I85PREP
⌘ K
Check Point CCCS study materials
Check Point CCCS study resources

Check Point CCCS practice questions

One question at a time. Build your Check Point CCCS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Security Fundamentals and Shared Responsibility

In a public cloud IaaS deployment, which responsibility remains with the customer under the shared responsibility model?

  1. Managing the provider's backbone network routing infrastructure
  2. Maintaining the physical security of the data center hosting the workloads
  3. Replacing failed hypervisor hosts in the provider's compute fleet
  4. Patching the guest operating system and configuring its security controls Correct answer.

Explanation

In IaaS the provider secures the physical facility, hardware, hypervisor, and core network, while the customer owns everything from the guest operating system upward. That includes OS patching, hardening, identity configuration inside the VM, and the data itself. The boundary shifts with the service model, but the guest layer is consistently the customer's.

Question 2Cloud Security Fundamentals and Shared Responsibility

A team deploys a serverless function that reads from a managed object store. Which statement best describes their security obligations?

  1. They must configure the hypervisor that isolates function instances
  2. They are responsible for the function code, its permissions, and the data they place in the store Correct answer.
  3. They must harden the underlying container host operating system
  4. They must patch the runtime that executes the function code

Explanation

With fully managed serverless compute and storage, the provider handles the runtime, host OS, and isolation layers. The customer still owns the application code, the identity and permissions granted to the function, and the classification and protection of stored data. Misconfigured function permissions are among the most common serverless risks.

Question 3Cloud Security Fundamentals and Shared Responsibility

Which control is most clearly the customer's responsibility when using a SaaS productivity suite?

  1. Patching the SaaS application's web front end
  2. Deciding which users receive access and reviewing that access periodically Correct answer.
  3. Maintaining redundancy of the provider's availability zones
  4. Encrypting data at rest across the provider's storage clusters

Explanation

In SaaS the provider operates nearly the entire stack, including the application, platform, and infrastructure. The customer's residual duties center on identity governance, data handling, and configuration of tenant-level settings. Access decisions and periodic access reviews therefore stay with the customer.

Question 4Cloud Security Fundamentals and Shared Responsibility

What does the shared responsibility model primarily define?

  1. The division of security and operational duties between a cloud provider and its customer Correct answer.
  2. The method used to calculate per-hour billing for cloud resources
  3. The sequence of steps in a cloud migration project plan
  4. The process for negotiating service level agreements with a cloud vendor

Explanation

The shared responsibility model is a framework that allocates security and operational duties between provider and consumer. It varies by service model, from IaaS to SaaS, and by the specific service features used. It is not a commercial, billing, or migration artifact.

Question 5Cloud Security Fundamentals and Shared Responsibility

A company moves a workload from IaaS virtual machines to a managed container platform. How does the responsibility boundary typically shift?

  1. The customer gains responsibility for patching the container runtime
  2. The customer becomes responsible for the physical hosts running the containers
  3. Responsibility for data encryption keys moves entirely to the provider
  4. The provider assumes more of the host and orchestration layer, while the customer keeps workload and identity duties Correct answer.

Explanation

As the service becomes more managed, the provider absorbs lower layers such as host patching and orchestration control plane maintenance. The customer generally retains responsibility for the workload, its configuration, and identity and access management. The direction of the shift is toward the provider taking on more of the platform.

Question 6Cloud Security Fundamentals and Shared Responsibility

Which activity is an example of the customer fulfilling its shared responsibility duty in a public cloud?

  1. Auditing the provider's source code for the hypervisor
  2. Testing the provider's physical access badge system
  3. Verifying that the provider's data center has redundant power feeds
  4. Reviewing cloud audit logs for anomalous administrative activity Correct answer.

Explanation

Monitoring tenant-visible audit logs is a customer responsibility because it concerns activity in the customer's own environment. Physical facility controls and hypervisor internals are provider-owned and typically evidenced through independent attestations rather than direct customer audit. The customer verifies provider controls through reports, not by inspecting the facility itself.

