Check Point CCCS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared responsibility model

A division of security duties: the cloud provider secures physical infrastructure and managed service internals, while the customer secures identity, data, configuration, and guest workloads.

IaaS customer duties

In infrastructure-as-a-service, the customer patches the guest OS, configures network ACLs and security groups, manages identities, and classifies and encrypts its own data.

SaaS customer duties

In software-as-a-service, the customer mainly governs identity and access, data classification, sharing configuration, and acceptable-use policy; the provider handles application and platform patching.

Customer-managed keys

Encryption keys generated and held by the customer in a key management service or HSM, giving the customer control over rotation and revocation while shifting key custody responsibility to itself.

Configuration drift

Continuous divergence of deployed cloud resources from their intended secure state, caused by API-driven change; it requires declarative policy enforcement rather than periodic manual review.

Control-plane logging

Provider audit trails recording API actions in an account; they are customer-enabled, customer-retained evidence and are not universally on by default across services.

CloudGuard gateway image

A marketplace or template-deployed Gaia-based virtual gateway that boots into a VPC or VNet and receives policy from an on-premises or cloud Security Management Server.

Source/destination check

An AWS ENI attribute that must be disabled on a forwarding gateway interface so the instance can receive and forward traffic addressed to other hosts.

Azure IP forwarding

A NIC setting that must be enabled on the gateway interface so packets arriving for other destinations are forwarded rather than dropped by the guest operating system.

Gateway bootstrap

Preconfigured startup parameters embedded in an image or user data that let a newly launched gateway register with the management server and fetch policy without manual steps.

BYOL versus PAYG

Two licensing models: bring-your-own-license uses centralized license management and portability, while pay-as-you-go is bound to marketplace terms and generally cloud-specific.

Gateway sizing driver

Required gateway count is derived from inspected throughput and concurrent connections per instance, not from the number of workloads alone.

CloudGuard Terraform modules

Check Point's published infrastructure-as-code modules that parameterize VPC or VNet, subnets, gateway count, and management connectivity for repeatable deployments.

AWS route table inspection

To inspect traffic, the source subnet's route table points the destination CIDR at the gateway ENI, forcing packets through the security gateway before delivery.

Azure user-defined route

A route with next hop set to a virtual appliance private IP; it redirects subnet traffic to the CloudGuard gateway for inspection.

North-south inspection

Inspection of traffic entering or leaving the cloud environment, placing the gateway between the internet gateway and workload subnets on the default route.

East-west inspection

Inspection of traffic between workloads inside the cloud; it requires route changes or transparent insertion so intra-VPC packets traverse the gateway.

Asymmetric routing

A condition where request and response take different paths; stateful gateways drop such flows, so symmetric per-zone route tables are required.

Gateway Load Balancer

A transparent insertion service using GENEVE encapsulation on port 6081 that steers traffic to third-party inspection appliances without per-workload route changes.

Transit hub-and-spoke

A topology centralizing gateways in a shared services VPC or VNet, with spoke networks peered to the hub and inter-spoke traffic routed through inspection.

Private endpoint bypass

Private connectivity paths that avoid internet routing and can skip inspection; they must be explicitly routed through the gateway or formally accepted as exceptions.

CSPM function

Continuous assessment of cloud accounts against security rules, producing severity-rated findings with remediation guidance and mapping to compliance controls.

Compliance bundle

A mapping of posture rules to a framework such as CIS, PCI DSS, HIPAA, SOC 2, NIST, or GDPR, reporting pass or fail per control.

Read-only onboarding role

A cross-account IAM role, service principal, or service account granted assessment-only permissions so posture scanning needs no write credentials.

Auto-remediation

Serverless functions triggered by the posture platform that automatically fix misconfigurations such as public storage buckets or overly open security groups.

Posture exception

A suppression of a known-acceptable finding that should carry an owner and expiry date to prevent permanent, unowned blind spots.

Assessment cadence

Near-real-time posture evaluation using cloud API polling plus event-driven triggers, because point-in-time scans cannot keep pace with constant configuration drift.

Workload protection agent

Software deployed on VMs or hosts that detects malware, behavioral anomalies, and file encryption, and can block or quarantine the workload at runtime.

Serverless function protection

A lightweight extension or layer attached to functions at deployment that inspects invocations; it cannot be added to an existing function without redeployment.

Container image scanning

Vulnerability assessment of container images on registry push and at runtime, with pipeline policy that fails builds on critical findings rather than warning.

IaC scanning

Static analysis of Terraform or CloudFormation templates before deployment, catching misconfigurations earlier than cloud API posture checks.

Management API automation

Scripted provisioning and policy operations through the management server's API and CLI, enabling repeatable gateway, object, and policy installation tasks.