156-315.81.20 Identity Awareness — All Questions With Answers

Question 1mediummultiple choice

Read the full Identity Awareness explanation →

An administrator configures Identity Awareness in AD Query mode on a Security Gateway. Users report that after logging in from workstations, traffic is occasionally blocked because the firewall associates their IP addresses with previously logged-out users. What is the most effective troubleshooting step to resolve this stale identity mapping issue?

Question 2hardmultiple choice

Read the full Identity Awareness explanation →

Refer to the exhibit. An administrator runs a status command for Identity Awareness on a Security Gateway member of a High Availability cluster and sees the output shown in the exhibit. What is the immediate impact on identity enforcement for this cluster member?

Exhibit

[Identity Awareness]
Status: Enabled
AD Query Status: Connected
PDp Status: Active
PEp Status: Active
Connected PDP instances: 0
Last Error: Failed to connect to PDP on cluster peer due to SIC failure.

Question 3mediummulti select

Read the full Identity Awareness explanation →

When configuring Identity Awareness with Active Directory integration, an administrator needs to ensure that user group memberships are retrieved accurately and efficiently. Which THREE configuration steps or prerequisites are required for successful AD Query and LDAP integration? (Choose THREE)

Question 4easymultiple choice

Read the full Identity Awareness explanation →

When configuring Identity Awareness in SmartConsole, which software blade must be enabled on the Security Gateway object before Identity Awareness options become available?

Question 5mediummultiple choice

Read the full Identity Awareness explanation →

Refer to the exhibit. An administrator runs the 'pdp monitor all' command on a Security Gateway to troubleshoot an Identity Awareness issue. Based on the output, what conclusion can be made regarding the IP address 10.100.10.55?

Exhibit

[expert@security-gw:]# pdp monitor all
UID: 0-0-0-0-ip-10.100.10.55
IP: 10.100.10.55
Timeout: 3598
State: Connected
Sources: (AD Query)
User: jdoe
Domain: CORP

Question 6hardmultiple choice

Read the full Identity Awareness explanation →

A Security Gateway is configured with both AD Query and Browser-Based Authentication. A user successfully logs into a workstation and generates network traffic. However, the gateway captures the user identity through Browser-Based Authentication instead of AD Query. Why did this occur?

Question 7mediummulti select

Read the full Identity Awareness explanation →

Which TWO methods can an administrator use to verify active Identity Awareness sessions and troubleshoot user mappings on a Check Point Security Gateway CLI? (Choose TWO)

Question 8mediummultiple choice

Read the full Identity Awareness explanation →

An enterprise environment implements Identity Awareness with AD Query. Security administrators notice that contractor laptops connected to the internal network are incorrectly acquiring internal user identities belonging to employees who previously used those machines. What is the best method to prevent this stale identity mapping?

Question 9hardmulti select

Read the full VPN explanation →

Which TWO of the following configurations are required to ensure that a Security Gateway can transparently identify users connecting from a remote subnet via a VPN tunnel using AD Query?

Question 10mediummultiple choice

Read the full Identity Awareness explanation →

Refer to the exhibit. An administrator is troubleshooting an issue where 'jdoe' cannot access a restricted server. The policy rule explicitly allows the 'IT_Staff' group. Based on the output, what is the most likely reason the traffic is being blocked?

Exhibit

pdp monitor all
User: jdoe
IP: 10.10.1.50
Session ID: 5218
State: Associated
Source: AD Query
Age: 120s
Groups: CN=IT_Staff,OU=Users,DC=corp,DC=local

Question 11mediummultiple choice

Read the full Identity Awareness explanation →

Which mechanism does the Identity Awareness gateway use to prevent 'Identity Spoofing' when using transparent identification methods like AD Query?

Question 12easymultiple choice

Read the full Identity Awareness explanation →

When configuring the Identity Awareness 'Captive Portal', which authentication method is considered the most secure for internal users?

Question 13mediummulti select

Read the full Identity Awareness explanation →

Which THREE components are necessary for the 'Identity Collector' to function correctly in a Check Point environment?

Question 14mediummultiple choice

Read the full Identity Awareness explanation →

A user is authenticated via AD Query, but after 30 minutes, they lose access. The administrator checks the logs and sees 'Session Timeout'. Which setting should be adjusted to keep the user authenticated longer without requiring them to re-authenticate?

