The Application Control software blade provides application security by identifying and controlling the use of thousands of different applications and protocols on the network. It uses multiple inspection technologies to recognize applications, regardless of the port or protocol used. This blade integrates seamlessly with the Identity Awareness blade to provide granular identity control, allowing administrators to create policies that define which users or groups can use specific applications. This combination delivers both application security and identity-based access control.

A. Identity Awareness provides identity control (the "who") but does not provide application security (the "what application"). It is a complementary blade.

B. Data Loss Prevention (DLP) focuses on preventing the unauthorized transmission of sensitive information outside the organization, not on controlling application usage.

C. URL Filtering controls access to websites based on their URL and category, which is a different function from identifying and controlling specific applications.

- Check Point. (2023). R81.20 Application Control Administration Guide. p. 7, Chapter 1 "Introduction to Application Control". The guide states, "The Application Control Software Blade provides application security and control... Application Control works with the Identity Awareness Software Blade to give you visibility into the applications that users and groups use."

The Gaia operating system's snapshot management feature allows an administrator to create a point-in-time image of the system's root disk volume. This process utilizes Logical Volume Manager (LVM) technology to create the snapshot without requiring a reboot or the interruption of Check Point processes. This provides a quick and non-disruptive method for creating a rollback point before making significant system changes. The other listed methods are disruptive.

A. This is incorrect because the snapshot utility is specifically designed to be non-disruptive and does not stop Check Point processes.

B. The standard backup utility stops Check Point services to ensure a consistent and complete backup of the configuration and system state.

C. The migrate export command is used for upgrades and migrations. It stops all Check Point daemons to create a consistent export package.

- Check Point. (2023). R81.20 Gaia Administration Guide. Check Point Software Technologies Ltd. Chapter: "System Management", Section: "Snapshot Management", Page 53. "You can use Snapshot Management to back up and restore a Gaia system without interrupting the services."

- Check Point. (2023). R81.20 CLI Reference Guide. Check Point Software Technologies Ltd. Chapter: "System Configuration", Section: "backup", Page 158. "Stops Check Point products."

- Check Point. (2023). R81.20 Installation and Upgrade Guide. Check Point Software Technologies Ltd. Chapter: "Upgrade and Migration Tools", Section: "Migration Tools", Page 130. "The export process stops all Check Point services."

For roaming users, typically using corporate-managed laptops, Identity Agents are the best deployment method. The agent is installed on the user's computer and transparently provides user and machine identity information to the Security Gateway. This method is seamless for the user, does not require repeated logins (unlike a captive portal), and provides robust identity information for use in the Access Control policy, regardless of the user's location.

A. Use Office Mode: Office Mode is a feature of IPsec VPN that assigns an internal IP address; it is not a primary method for acquiring user identity.

C. Share user identities between gateways: This is a mechanism for synchronizing identity data between gateways for scalability, not a method for acquiring identity from an end-user.

D. Use captive portal: A captive portal requires active user login through a web browser, which is intrusive and less suitable for corporate roaming users than a transparent agent.

1. Check Point. (2023). R81.20 Identity Awareness Administration Guide. Page 13, "Identity Sources". States, "For roaming users, we recommend to use an Identity Agent."

2. Check Point. (2023). R81.20 Identity Awareness Administration Guide. Page 43, "Identity Agent". Describes the agent as providing "transparent authentication from the user's computer."

In a ClusterXL Active-Active deployment, the Sticky Decision Function (SDF) is essential for preventing asymmetric routing. Asymmetric routing occurs when packets for the same connection are processed by different cluster members on their inbound and outbound paths. This breaks stateful inspection. The SDF ensures that a specific cluster member is designated to handle all packets for a given connection, thereby maintaining session state integrity and ensuring traffic flows symmetrically through the cluster.

A. Symmetric routing is the desired outcome that the Sticky Decision Function helps to achieve, not a problem it prevents.

B. Failover is a fundamental capability of a cluster, which SDF helps to function correctly in Active-Active mode, rather than preventing it.

D. Anti-Spoofing is a separate security feature that validates the source IP address of a packet against the gateway's topology.

1. Check Point. (2023). R81.20 ClusterXL Administration Guide. Chapter: "Load Sharing", Section: "The Sticky Decision Function".

Each administrator works in an independent “session”. Only the objects that a user edits are locked to that user; all other administrators can log in simultaneously, open their own sessions and modify different objects in parallel.

