156-315.81.20 Identity Awareness — 30 Questions

Question 1

An administrator configures Identity Awareness in AD Query mode on a Security Gateway. Users report that after logging in from workstations, traffic is occasionally blocked because the firewall associates their IP addresses with previously logged-out users. What is the most effective troubleshooting step to resolve this stale identity mapping issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the AD Query advanced properties to decrease the polling interval and reduce the session idle timeout threshold.. Stale IP-to-user mappings usually occur due to delayed logout detection or missed Kerberos/NetLogon session teardown events from the Domain Controller. Adjusting the AD Query polling frequency and enabling aggressive aging parameters ensures that disconnected sessions are purged rapidly, maintaining accurate policy enforcement and preventing unauthorized access persistence for shared terminal environments.

Answer

Restart the Security Gateway kernel using the cpstop and cpstart commands during production hours.

Answer

Disable AD Query completely and switch the entire environment exclusively to captive portal authentication.

Answer

Clear the browser cache and flush DNS records on every affected client workstation manually via the command line.

Question 2

Refer to the exhibit. An administrator runs a status command for Identity Awareness on a Security Gateway member of a High Availability cluster and sees the output shown in the exhibit. What is the immediate impact on identity enforcement for this cluster member?

Accepted Answer

The PEP cannot communicate with the PDP, resulting in failed identity-based access control evaluations for traffic hitting this gateway.. When a Security Gateway acting as a Policy Enforcement Point (PEP) loses Secure Internal Communication (SIC) connection to its Policy Decision Point (PDP) instance, it cannot synchronize user identity tables. Consequently, the PEP drops or fails to evaluate identity-based access rules for new traffic, degrading authentication enforcement across the cluster until SIC trust is restored.

Answer

All user authentication traffic is automatically redirected to the captive portal web server hosted locally on the PEP.

Answer

The Security Gateway continues to enforce cached identity rules indefinitely without any operational degradation.

Answer

The firewall kernel drops all transit packets immediately regardless of whether the security policy contains identity rules.

Question 3

When configuring Identity Awareness with Active Directory integration, an administrator needs to ensure that user group memberships are retrieved accurately and efficiently. Which THREE configuration steps or prerequisites are required for successful AD Query and LDAP integration? (Choose THREE)

Accepted Answer

Define the Domain Controller IP addresses and LDAP account credentials within SmartConsole under Servers and Objects.. Successful Identity Awareness integration requires proper administrative account permissions to read directory objects and security logs, correct LDAP server definitions for attribute mapping, and properly configured AD Query settings. These components allow the gateway to query group memberships and track user logons seamlessly.

Answer

Install the full Check Point Security Management server software package directly onto every Windows Domain Controller in the domain.

Answer

Configure every end-user workstation to run the Check Point Kernel Debugger service continuously in the background.

Question 4

When configuring Identity Awareness in SmartConsole, which software blade must be enabled on the Security Gateway object before Identity Awareness options become available?

Accepted Answer

Application Control. Identity Awareness relies on the Application Control and URL Filtering framework to perform advanced layer-7 user and group matching. Without enabling Application Control on the gateway software tab, administrators cannot configure identity-based access rules, as the underlying inspection engine requires this architecture for proper packet tagging.

Answer

Threat Emulation

Answer

IPsec VPN

Answer

URL Filtering

Question 5

Refer to the exhibit. An administrator runs the 'pdp monitor all' command on a Security Gateway to troubleshoot an Identity Awareness issue. Based on the output, what conclusion can be made regarding the IP address 10.100.10.55?

Accepted Answer

The Security Gateway successfully mapped the IP address to user jdoe using Active Directory Query.. The Policy Decision Point (PDP) monitor command displays active identity sessions currently maintained by the gateway. The output clearly shows that IP address 10.100.10.55 is successfully associated with user 'jdoe' via the Active Directory Query source, with an active session timeout remaining, proving that the identity mapping is fully operational.

Answer

The user jdoe failed authentication via Captive Portal and is currently locked out of the domain.

Answer

The Endpoint Identity Agent on the host has crashed and fallen back to an unauthenticated guest state.

Answer

The session has expired and will be purged from the kernel Identity Awareness tables within the next minute.

Question 6

A Security Gateway is configured with both AD Query and Browser-Based Authentication. A user successfully logs into a workstation and generates network traffic. However, the gateway captures the user identity through Browser-Based Authentication instead of AD Query. Why did this occur?

Accepted Answer

Identity Awareness source prioritization rules place explicit authentication methods above passive methods like AD Query.. Check Point Identity Awareness prioritizes identity sources based on an internal hierarchy where explicit or interactive authentication methods, such as Browser-Based Authentication or Identity Agents, take precedence over passive methods like AD Query when resolving access policies that require verified interactive sessions.

Answer

AD Query was disabled globally because the primary Domain Controller failed to respond to ICMP ping checks.

Answer

The user's browser automatically bypassed the proxy settings, forcing the gateway to fall back to Captive Portal.

Answer

AD Query failed to detect the Windows logon event ID 4624 because audit policy was misconfigured on the workstation.