Question 7Cloud Security Fundamentals and Shared Responsibility

A security team wants assurance about the provider's physical and environmental controls. What is the most appropriate customer action under the shared responsibility model?

  1. Require the provider to share hypervisor source code for review
  2. Send staff to perform a penetration test of the provider's data center
  3. Request the provider's independent third-party audit reports covering those controls Correct answer.
  4. Install the customer's own monitoring agents on provider hypervisors

Explanation

Customers inherit provider controls rather than performing them, and they gain assurance through independent audit reports and certifications the provider publishes. Direct inspection or testing of provider facilities is normally not permitted. This inherited-control concept is central to the model.

Question 8Cloud Security Fundamentals and Shared Responsibility

Which statement about data classification duties in the cloud is most accurate?

  1. The customer classifies its data and chooses appropriate services and controls for each class Correct answer.
  2. Classification is unnecessary because the provider encrypts all data by default
  3. The provider classifies customer data and decides where it may be stored
  4. Classification is performed jointly by the provider and customer for every object

Explanation

Data classification is a customer responsibility because only the customer understands the sensitivity and regulatory context of its information. The customer then selects services and controls matched to each class. Providers offer capabilities such as encryption and key management, but they do not decide classification for the tenant.

Question 9Cloud Security Fundamentals and Shared Responsibility

An organization stores regulated data in a cloud service and must keep control of the encryption keys so the provider cannot read the data. Which approach aligns with customer responsibility for key management?

  1. Use a customer-managed key or external key store where the customer controls key lifecycle Correct answer.
  2. Rely on provider-managed keys with no customer involvement
  3. Store plaintext keys in the application configuration file
  4. Disable encryption to simplify access for administrators

Explanation

When regulation or policy requires the customer to hold cryptographic control, customer-managed keys or an external key store let the customer govern key lifecycle and revocation. Provider-managed keys are convenient but leave key control with the provider. Disabling encryption or embedding plaintext keys defeats the purpose entirely.

Question 10Cloud Security Fundamentals and Shared Responsibility

Which pair correctly matches a responsibility to the party that owns it in a typical IaaS deployment?

  1. Customer: guest OS patching; Provider: hypervisor patching Correct answer.
  2. Customer: hypervisor patching; Provider: guest OS patching
  3. Customer: physical host firmware; Provider: application hardening
  4. Customer: network backbone routing; Provider: firewall rule authoring in the guest

Explanation

In IaaS the provider patches the hypervisor and below, while the customer patches the guest operating system and above. This split is the defining characteristic of the IaaS boundary. Mixing the two layers inverts the model and is a common exam trap.

Question 11Cloud Security Fundamentals and Shared Responsibility

A developer grants a cloud function broad administrative permissions because it is easier to debug. Which shared responsibility failure does this represent?

  1. A provider failure to isolate tenants at the hypervisor layer
  2. A provider failure to patch the managed runtime
  3. A customer failure to physically secure the data center
  4. A customer failure to apply least privilege in its own configuration Correct answer.

Explanation

Identity and permission configuration for workloads is squarely a customer duty, even when the compute platform is fully managed. Overly broad permissions are a tenant-side misconfiguration, not a provider defect. Least privilege must be applied by the customer regardless of service model.

Question 12Cloud Security Fundamentals and Shared Responsibility

Which control is shared in the sense that the provider supplies a capability and the customer must configure it correctly?

  1. Physical media destruction at end of hardware life
  2. Firmware updates on provider storage arrays
  3. Cooling system maintenance in the provider facility
  4. Security groups and network access rules in a virtual network Correct answer.

Explanation

Some controls are described as shared because the provider delivers the mechanism while the customer must configure it appropriately. Network access rules are a classic example: the platform exists, but an overly permissive rule is the customer's misconfiguration. Facility and hardware lifecycle controls remain provider-only.

