft Active Directory, and the administrator wants to minimize the number of AD queries sent from the gateway. Which configuration should the administrator use to achieve this?

Accepted Answer

Deploy Identity Collector to receive identity events from AD and forward them to the Security Gateway.. Identity Collector is specifically designed to reduce load on Active Directory by having a dedicated collector receive security event log data and push identity updates to the Security Gateway. This eliminates the need for the gateway to poll AD, which is the behavior of AD Query. The other methods either still query AD or are intended for different authentication scenarios.

Answer

Configure the Security Gateway to use RADIUS accounting to receive user identity information.

Answer

Configure Identity Awareness with AD Query and enable caching on the Security Gateway.

Answer

Enable Identity Awareness with Terminal Server Agent on all domain controllers.

Question 3

A security administrator has configured Identity Awareness with AD Query on a Check Point R81.20 Security Gateway. Users report that they can access resources immediately after logging in, but after a password change, some users are still identified with their old group memberships for an extended period. What is the most likely cause of this behavior?

Accepted Answer

The AD Query cache has not expired, and the gateway is using cached group information.. The correct answer is that the AD Query cache has not expired, and the gateway is using cached group information. AD Query periodically queries Active Directory and caches the results to reduce load. When group memberships change, the gateway may not reflect the changes until the cache is refreshed, causing users to retain old group memberships for an extended period.

Answer

The Identity Awareness blade is not configured to synchronize group memberships.

Answer

The user's session on the Security Gateway has not been refreshed, and the old session is still active.

Answer

The Security Gateway is not receiving real-time login events from the domain controllers.

Question 4

An administrator is troubleshooting an Identity Awareness deployment where some users are intermittently shown as unidentified on the Security Gateway. The environment uses AD Query. Which TWO conditions would cause AD Query to fail to identify a logged-in user? (Choose two.)

Accepted Answer

The Security Gateway cannot reach the domain controller on the required ports for event log retrieval.. AD Query relies on reaching domain controllers to read security event logs, and it only sees logons generated after monitoring is enabled for those controllers. Blocked connectivity or logons predating configuration both leave users unidentified. Endpoint agent state, portal certificates, and session timeout length do not govern whether AD Query can read domain login events.

Answer

The Captive Portal certificate has expired on the gateway.

Answer

The gateway's identity session timeout is shorter than the users' typical work session.

Answer

The endpoint has the Identity Agent installed but the service is set to manual start.

Question 5

A security administrator must let contractors on personally owned, non-domain laptops access internal resources. The contractors cannot install endpoint software, and the organization wants them to authenticate through a web page before access is granted. Which Identity Awareness acquisition method fits these constraints?

Accepted Answer

Captive Portal configured on the Security Gateway. Captive Portal is designed for users who cannot run endpoint agents and are not in the domain. It presents a browser-based login before granting access, satisfying both the no-install and web-authentication requirements. The gateway then maps the authenticated user to the source address for identity-based enforcement.

Answer

AD Query against the corporate domain controllers

Answer

Identity Agent installed by each contractor

Answer

RADIUS Accounting from a third-party network access server

Question 6

An administrator configures Identity Awareness with Active Directory Query on an R81.20 Security Gateway. Users are authenticated via Kerberos, and the gateway has been joined to the domain. However, after login, some users are not being identified. The administrator notices that the gateway's AD Query service account password has expired. What is the most likely cause of the identification failure?

Accepted Answer

The AD Query service account password must be updated in the Identity Awareness configuration, and the service restarted.. The AD Query method relies on a service account to read login events from Active Directory. If that account's password expires or is changed, the gateway loses access and cannot identify users. The fix is to update the password in the Identity Awareness configuration and restart the service. This ensures continuous identification.

Answer

The Security Gateway must be rebooted to re-establish the Kerberos trust with the domain controller.

Answer

The users must log in again because their Kerberos tickets have expired due to the service account issue.

Answer

The Identity Awareness blade must be reinstalled because the expired password corrupted its database.

Question 7

An administrator configures Identity Awareness to use AD Query and creates an Access Control rule allowing the 'Sales' identity group to reach a CRM server. Users in Sales are identified, yet some still get blocked. Reviewing logs shows their sessions exist but the group membership is missing. Which configuration should the administrator verify first?

Accepted Answer

The AD Query refresh and group synchronization settings that determine how often group membership is updated from Active Directory.. When an identity session exists but group membership is absent, the issue is usually in how group data is resolved and refreshed from Active Directory. AD Query relies on periodic synchronization to map users to their groups, so stale or misconfigured group synchronization settings explain why identified Sales users lack the group needed to match the rule.

Answer

The Identity Agent installation package version deployed to Sales laptops.

Answer

The Captive Portal login page branding and timeout values.

Answer

The Security Gateway's routing table entries toward the CRM server subnet.

Question 8

An administrator is deploying Identity Awareness on a Check Point R81.20 Security Gateway. Users authenticate to a captive portal hosted by the gateway itself, without any external directory service. Which Identity Awareness method is being used?

Accepted Answer

Browser-Based Authentication. Browser-Based Authentication is the only Identity Awareness method that operates entirely on the Security Gateway without any external directory or identity source. It presents a captive portal, validates credentials against the gateway's local user database, and then maps the source IP to the authenticated user for policy enforcement. All other methods depend on external infrastructure, which the scenario explicitly excludes.