Question 7

Which TWO methods can an administrator use to verify active Identity Awareness sessions and troubleshoot user mappings on a Check Point Security Gateway CLI? (Choose TWO)

Accepted Answer

pdp monitor all. Check Point provides specialized CLI utilities like 'pdp' (Policy Decision Point) and 'pep' (Policy Enforcement Point) to inspect user identity databases, active sessions, and enforcement states directly on the Security Gateway. These tools are essential for advanced troubleshooting when SmartConsole monitoring lacks sufficient detail.

Answer

fw tab -t identity_table

Answer

pep show users

Answer

identity_clish show sessions

Question 8

An enterprise environment implements Identity Awareness with AD Query. Security administrators notice that contractor laptops connected to the internal network are incorrectly acquiring internal user identities belonging to employees who previously used those machines. What is the best method to prevent this stale identity mapping?

Accepted Answer

Enable Identity Agent heartbeat and configure shorter idle timeout thresholds.. Stale identity mappings occur when an IP address remains associated with a user long after they disconnect, and a new user or device assumes that IP. Implementing Identity Agent or configuring aggressive probe timeouts ensures the gateway actively verifies endpoint liveness and flushes outdated sessions promptly.

Answer

Increase the AD Query cache retention period to 24 hours to ensure continuous session persistence.

Answer

Disable AD Query and rely exclusively on LDAP queries for real-time group membership lookups.

Answer

Configure static ARP bindings on the core switch for all contractor and employee workstations.

Question 9

Which TWO of the following configurations are required to ensure that a Security Gateway can transparently identify users connecting from a remote subnet via a VPN tunnel using AD Query?

Accepted Answer

Ensure the Domain Controller is defined as an LDAP Account Unit in the gateway object.. For AD Query to function across routed segments or VPNs, the gateway must be explicitly configured to trust the traffic and ensure the Identity Awareness process can reach the Domain Controller. The integration requires specific access to the AD server and proper configuration within the Identity Awareness gateway blade settings to map the IP ranges correctly to the domain controllers.

Answer

Enable 'Identity Logging' in the Domain Controller object properties.

Answer

Install an Identity Agent on all clients in the remote subnet.

Answer

Configure the gateway to act as a RADIUS server for the VPN clients.

Question 10

Refer to the exhibit. An administrator is troubleshooting an issue where 'jdoe' cannot access a restricted server. The policy rule explicitly allows the 'IT_Staff' group. Based on the output, what is the most likely reason the traffic is being blocked?

Accepted Answer

The traffic source IP does not match the IP identified in the PDP table.. The output confirms the user 'jdoe' is correctly associated with the 'IT_Staff' group via AD Query. Since the identity is known, the block is likely occurring due to a secondary factor. The most common cause is that the IP address 10.10.1.50 is not actually associated with the source of the traffic, or an implicit cleanup rule is catching the connection before the identity rule is matched.

Answer

The Identity Awareness blade is not enabled on the gateway.

Answer

The user is not in the correct Active Directory group.

Answer

The identity session has expired.

Question 11

Which mechanism does the Identity Awareness gateway use to prevent 'Identity Spoofing' when using transparent identification methods like AD Query?

Accepted Answer

It utilizes the Security Gateway's anti-spoofing mechanism on internal interfaces.. To combat identity spoofing, the gateway correlates the user identity with the IP address using multiple sources. Specifically, it employs session tracking and can be configured to use 'Identity Check' or 'Antispoofing' features that verify the consistency of the IP-to-User mapping, ensuring that traffic originating from an IP address matches the credentials captured via the AD Query or other sources.

Answer

It requires all users to perform 2FA on every new connection.

Answer

It automatically forces a captive portal challenge if the IP changes.

Answer

It uses hardware-based address filtering (MAC binding) for every user.

Question 12

When configuring the Identity Awareness 'Captive Portal', which authentication method is considered the most secure for internal users?

Accepted Answer

Kerberos SSO. For internal users, integrating the Captive Portal with Active Directory via Kerberos or NTLM is the most secure and seamless method. It leverages the existing enterprise authentication infrastructure without requiring users to type their credentials into a web form, as the browser automatically negotiates the identity with the gateway using the user's logged-in Windows session tokens.

Answer

HTTPS form-based authentication

Answer

HTTP basic authentication

Answer

RADIUS-based token authentication

Question 13

Which THREE components are necessary for the 'Identity Collector' to function correctly in a Check Point environment?

Accepted Answer

An account with 'Read' permissions to Active Directory event logs.. Identity Collector is a standalone component that gathers identity information from various sources and forwards it to the Check Point gateway. It requires connectivity to the data source (like Active Directory), connectivity to the security gateway (to forward the identity mapping), and a properly configured account with sufficient permissions to read the event logs from the source.

Answer

An Identity Agent installed on every Domain Controller.

Answer

The 'Identity Awareness' blade enabled on the Identity Collector server.

Question 14

A user is authenticated via AD Query, but after 30 minutes, they lose access. The administrator checks the logs and sees 'Session Timeout'. Which setting should be adjusted to keep the user authenticated longer without requiring them to re-authenticate?