Question 13Cloud Security Fundamentals and Shared Responsibility

How does the shared responsibility model apply to a provider's managed database service compared with a self-hosted database on IaaS?

  1. The managed service removes all customer responsibility for data
  2. The self-hosted database makes the provider responsible for schema design
  3. Both models assign identical duties to the customer for OS patching
  4. The managed service shifts patching and platform maintenance to the provider while the customer keeps data and access control Correct answer.

Explanation

A managed database moves engine patching, backups infrastructure, and host maintenance to the provider. The customer still controls data content, user accounts, network exposure, and query-level access. In self-hosted IaaS the customer additionally patches the OS and database engine.

Question 14Cloud Security Fundamentals and Shared Responsibility

A regulator asks who is accountable for a data breach caused by an unpatched guest OS in IaaS. Under the shared responsibility model, who bears that duty?

  1. Both parties equally, since the model splits all duties in half
  2. The customer, because guest OS patching is a customer task in IaaS Correct answer.
  3. The provider, because it hosts the virtual machine
  4. Neither party, because the model does not address patching

Explanation

In IaaS the guest operating system sits above the provider-managed hypervisor, so patching it is the customer's duty. Accountability follows the boundary regardless of where the workload physically runs. The model does not divide duties equally; it assigns each layer to a specific party.

Question 15Cloud Security Fundamentals and Shared Responsibility

Which practice best demonstrates that a customer understands inherited controls in a cloud migration?

  1. Mapping provider audit reports to the controls the customer no longer operates directly Correct answer.
  2. Building a second data center to mirror the provider facility
  3. Duplicating the provider's hypervisor patching process
  4. Re-implementing physical access controls inside the cloud tenant

Explanation

Inherited controls are those the provider operates and the customer relies upon, so the customer's job is to map and document them against its control framework. Re-implementing provider-layer controls in the tenant wastes effort and creates confusion. The correct approach is evidence mapping, not duplication.

Question 16Cloud Security Fundamentals and Shared Responsibility

Which statement about the shared responsibility model and compliance is correct?

  1. Using a certified provider makes the customer automatically compliant with all regulations
  2. Provider certifications cover the provider's scope, and the customer must still meet its own obligations Correct answer.
  3. Customer compliance obligations disappear when using a SaaS service
  4. Compliance is entirely the provider's concern once data is in the cloud

Explanation

Provider attestations cover only the provider-controlled portion of the stack. The customer must still satisfy its own regulatory duties, such as access governance, data residency choices, and logging. Compliance is therefore a joint outcome, not something inherited wholesale.

Question 17Cloud Security Fundamentals and Shared Responsibility

A team wants to reduce the customer's patching burden for a web application. Which migration choice most directly shifts OS and middleware patching to the provider?

  1. Increasing the instance size of the existing virtual machines
  2. Moving from virtual machines to a managed application platform Correct answer.
  3. Adding a second availability zone to the current deployment
  4. Moving from one region to another within the same provider

Explanation

Adopting a managed application platform moves OS and middleware maintenance to the provider, leaving the customer focused on application code and configuration. Regional changes, instance resizing, and additional zones affect resilience and capacity, not the responsibility boundary. The service model, not the topology, determines who patches.

Question 18Cloud Security Fundamentals and Shared Responsibility

An auditor finds that the customer relies on provider disk encryption but never configured logging of key usage. Which conclusion is most defensible?

  1. The customer has a gap because monitoring its own key and access activity is a customer duty Correct answer.
  2. The provider failed its duty because it should log customer key usage automatically
  3. No gap exists because encryption at rest is sufficient on its own
  4. The gap belongs to the auditor, who should have configured logging

Explanation

Encryption at rest is a provider capability, but monitoring how keys and access are used in the tenant is a customer responsibility. Relying on encryption without visibility into key usage leaves a detection gap. The provider is not obligated to perform tenant-level monitoring on the customer's behalf.