Question 15mediummultiple choice

Read the full Identity Awareness explanation →

Which of the following describes the correct order of operations when a user attempts to access a resource protected by an Identity Awareness policy?

Question 16hardmulti select

Read the full Identity Awareness explanation →

Which TWO of the following steps are required to troubleshoot an 'Identity Awareness' user-identification failure when using 'Captive Portal'?

Question 17mediummultiple choice

Read the full Identity Awareness explanation →

An administrator wants to use Identity Awareness for internal traffic, but the gateway must not prompt users for authentication. Which combination is the most suitable?

Question 18mediummultiple choice

Read the full Identity Awareness explanation →

Which of the following describes the function of the 'Identity Awareness' gateway in a cross-domain environment?

Question 19mediummulti select

Read the full Identity Awareness explanation →

Which TWO of the following are prerequisites for configuring Identity Awareness with Active Directory Query in a Check Point environment?

Question 20mediummultiple choice

Read the full Identity Awareness explanation →

A security administrator has deployed Identity Awareness using Terminal Servers Agent on a Citrix XenApp server. Users log in to the XenApp server with their Active Directory credentials, then open a published Internet Explorer session to access internal web applications through the Security Gateway. The administrator notices that all user sessions are attributed to the service account used by the Identity Awareness agent, not the individual users. What is the most likely cause of this issue?

Question 21hardmultiple choice

Read the full Identity Awareness explanation →

A security administrator is configuring Identity Awareness on a Security Gateway using Captive Portal. The portal is configured to authenticate users against an LDAP server. Users report that after entering their credentials, they are redirected to the original URL but are still prompted for authentication again immediately. The administrator checks the gateway logs and sees successful LDAP authentication but no identity being registered. What is the most likely cause?

Question 22mediummulti select

Read the full Identity Awareness explanation →

An administrator is configuring Identity Awareness with Terminal Servers / Citrix (TS) agent on a Security Gateway. The environment includes multiple Citrix servers and a mix of Windows and Mac clients. The administrator needs to ensure that identities are correctly associated with user sessions. Which two actions are required to achieve this? (Choose two.)

Question 23mediummultiple choice

Read the full Identity Awareness explanation →

An administrator is deploying Identity Awareness on a Security Gateway and wants to minimize the load that identity acquisition places on Active Directory domain controllers while still identifying users who log on to domain-joined workstations. Which Identity Awareness acquisition method should the administrator select?

Question 24mediummultiple choice

Read the full Identity Awareness explanation →

A security administrator is deploying Identity Awareness on a Check Point Security Gateway that must identify users connecting through a non-domain, network-level terminal server. The administrator needs the gateway to map each user session to the correct IP address without installing any agent on the terminal server. Which Identity Awareness acquisition method should the administrator configure?

Question 25hardmultiple choice

Read the full Identity Awareness explanation →

A Check Point Security Gateway is configured with Identity Awareness using AD Query. The administrator notices that some users are not being identified correctly after they log in to their workstations. The gateway is able to query the domain controllers, but the identity information appears stale for certain users. Which action should the administrator take to ensure that AD Query retrieves updated user-to-IP mappings promptly?

Question 26mediummultiple choice

Read the full Identity Awareness explanation →

A security administrator has configured Identity Awareness on a Security Gateway using Terminal Servers (Citrix) with the Multi-User Host agent. Several users report that after connecting to the Citrix server, they are still identified as the previous user who logged on to that server. The administrator verifies that the Multi-User Host agent is running and that the gateway can communicate with it. What is the most likely cause of the stale identity mappings?

Question 27mediummulti select

Read the full Identity Awareness explanation →

An administrator is configuring Identity Awareness with AD Query on a Check Point Security Gateway. The environment has multiple domain controllers across two sites. Which two actions should the administrator take to ensure reliable user identification across both sites? (Choose two.)

Question 28hardmultiple choice

Read the full Identity Awareness explanation →

A Check Point Security Gateway is configured with Identity Awareness using Captive Portal. Users authenticate through the portal, and the gateway maps their identities. An administrator notices that some users remain identified even after they log off their workstations and leave for the day. The administrator wants to ensure that stale identities are removed promptly. Which parameter should the administrator adjust to control how long an identity remains valid after the last detected activity?