Answer

RADIUS Accounting

Answer

Identity Collector

Answer

Active Directory Query

Question 9

A security administrator is deploying Identity Awareness using the Identity Collector in an environment with multiple domain controllers. The administrator wants to ensure that user identity information is collected from all domain controllers and that the load is distributed. Which configuration should be implemented?

Accepted Answer

Deploy multiple Identity Collector instances, each connecting to a different domain controller, and configure them to share data with the Security Gateway.. To collect identities from multiple domain controllers and distribute load, deploy multiple Identity Collector instances, each assigned to a different domain controller. They all forward data to the Security Gateway, providing redundancy. This is the recommended approach for large environments with multiple domain controllers.

Answer

Enable the Identity Awareness blade on each domain controller to push identities directly to the gateway.

Answer

Use a single Identity Collector and configure it to query all domain controllers simultaneously via LDAP.

Answer

Configure the Identity Collector to connect to each domain controller individually and enable load balancing.

Question 10

A security administrator manages a Check Point R81.20 environment with Identity Awareness using Active Directory Query. Users on domain-joined machines are identified correctly, but users who connect through a NAT device are consistently shown as unknown. What is the most likely cause?

Accepted Answer

The AD Query method cannot resolve identities when the source IP is translated by NAT.. Active Directory Query relies on matching the source IP of traffic to the IP recorded in AD security events. NAT rewrites the source IP, so the gateway sees a different address than the one in the AD logs, and the identity lookup fails. To support NATed users, the administrator must use a method that carries identity in the traffic itself, such as Identity Collector or RADIUS Accounting.

Answer

The gateway is missing a license for Identity Awareness.

Answer

The AD Query account password has expired.

Answer

The Security Gateway is not configured to read the correct AD security log.

Question 11

An administrator is configuring Identity Awareness on a Security Gateway and wants to enable users to authenticate via a web portal before accessing network resources. The administrator wants to minimize user disruption and avoid installing additional software. Which Identity Awareness method should be used?

Accepted Answer

Browser-Based Authentication. Browser-Based Authentication provides a web portal for user login, requiring only a browser. It avoids software installation and domain integration. This method is suitable when users need to authenticate before accessing resources, and it minimizes disruption by leveraging familiar browser interfaces.

Answer

AD Query

Answer

Terminal Server Agent

Answer

Identity Collector

Question 12

An administrator is configuring Identity Awareness on a Check Point R81.20 Security Gateway. The company uses a single Active Directory domain and wants to identify users without installing any software on client machines. Which Identity Awareness method should the administrator choose?

Accepted Answer

AD Query. AD Query is the only method that automatically identifies users in an Active Directory domain without installing any software on client machines. It leverages the existing domain infrastructure and the Security Gateway's ability to query domain controllers, making it the correct choice for this scenario. Other methods either require client software or manual authentication.

Answer

Identity Agent

Answer

Browser-Based Authentication

Answer

Terminal Server Agent

Question 13

An administrator is configuring Identity Awareness on a Check Point R81.20 gateway using the Identity Collector. Users are authenticated via multiple Active Directory domains in a forest. The administrator notices that users from one domain are not being identified. What is the most likely cause?

Accepted Answer

The Identity Collector service account does not have sufficient permissions to read the Event Log on domain controllers in that domain.. The Identity Collector relies on reading security event logs from domain controllers. When multiple domains exist, the service account must have read permissions on each domain controller. If permissions are missing for one domain, the collector cannot retrieve login events, leaving users unidentified. Ensuring the account has appropriate rights in every domain is essential for full coverage.

Answer

The Identity Collector does not support multiple domains in a single forest.

Answer

The gateway is not configured with a DNS server that can resolve the domain controllers in that domain.

Answer

The users in that domain are not members of any groups that are used in Identity Awareness rules.

Question 14

A security administrator is configuring Identity Awareness with Terminal Server Agent on a Citrix server. Users report that after logging off and logging back in, they are still associated with their previous session, causing policy inconsistencies. What is the most likely cause of this issue?

Accepted Answer

The Terminal Server Agent is not configured to monitor session logoff events.. The Terminal Server Agent must be configured to monitor both logon and logoff events to accurately track user sessions. If logoff events are missed, the gateway retains the user's identity, causing policy inconsistencies when the user logs back in. Ensuring proper event monitoring resolves the issue.

Answer

The Security Gateway's identity database is full and cannot accept new sessions.

Answer

The user's credentials are cached by the Citrix server, causing automatic re-authentication with the old identity.

Answer

The Terminal Server Agent requires a reboot after each user logoff to clear the session.

Question 15

A security administrator has deployed Identity Awareness with Terminal Server Agent on a Check Point R81.20 gateway. Users report that their identities are correctly identified when they log in, but after disconnecting and reconnecting to a different session on the same terminal server, they are still associated with the old session. What is the most likely cause?

Accepted Answer

The Terminal Server Agent is not configured to monitor session changes.. The Terminal Server Agent must be configured to monitor all session events, including logoff and reconnection, to keep the identity database current. If it only tracks initial logons, the gateway will not update the mapping when a user switches sessions, resulting in stale associations. Ensuring that session change monitoring is enabled resolves the issue.

Answer

The gateway's identity database is full and cannot accept new entries.

Answer

The gateway is not licensed for Identity Awareness with Terminal Server Agent.

Answer

The Terminal Server Agent service is not running on the terminal server.