Question 19Cloud Security Fundamentals and Shared Responsibility

Which scenario best illustrates a customer misjudging the responsibility boundary?

  1. The customer reviews provider audit reports annually
  2. The customer tags resources for cost allocation
  3. The customer enables multi-factor authentication for console access
  4. The customer assumes the provider's backup feature removes the need for any customer data protection strategy Correct answer.

Explanation

Assuming a provider backup feature fully discharges the customer's data protection duty is a boundary error. The customer must still define retention, verify restorability, and protect data from deletion or ransomware within its own scope. Enabling MFA, tagging, and reviewing reports are all appropriate customer actions.

Question 20Cloud Security Fundamentals and Shared Responsibility

In a hybrid architecture where on-premises systems connect to cloud services, how should responsibility be assessed?

  1. The provider becomes responsible for the on-premises systems once they connect to the cloud
  2. Responsibility is assessed per component and per service model, including the on-premises estate the customer still operates Correct answer.
  3. A single shared responsibility model covers the entire hybrid estate uniformly
  4. The customer is responsible for provider-managed cloud services in a hybrid design

Explanation

Hybrid environments contain components governed by different responsibility arrangements. The customer remains responsible for its on-premises systems while provider duties apply only to the cloud services consumed. Responsibility must therefore be mapped component by component rather than assumed uniform.

Question 21Cloud Security Fundamentals and Shared Responsibility

Which statement about logging responsibilities in a public cloud is correct?

  1. The customer decides what to log in its workloads and protects those logs from tampering Correct answer.
  2. Audit logs are unnecessary because the provider monitors all tenant activity
  3. The provider configures which application events the customer records
  4. Log retention is always handled by the provider on the customer's behalf

Explanation

The customer determines logging scope for its workloads and must protect log integrity, including retention and access control. Providers offer logging services and may record control-plane events, but they do not decide what application events matter to the tenant. Tamper resistance is a customer design decision.

Question 22Cloud Security Fundamentals and Shared Responsibility

What is the primary reason the shared responsibility model changes across IaaS, PaaS, and SaaS?

  1. Pricing structures differ between the service models
  2. The amount of the stack managed by the provider increases from IaaS to SaaS Correct answer.
  3. Regulatory requirements are identical for all service models
  4. Customers are required to manage more layers as services become more managed

Explanation

As services become more managed, the provider operates a larger portion of the stack, so the customer's share shrinks accordingly. This is why the boundary is not fixed and must be evaluated per service. Customers manage fewer, not more, layers as they move toward SaaS.

Question 23Cloud Security Fundamentals and Shared Responsibility

Which customer action best supports the principle that the customer remains accountable for its data wherever it resides?

  1. Encrypting sensitive data and restricting access to only required identities Correct answer.
  2. Assuming the provider will detect improper access to the data
  3. Removing access logging to reduce storage costs
  4. Delegating data ownership decisions to the provider's support team

Explanation

Data accountability stays with the customer regardless of hosting, so encryption and tight access control are core customer duties. The provider does not assume ownership of customer data or decide who should access it. Removing logging would weaken the customer's ability to detect misuse.

Question 24Cloud Security Fundamentals and Shared Responsibility

Which control belongs to the provider in a public cloud environment?

  1. Configuring the tenant's identity federation with the corporate directory
  2. Defining the password policy for the tenant's application users
  3. Approving which employees may access the tenant console
  4. Managing the hypervisor that isolates tenant virtual machines Correct answer.

Explanation

Hypervisor operation and tenant isolation are provider-layer controls that customers cannot perform themselves. Identity federation, application password policy, and console access approval are all tenant-level decisions. Confusing the two layers is a frequent source of misplaced expectations.

Question 25Cloud Security Fundamentals and Shared Responsibility

A startup argues it does not need a security program because its provider is certified. Which response is most accurate?