Accepted Answer

Increase the 'AD Query' timeout in the Identity Awareness blade settings.. Identity sessions have a defined lifetime. When the session expires due to inactivity or a hard timeout, the user is removed from the Identity table. To prevent this, the administrator must modify the session timeout settings within the Identity Awareness gateway object in SmartConsole. Specifically, the 'Session Timeout' for AD Query should be increased to accommodate the desired duration of user sessions.

Answer

Enable 'Identity Logging' on the domain controller.

Answer

Decrease the 'Keep-Alive' interval in the identity daemon.

Answer

Change the 'Authentication Frequency' to 'Per-Packet'.

Question 15

Which of the following describes the correct order of operations when a user attempts to access a resource protected by an Identity Awareness policy?

Accepted Answer

Packet arrival, Identity lookup in PDP table, Rule evaluation.. When a packet arrives, the gateway checks its Identity Awareness table for an existing association (IP-to-User mapping). If it exists, the gateway evaluates the rule against the identified user and group. If no identity is known, and the rule requires identity, the gateway may trigger an authentication challenge (Captive Portal) or check other sources like AD Query to resolve the identity before applying the policy.

Answer

Rule evaluation, Identity lookup, Packet inspection.

Answer

Authentication challenge, Packet inspection, Rule evaluation.

Answer

Packet inspection, Rule evaluation, Identity lookup.

Question 16

Which TWO of the following steps are required to troubleshoot an 'Identity Awareness' user-identification failure when using 'Captive Portal'?

Accepted Answer

Review the 'Portal' logs in SmartView Tracker or Logs.. Troubleshooting Captive Portal requires checking both the gateway configuration and the client-side experience. The administrator must verify if the user's traffic is actually reaching the portal (is the rule configured to trigger the portal?), and if the gateway is correctly resolving the authentication backend (LDAP server connectivity). These two checks cover both the traffic flow and the identity validation process effectively.

Answer

Check the 'Identity Awareness' blade status using 'cpwd_admin'.

Answer

Reset the gateway 'Identity Awareness' database.

Answer

Restart the management server.

Question 17

An administrator wants to use Identity Awareness for internal traffic, but the gateway must not prompt users for authentication. Which combination is the most suitable?

Accepted Answer

AD Query and Kerberos SSO.. For transparent identification without user prompts, the combination of AD Query and Browser-Based Authentication (configured for Kerberos SSO) is the most effective. AD Query handles the identification of the device and user session in the background, while Kerberos SSO allows the browser to authenticate with the gateway seamlessly, providing a completely transparent experience that meets the administrator's requirement for zero user friction.

Answer

Captive Portal with manual username/password.

Answer

Identity Agent and Captive Portal.

Answer

Active Directory Query and RADIUS.

Question 18

Which of the following describes the function of the 'Identity Awareness' gateway in a cross-domain environment?

Accepted Answer

It queries the Global Catalog for identity information.. In a cross-domain environment, the gateway must be configured to communicate with multiple Active Directory domains. It achieves this by defining multiple LDAP Account Units, each representing a different domain. The gateway queries these units to resolve user identities, memberships, and attributes across the entire multi-domain forest, ensuring consistent policy enforcement regardless of which domain the user account originates from.

Answer

It can only communicate with the primary domain.

Answer

It requires a local user database to be synchronized.

Answer

It forces users to authenticate against each domain separately.

Question 19

Which TWO of the following are prerequisites for configuring Identity Awareness with Active Directory Query in a Check Point environment?

Accepted Answer

A service account with Read-only access to the Domain Controller security logs. For AD Query to function, the gateway must have the Identity Awareness software blade enabled and configured to communicate with the domain controller using a service account with appropriate permissions. These prerequisites ensure the gateway can query the Event Viewer logs. Properly defining the AD domain in the gateway object allows the gateway to query relevant domain controllers for authentication events.

Answer

Installation of the Check Point Identity Agent on all domain controllers

Answer

The Security Gateway must be a member of the Active Directory domain

Answer

Required installation of the Identity Awareness Captive Portal on all internal switches

Question 20

A security administrator has deployed Identity Awareness using Terminal Servers Agent on a Citrix XenApp server. Users log in to the XenApp server with their Active Directory credentials, then open a published Internet Explorer session to access internal web applications through the Security Gateway. The administrator notices that all user sessions are attributed to the service account used by the Identity Awareness agent, not the individual users. What is the most likely cause of this issue?

Accepted Answer

The Identity Awareness agent is using a service account that lacks sufficient permissions to query user sessions on the XenApp server.. In a Citrix XenApp environment, the Terminal Servers Agent must run with sufficient privileges to enumerate user sessions and extract individual identities. When the agent's service account lacks permissions, it cannot read session details, causing all traffic to be attributed to that service account. Granting the required permissions (e.g., local administrator or specific 'Query User' rights) allows the agent to correctly identify each user, ensuring accurate identity-based policy enforcement.

Answer

The Terminal Servers Agent is not configured to monitor the correct Citrix XenApp published application or session.

Answer

The Identity Awareness blade is not enabled on the Security Gateway.

Answer

The Security Gateway is configured to use AD Query instead of Terminal Servers Agent for identity acquisition.