Question 29easymultiple choice

Read the full Identity Awareness explanation →

A Check Point administrator is setting up Identity Awareness on a Security Gateway for the first time. The administrator wants to use a method that requires no additional servers or endpoint software and can identify users based on their login to the domain. Which Identity Awareness method should be used?

Question 30hardmulti select

Read the full Identity Awareness explanation →

A security administrator is deploying Identity Awareness in a large enterprise with multiple Security Gateways managed by a Security Management Server. The administrator wants to use a single Identity Awareness source to identify users across all gateways and ensure that identity information is shared consistently. The environment includes Active Directory domain controllers and a requirement for high availability. Which two statements are true regarding the configuration and behavior of Identity Awareness in this scenario? (Choose two.)

Question 31mediummultiple choice

Read the full Identity Awareness explanation →

A security administrator has deployed Identity Awareness on a R81 Security Gateway using the AD Query method. The gateway successfully logs in to the domain controller and retrieves user information. However, users who authenticate via a Remote Desktop Protocol (RDP) session to a terminal server are not being identified. The administrator verifies that the AD Query configuration is correct and that the terminal server is generating logon events. What is the most likely cause of this issue?

Question 32hardmultiple choice

Read the full Identity Awareness explanation →

A Check Point Security Gateway is configured with Identity Awareness in Captive Portal mode. Users authenticate via the portal, and their identities are stored in the PDP. An administrator notices that after a user successfully authenticates, the gateway still enforces policies based on the 'Unauthenticated' group for some connections. The administrator runs 'pdp monitor all' and sees the user listed with an IP address. What is the most likely reason for this behavior?

Question 33hardmulti select

Read the full Identity Awareness explanation →

An administrator is troubleshooting an Identity Awareness deployment that uses AD Query. Users are not being identified on the Security Gateway. The administrator has verified that the Identity Awareness blade is enabled and that the gateway can ping the domain controller. Which two actions should the administrator take to further diagnose the issue? (Choose two.)

Question 34easymultiple choice

Read the full Identity Awareness explanation →

A Check Point Security Gateway is configured with Identity Awareness using the Browser-Based Authentication method. Users are required to authenticate via a web portal before accessing the Internet. The administrator wants to allow users to authenticate once and remain identified for a specified period, even if they close the browser. Which configuration setting should the administrator adjust?

Question 35hardmulti select

Read the full Identity Awareness explanation →

An administrator is deploying Identity Awareness with AD Query in a large enterprise. The environment includes multiple domain controllers and several Security Gateways. The administrator wants to ensure that user identification is accurate and resilient. Which TWO of the following configurations are required to support this deployment? (Choose two.)

Question 36hardmulti select

Read the full Identity Awareness explanation →

An enterprise environment utilizes Identity Awareness with both AD Query and Browser-Based Authentication. Security administrators notice that contractor devices, which are not joined to the Active Directory domain, fail to acquire identity roles and are blocked by internal firewall rules. Which TWO methods can be implemented to correctly identify and authenticate these non-domain-joined contractor machines? (Choose TWO)

Question 37easymultiple choice

Read the full Identity Awareness explanation →

Which core software blade must be enabled on a Check Point Security Gateway to allow the creation of access control rules based on Active Directory user groups and computer objects?

Question 38mediummultiple choice

Review the full subnetting walkthrough →

An administrator is troubleshooting an Identity Awareness deployment where AD Query fails to resolve user identities for workstations located in a newly added branch office subnet. The Security Gateway can successfully ping the Domain Controllers in the branch office. What is the most likely cause of this communication failure?

Question 39mediummultiple choice

Read the full Identity Awareness explanation →

An administrator configures Identity Awareness in a Check Point environment using Active Directory Query as the primary identity source. Users suddenly report that access policies based on user groups are randomly failing. What is the most likely root cause of this behavior?

Question 40hardmulti select

Read the full Identity Awareness explanation →

Which TWO authentication methods are natively supported by Check Point Identity Awareness for acquiring user identities without requiring a client-side agent installation? (Choose TWO)

Question 41hardmulti select

Read the full Identity Awareness explanation →

Which THREE parameters must be correctly configured when setting up an Active Directory Query identity source in SmartConsole? (Choose THREE)

Question 42mediummultiple choice

Read the full Identity Awareness explanation →

An administrator notices that users connecting through a Citrix XenApp published application server are all appearing as a single user in Identity Awareness access logs. What is the appropriate solution to resolve this limitation?