  1. The argument is invalid because the customer still owns configuration, identity, and data duties Correct answer.
  2. The argument is valid only when the data is encrypted
  3. The argument is valid because certification covers the entire stack
  4. The argument is valid only for SaaS services

Explanation

Provider certification addresses only the provider's portion of the shared responsibility model. The customer remains responsible for secure configuration, identity governance, and data protection in its own environment. Certification never covers tenant-side duties, in any service model.

Question 26Cloud Security Fundamentals and Shared Responsibility

In the Check Point shared responsibility model for public cloud, which responsibility always remains with the customer regardless of the service model (IaaS, PaaS, or SaaS)?

  1. Availability of the provider's global backbone network
  2. Accountability for the data and for how identities are granted access Correct answer.
  3. Physical security of the data center hosting the workload
  4. Patching of the hypervisor layer beneath guest virtual machines

Explanation

Across every cloud service model the customer keeps ownership and accountability for its data and for the access decisions it makes. The provider secures the facilities, virtualization layer, and backbone, but it never absorbs the customer's duty to control who can reach the data.

Question 27Cloud Security Fundamentals and Shared Responsibility

A company moves a workload from IaaS virtual machines to a provider-managed container platform. Which responsibility most clearly transfers from the customer to the provider?

  1. Patching the host operating system that runs the containers Correct answer.
  2. Classifying the sensitivity of the application data
  3. Defining which users may deploy images
  4. Configuring network security groups for the workload

Explanation

In a managed container platform the provider owns the underlying host operating system and its patching, while the customer still governs configuration, access, and data. Moving up the stack shifts operating-system maintenance to the provider but never shifts data classification or identity decisions.

Question 28Cloud Security Fundamentals and Shared Responsibility

Which artifact should a customer request from a cloud provider to obtain independent evidence about the provider's own controls without conducting its own audit of the provider's data centers?

  1. The customer's own vulnerability scan output for its cloud workloads
  2. The provider's marketing whitepaper on security architecture
  3. The provider's third-party audit attestation and certification reports Correct answer.
  4. The provider's internal penetration test report for the customer's tenant

Explanation

Independent attestations such as SOC 2 reports or ISO 27001 certificates give the customer evidence about the provider's controls without auditing the provider directly. These reports support the customer's own compliance program by documenting inherited controls.

Question 29Cloud Security Fundamentals and Shared Responsibility

A regulated firm stores customer records in a SaaS application and wants to ensure the provider cannot read the plaintext. Which approach keeps the firm's shared-responsibility obligation for data confidentiality under its own control?

  1. Enabling the provider's built-in access logging for administrators
  2. Relying on the provider's default at-rest encryption with provider-managed keys
  3. Asking the provider to sign a confidentiality clause in the contract
  4. Encrypting records with customer-managed keys held outside the provider's key store Correct answer.

Explanation

Holding keys outside the provider's key management boundary means the provider cannot decrypt the data even with full infrastructure access. Contract clauses and provider-managed encryption shift operational trust to the provider rather than keeping the confidentiality control with the customer.

Question 30Cloud Security Fundamentals and Shared Responsibility

A security architect is mapping controls for a new IaaS deployment. Which item belongs to the provider rather than the customer?

  1. Defining inbound firewall rules for the guest
  2. Administering operating-system user accounts
  3. Managing the hypervisor and its firmware Correct answer.
  4. Hardening the guest operating system image

Explanation

In IaaS the provider operates the virtualization layer, including the hypervisor and its firmware, while the customer controls everything inside the guest. Guest hardening, guest firewalls, and guest account administration all fall to the customer.

Question 31Cloud Security Fundamentals and Shared Responsibility

A team deploys a serverless function with an overly permissive role because broad permissions simplified testing. Which shared-responsibility failure does this represent?

  1. The customer failed to patch the runtime that executes the function
  2. The provider failed to restrict the identity permissions available to the tenant
  3. The customer failed to apply least privilege to the identities it controls Correct answer.
  4. The provider failed to isolate the function from other tenants

Explanation

Identity and access configuration for workloads the customer deploys is a customer responsibility, and excessive permissions are a customer-side least-privilege failure. The provider supplies the identity primitives but does not decide which permissions the customer's function receives.

