156-315.81.20 Identity Awareness Practice Question
An administrator is troubleshooting an Identity Awareness deployment where AD Query fails to resolve user identities for workstations located in a newly added branch office subnet. The Security Gateway can successfully ping the Domain Controllers in the branch office. What is the most likely cause of this communication failure?
⚠ Common exam trap
Engineers often assume that successful basic connectivity like pinging the Domain Controller means AD Query will function, overlooking that specific management and log-scraping ports might be blocked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Necessary ports such as RPC (135) and SMB (445) are blocked between the Security Gateway and the Domain Controllers.
AD Query relies on specific remote procedure call mechanisms and Windows Management Instrumentation protocols to read Security Event logs from Domain Controllers. If required ports like RPC Endpoint Mapper (135), SMB (445), or dynamic RPC ports are blocked by intermediate firewalls or host firewalls, the gateway cannot poll logs, resulting in complete identity resolution failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Security Gateway lacks the necessary routing table entries to reach the branch office local subnet.
Why it's wrong here
The scenario explicitly states that the Security Gateway can successfully ping the Domain Controllers in the branch office. Successful ICMP reachability proves that basic Layer 3 routing and network connectivity between the gateway and the domain controllers are fully functional.
- ✓
Necessary ports such as RPC (135) and SMB (445) are blocked between the Security Gateway and the Domain Controllers.
Why this is correct
AD Query requires active RPC and SMB communication to query Windows Security Event logs remotely from Domain Controllers. When intermediate or host firewalls block these administrative ports, the gateway cannot read login events, causing identity resolution to fail completely.
- ✗
The branch office workstations have not installed the Check Point Identity Agent software.
Why it's wrong here
AD Query is a transparent, agentless identification method that does not require installing any software on end-user workstations. Therefore, missing endpoint agents will not prevent AD Query from functioning properly as long as domain controller logs are accessible.
- ✗
The Captive Portal Web API service on the Security Gateway has been stopped by the administrator.
Why it's wrong here
AD Query operates independently of the Captive Portal Web API service, utilizing direct Active Directory log polling mechanisms. Stopping the captive portal service would only affect browser-based authentication flows, leaving AD Query log parsing completely unaffected.
Visual reference
About these practice questions
This 156-315.81.20 question is part of Courseiva's 210-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-315.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-315.81.20 exam.