Question 43hardmultiple choice

Read the full Identity Awareness explanation →

Refer to the exhibit. An administrator runs a CLI command to test policy evaluation for a specific client IP address. What does the output indicate about the gateway's evaluation process?

Exhibit

[expert@security-gw:]# pdp test access 10.100.20.15 192.168.1.50 80
Matching Access Role: 'Finance_Users'
Identity Source: AD Query
Action: Accept

Question 44hardmultiple choice

Read the full Identity Awareness explanation →

Refer to the exhibit. An administrator is trying to refresh group membership for a user manually using the CLI. What is the most likely cause of this error?

Exhibit

pdp update user-group-info [username]
Error: Failed to fetch group info. Connection to LDAP Account Unit failed.

Question 45easymultiple choice

Read the full Identity Awareness explanation →

Which Identity Awareness source is best suited for identifying users connecting from non-Windows devices like mobile phones or tablets?

Question 46hardmultiple choice

Read the full Identity Awareness explanation →

Refer to the exhibit. Rule 5 allows the group 'Admins'. Why is the user 'admin' being blocked?

Exhibit

pdp monitor all
User: admin
IP: 192.168.1.10
Session ID: 4005
State: Associated
Source: Captive Portal
Groups: CN=Admins,OU=Groups,DC=local

[Gateway Log]
Error: Identity Awareness user 'admin' blocked by rule 5.

Question 47mediummultiple choice

Read the full Identity Awareness explanation →

When using the Identity Agent, what is the 'Shared User' feature used for?

Question 48mediummultiple choice

Read the full Identity Awareness explanation →

An administrator needs to implement Identity Awareness in a large environment with multiple Active Directory domains. Which method ensures the most efficient identity retrieval without requiring client-side agent installations on every workstation?

Question 49hardmultiple choice

Read the full Identity Awareness explanation →

When utilizing Identity Awareness, what is the primary purpose of the 'Identity Logging' feature in the context of compliance and auditing?

Question 50mediummultiple choice

Read the full Identity Awareness explanation →

An administrator has deployed Identity Awareness on a Security Gateway in AD Query mode. Users authenticate to the domain and their identities are learned successfully. However, a security policy rule that should permit access to an internal web server for the group 'Sales' is not matching. The administrator verifies that user 'jsmith' is a member of 'Sales' in Active Directory. The gateway's PDP shows the user identity, but the group is missing. What is the most likely cause?

Question 51easymultiple choice

Read the full Identity Awareness explanation →

An administrator is deploying Identity Awareness on a Security Gateway and wants to ensure that user identities are shared with other gateways in the same domain. The administrator configures the gateway as a PDP and enables Identity Sharing. Which statement describes the primary benefit of this configuration?

Question 52mediummultiple choice

Read the full Identity Awareness explanation →

A security administrator is troubleshooting an Identity Awareness issue where users are not being identified on a Security Gateway. The gateway is configured to use AD Query. The administrator runs the command 'pdp monitor all' and sees that no users are listed. Which of the following is the most likely cause?

Question 53hardmultiple choice

Review the full subnetting walkthrough →

A Security Gateway is configured with Identity Awareness using AD Query, and users authenticate to the domain normally. An administrator notices that identities for users who log on to workstations on a remote subnet are not appearing in the Identity Awareness database, while local subnet users are identified correctly. The domain controllers are reachable and audit logging is enabled. Which configuration item should the administrator verify first?

Question 54mediummultiple choice

Read the full Identity Awareness explanation →

A security administrator is deploying Identity Awareness on a Check Point R81 Security Gateway using the Identity Agents method. The organization wants to avoid installing additional client software on user workstations. Which Check Point component must be deployed to collect identities from the Active Directory domain controllers without requiring a full Identity Agent on each endpoint?

Question 55easymultiple choice

Read the full Identity Awareness explanation →

A company wants users on managed Windows laptops to be identified by the Security Gateway without deploying any additional endpoint software and without prompting for credentials. Users already authenticate to the Active Directory domain at logon. Which Identity Awareness component is required on the Security Gateway to achieve this?