Question 32Cloud Security Fundamentals and Shared Responsibility

Which control is best described as shared, where the provider delivers a capability and the customer must enable or configure it properly?

  1. Encryption at rest offered as a toggle in the storage console Correct answer.
  2. Power redundancy in the provider's facility
  3. Background checks for the provider's operations staff
  4. Physical badge access to the provider's data hall

Explanation

Encryption at rest is a provider capability that only protects data once the customer enables it and configures keys and rotation appropriately, making it a shared control. Facility access, power redundancy, and staff screening are entirely provider-owned.

Question 33Cloud Security Fundamentals and Shared Responsibility

How does the customer's patching obligation differ between a provider-managed database service and a self-managed database on IaaS?

  1. The managed service shifts engine and host patching to the provider, leaving schema and access tuning to the customer Correct answer.
  2. Neither model requires patching because the provider secures the storage layer
  3. Both require the customer to patch the database engine and the host operating system
  4. The self-managed database shifts engine patching to the provider while the customer patches the host

Explanation

With a managed database the provider patches the engine and underlying host, while the customer still owns schema design, data, and access configuration. On IaaS the customer patches both the guest operating system and the database engine itself.

Question 34Cloud Security Fundamentals and Shared Responsibility

A breach results from an unpatched guest operating system on an IaaS virtual machine. Under the shared responsibility model, who is accountable?

  1. The customer, because the guest operating system is within its control boundary Correct answer.
  2. Neither party, because the vulnerability originated in third-party software
  3. Both parties equally, because patching is always a shared control
  4. The provider, because it supplies the virtualization platform

Explanation

The guest operating system in IaaS sits inside the customer's control boundary, so its patching and the resulting accountability belong to the customer. The provider is responsible only for the layers beneath the guest, such as the hypervisor and physical host.

Question 35Cloud Security Fundamentals and Shared Responsibility

During a cloud migration an architect documents which controls the organization inherits from the provider. Which practice best demonstrates a correct understanding of inherited controls?

  1. Replacing the organization's own access reviews with the provider's audit report
  2. Assuming all provider certifications apply identically to every service the organization uses
  3. Recording the provider attestation as evidence and confirming the control's scope matches the workload Correct answer.
  4. Removing the control from the risk register because the provider now covers it

Explanation

Inherited controls must be mapped to the specific service and evidenced by the provider's attestation, with scope verified against the workload. The customer retains responsibility for controls outside the attestation scope and for its own identity and data controls.

Question 36Cloud Security Fundamentals and Shared Responsibility

Which statement about compliance in the shared responsibility model is most accurate?

  1. A provider certification makes the customer's workload compliant automatically
  2. Compliance obligations end at the provider's boundary once data is stored in the cloud
  3. Compliance is a joint outcome: the provider's attestations cover its layers while the customer must evidence its own controls Correct answer.
  4. The customer is responsible for auditing the provider's internal control environment directly

Explanation

Compliance in cloud is achieved jointly: the provider evidences the controls it operates, and the customer must evidence the controls it retains, such as access management and data handling. A provider certificate covers only the provider's portion of the stack.

Question 37Cloud Security Fundamentals and Shared Responsibility

A team wants to reduce its own patching burden for a custom web application. Which migration choice most directly shifts maintenance work to the provider?

  1. Adding a web application firewall in front of the IaaS deployment
  2. Moving the application to a larger IaaS instance type
  3. Keeping the application on IaaS but enabling automatic guest updates
  4. Moving the application to a managed platform service that handles runtime patching Correct answer.

Explanation

A managed platform service takes over runtime and host maintenance, so the customer no longer patches the operating system or runtime. Larger instances and added firewalls change capacity or filtering but leave the patching duty with the customer.