A. Locks are object-scoped, not LAN-scoped; admins need no special same-subnet session.

B. A first login never blocks the whole database; “Read-only” switching is unnecessary.

C. The database is not globally locked—other admins may still create writable sessions.

1. Check Point R80.20 Security Management Administration Guide, “Concurrent Administration & Sessions”, p.55-58.

2. Check Point SK106456, “SmartConsole sessions and database locking in R80.x”, §Overview.

3. Tel-Aviv University Cyber-Security Course Notes, “Check Point R80 Session Architecture”, lecture 7, slide 14.

An Access Role is a versatile object in Check Point's policy management that allows for granular access control based on multiple factors. It is not limited to a single identity type. An administrator can create a single Access Role object that combines various conditions, including specific users and user groups (from an identity source like Active Directory), specific computers or computer groups, networks (IP addresses/ranges), and even remote access clients. This composite object can then be used in the source or destination of a security policy rule to simplify and strengthen access control.

A. Access Roles can include remote access clients, but this is only one of several possible components, not the sole factor.

B. Access Roles can include computers and networks, but this answer omits the critical user identity component.

C. Access Roles are heavily based on users and groups, but they can also incorporate network and machine information for more context.

1. Check Point. (2023). R81.20 Identity Awareness Administration Guide. Chapter 1: "Introduction to Identity Awareness", Section: "Access Roles". (Explicitly states that Access Roles can include users, machines, networks, and remote access clients).

2. Check Point. (2023). R81.20 Security Management Administration Guide. p. 278, "Using Identity in the Access Control Policy". (Describes creating Access Role objects and using them in rules, showing the combination of different identity and network elements).

To grant a user permission to run a specific expert mode command like tcpdump without providing full expert mode access, the command must first be made available in the Gaia CLISH shell. This is done using the add command feature. Then, Role-Based Administration (RBA) is used to create a custom role that includes only this newly defined command. Finally, a new user is created with a non-root UID (any UID other than 0) and assigned this restrictive role. This adheres to the principle of least privilege.

B. Assigning UID 0 grants superuser (root) privileges, which contradicts the requirement of limited access and is a significant security risk.

C. This option grants full expert-mode access and uses UID 0, both of which are explicitly against the stated requirements and security best practices.

D. This option incorrectly grants full expert-mode access to the role, which is what the administrator wants to avoid.

1. Check Point. (2023). R81.20 Gaia Administration Guide. Check Point Support Center. Chapter: "System Management", Section: "Role-Based Administration", Sub-section: "Adding an Expert Mode Command to a Role".

2. Check Point. (2023). R81.20 CLI Reference Guide. Check Point Support Center. Chapter: "User Management Commands", Section: "add command".

The Hit Count feature, which tracks the number of connections matched by each rule, is configured at the policy layer level. In SmartConsole, an administrator must edit the properties of a specific Access Control Policy layer (e.g., the "Network" layer) to find the checkbox that enables or disables Hit Count tracking. Once enabled for the layer, counters will be active for all rules within it.

A. Hit Count is not configured on the policy package itself, but on a specific layer within the Access Control policy of that package.

B. This is a management and display feature configured in SmartConsole, not a setting on the individual Security Gateway objects.

D. This setting is specific to a policy layer, not a global property that affects the entire Security Management Server.

1. Check Point R81.20 Security Management Administration Guide, Chapter: "Access Control", Section: "Working with the Access Control Rule Base", Subsection: "Hit Count". The guide provides the exact procedure: "To enable or disable Hit Count for a Layer: ... Select a layer and click Edit. ... Select or clear Enable Hit Count."

When using SmartConsole, changes made by an administrator are sent to the Security Management Server and held in a private session database. If the network connection is lost, the Management Server maintains the session lock and preserves all unpublished changes. Once connectivity is restored, the administrator can log back in, and SmartConsole will reconnect to the existing session, allowing them to continue their work exactly where they left off without any loss of data. This ensures administrative work is not lost due to transient network issues.

A. Rebooting and clearing the cache are unnecessary troubleshooting steps; the changes are stored on the server, not just in a local client cache.

B. Accessing a local management cache store after a reboot is not the standard procedure; session data is held server-side.

C. Changes are not lost upon disconnection because they are saved in the session on the Security Management Server, not just locally.

- Check Point. (2023). R81.20 Security Management Administration Guide. p. 58, "Concurrent Administration". The documentation explains that when an administrator edits a policy, the database is locked, and changes are saved in a private session on the server.

The show config-state command is the designated function within the GAiA Command Line Interface (clish) to check the status of the running configuration. It provides a direct and simple output, indicating whether the current configuration is "saved" or "unsaved". This allows an administrator to quickly determine if changes have been made that will be lost upon a reboot without needing to review the specific changes.

A. show unsaved is not a valid GAiA clish command for viewing configuration status.

B. show save-state is not a valid GAiA clish command for this purpose.

C. show configuration diff is a valid command, but it displays the specific differences, rather than simply stating if the configuration is saved or not.

1. Check Point. (2023). Gaia R81.20 CLI Reference Guide. Page 100, "show config-state".