CCSM Advanced Security Management Practice Question
A security administrator is configuring a Check Point R81.20 Management Server to use an external User Directory for administrator authentication. The administrator wants to ensure that users can log into SmartConsole using their Active Directory credentials and that group membership determines their permission profile. Which two actions must be performed to achieve this? (Choose two.)
⚠ Common exam trap
The trap here is assuming that LDAPS or Identity Awareness are required for AD integration, when the essential steps are configuring the User Directory and mapping AD groups to administrator groups.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the User Directory object in SmartConsole to point to the Active Directory server.
To enable AD authentication and group-based permissions for SmartConsole, you must configure a User Directory object pointing to the AD server and define administrator groups mapped to AD groups. This allows AD users to log in with their credentials and inherit permissions based on their group membership. Manual account creation and other options are not required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the User Directory object in SmartConsole to point to the Active Directory server.
Why this is correct
Configuring a User Directory object in SmartConsole is necessary to establish communication with the Active Directory server. This object defines the connection settings, including the server IP, credentials, and schema. Without this, the Management Server cannot query AD for authentication or group membership, so it is a required step.
- ✗
Install a Check Point identity awareness blade on the Management Server.
Why it's wrong here
Identity Awareness is a software blade used on gateways to identify users based on network traffic, not for administrator authentication. It is not required for AD integration on the Management Server. The Management Server uses User Directory integration, which is separate from Identity Awareness.
- ✓
Define an administrator group in SmartConsole and map it to an Active Directory group.
Why this is correct
Defining an administrator group in SmartConsole and mapping it to an AD group enables automatic permission assignment. When an AD user logs in, their group membership is checked against the mapping, and the corresponding permission profile is applied. This is the standard method for integrating AD groups with SmartConsole permissions.
- ✗
Enable LDAP over SSL (LDAPS) on the Management Server to encrypt authentication traffic.
Why it's wrong here
While LDAPS is a good security practice for encrypting authentication traffic, it is not strictly required to achieve AD authentication and group-based permissions. The question asks for necessary actions, and LDAPS is optional, though recommended. It does not directly enable the mapping of AD groups to permission profiles.
- ✗
Create an administrator account for each AD user and manually assign permission profiles.
Why it's wrong here
Manual creation of administrator accounts for each AD user is not scalable and defeats the purpose of using an external directory. Instead, you can map AD groups to permission profiles, allowing automatic assignment based on group membership. Manual accounts would require ongoing maintenance and are not the recommended approach.
About these practice questions
This CCSM question is part of Courseiva's 219-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This CCSM practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSM exam.