Question 56mediummultiple choice

Read the full Identity Awareness explanation →

An administrator is troubleshooting an Identity Awareness deployment where users authenticated through a Captive Portal are shown as unidentified on a different Security Gateway in the same distributed environment. The portal gateway correctly identifies the users, but the second gateway does not. Which action should the administrator take to allow the identity information to reach the second gateway?

Question 57hardmultiple choice

Read the full Identity Awareness explanation →

An administrator is troubleshooting Identity Awareness on a Security Gateway. Users authenticated previously, but now the gateway shows them as unidentified and all traffic falls to the default rule. The administrator confirms the gateway can reach the domain controllers and that the Identity Awareness blade is enabled. Which action should the administrator take first to verify whether the gateway is receiving identity information from the PDP?

Question 58hardmulti select

Read the full Identity Awareness explanation →

An administrator is implementing Identity Awareness using AD Query on a Security Gateway. Before identities can be learned from Active Directory, which two actions must be performed? (Choose two.)

Question 59mediummultiple choice

Read the full Identity Awareness explanation →

A security administrator is deploying Identity Awareness on a Check Point R81 Security Gateway. The environment uses a Windows Server 2019 domain controller, and the administrator wants the gateway to learn user identities by querying Windows Security Event Logs on the domain controller. The administrator has already configured the Identity Awareness blade and enabled AD Query in SmartConsole. Which additional configuration is required on the domain controller for AD Query to function?

Question 60mediummulti select

Read the full Identity Awareness explanation →

An administrator is configuring Identity Awareness on a Check Point Security Gateway using the Captive Portal method. The organization wants to ensure that users who authenticate via the portal are correctly identified and that their identities are used in security policies. Which two actions are necessary to enable this? (Choose two.)

Question 61easymultiple choice

Read the full VPN explanation →

A company wants to enforce identity-based rules for remote users who connect through a VPN. The administrator needs the Security Gateway to learn the user identity during the VPN authentication process without deploying additional agents. Which Identity Awareness feature should the administrator use?

Question 62mediummultiple choice

Read the full Identity Awareness explanation →

An administrator is configuring Identity Awareness on a Check Point Security Gateway using the Terminal Server Agent. The environment has multiple users logging into a Citrix terminal server. The administrator wants to ensure that each user's identity is correctly associated with their individual session, not just the terminal server's IP address. Which statement describes how the Terminal Server Agent accomplishes this?

Question 63hardmultiple choice

Read the full Identity Awareness explanation →

An administrator has configured Identity Awareness with AD Query. Users are identified correctly during the day, but every morning many users appear unidentified until they generate new domain logon events. The administrator wants to reduce this morning gap without switching acquisition methods. Which configuration should the administrator adjust?

Question 64hardmultiple choice

Read the full Identity Awareness explanation →

A Check Point Security Gateway uses Identity Awareness with AD Query. An administrator notices that user identities are not being recognized in firewall rules that reference Active Directory groups. The gateway can identify individual users, but group-based rules do not match. What is the most likely cause?

Question 65easymultiple choice

Read the full Identity Awareness explanation →

A network administrator is configuring Identity Awareness on a Security Gateway using AD Query. The administrator wants to ensure that user identities are correctly associated with IP addresses and that the gateway can resolve user group memberships for policy enforcement. Which component must be installed and configured on the Security Gateway to enable AD Query?

Question 66easymultiple choice

Read the full Identity Awareness explanation →

An administrator is configuring Identity Awareness on a Check Point Security Gateway. The organization wants to identify users based on their login to the Windows domain without installing any software on user computers. Which Identity Awareness method should be used?

Question 67mediummultiple choice

Read the full Identity Awareness explanation →

A security administrator is troubleshooting an Identity Awareness deployment that uses Identity Agents. Users report that they can access resources based on their identity, but sometimes they are prompted to authenticate again even though they are already logged in. The administrator checks the gateway and sees that the Identity Agent is running on the users' computers. What is a possible cause for the re-authentication prompts?

[Identity Awareness] Status: Enabled AD Query Status: Connected PDp Status: Active PEp Status: Active Connected PDP instances: 0 Last Error: Failed to connect to PDP on cluster peer due to SIC failure.

pdp monitor all User: admin IP: 192.168.1.10 Session ID: 4005 State: Associated Source: Captive Portal Groups: CN=Admins,OU=Groups,DC=local [Gateway Log] Error: Identity Awareness user 'admin' blocked by rule 5.