Question 38Cloud Security Fundamentals and Shared Responsibility

A customer relies on provider disk encryption but never configured logging or alarms for key usage. Which shared-responsibility gap does this reveal?

  1. The customer treated an inherited capability as complete without monitoring its own key-related activity Correct answer.
  2. The provider failed to enable encryption by default on the volume
  3. The provider failed to notify the customer about key management events
  4. The customer should have disabled encryption to avoid key management overhead

Explanation

Encryption is a shared control: the provider supplies the mechanism, but the customer must configure keys and monitor their use. Absent key-usage monitoring, the customer has not fulfilled its side of the shared control even though encryption is active.

Question 39Cloud Security Fundamentals and Shared Responsibility

In a hybrid design where on-premises systems call cloud APIs, how should responsibility be allocated?

  1. Each party remains responsible for its own environment, and the customer owns the integration and identity controls across the boundary Correct answer.
  2. The customer becomes responsible for the provider's API infrastructure because it consumes the service
  3. The provider becomes responsible for the on-premises systems once they connect to the cloud
  4. Responsibility is undefined until a formal joint venture is created

Explanation

Hybrid architectures do not merge responsibility boundaries: the provider secures its cloud services while the customer secures on-premises systems and the connecting identity, network, and integration controls. The customer must govern credentials and data flows that cross the boundary.

Question 40Cloud Security Fundamentals and Shared Responsibility

Which logging responsibility typically belongs to the customer in a public cloud deployment?

  1. Enabling and reviewing audit logs for the customer's own cloud accounts and services Correct answer.
  2. Retaining provider control-plane logs indefinitely on the customer's behalf
  3. Capturing hypervisor-level events on the physical host
  4. Generating power and cooling telemetry for the provider's data hall

Explanation

The customer must enable service and account audit logging, protect those logs, and review them for suspicious activity. Hypervisor events, provider control-plane retention, and facility telemetry remain provider responsibilities.

Question 41Check Point CloudGuard Network Security Deployment in Public Clouds

In a Check Point CloudGuard deployment in AWS, which component is deployed inside the VPC to inspect traffic between subnets and to the internet?

  1. An AWS Network ACL policy set
  2. A Security Gateway cluster member instance Correct answer.
  3. A Route 53 resolver rule
  4. A CloudTrail trail

Explanation

CloudGuard Network Security in AWS is built around Security Gateway instances (typically clustered) deployed into the VPC, which inspect north-south and east-west traffic. AWS-native constructs such as NACLs, Route 53 and CloudTrail provide routing, DNS and logging but no Check Point threat inspection.

Question 42Check Point CloudGuard Network Security Deployment in Public Clouds

Which Check Point component manages CloudGuard Gateway instances and stores the security policy in a public cloud deployment?

  1. The Security Management Server or MDS Correct answer.
  2. The AWS Config aggregator
  3. The cloud provider's load balancer
  4. The Gateway's local routing table

Explanation

Gateways installed in public clouds are managed by a Security Management Server (or Multi-Domain Server), which holds the policy and pushes it to the gateways. Cloud-native services and the gateway's own routing table do not hold or distribute Check Point policy.

Question 43Check Point CloudGuard Network Security Deployment in Public Clouds

What is the purpose of the Gateway Load Balancer endpoint in an AWS CloudGuard deployment?

  1. To terminate TLS sessions for the management server
  2. To provide DNS resolution for gateway instances
  3. To attract traffic from spoke VPCs to the security VPC for inspection Correct answer.
  4. To store gateway backups in S3

Explanation

A GWLB endpoint in each spoke VPC makes the security VPC's Gateway Load Balancer appear as a next hop, so route tables can steer traffic through CloudGuard gateways transparently. It does not handle TLS termination, DNS, or backup storage.

Question 44Check Point CloudGuard Network Security Deployment in Public Clouds

When deploying CloudGuard in Azure, which resource is used to insert the gateway into the traffic path of a workload subnet?

  1. A network security group applied to the gateway NIC
  2. A user-defined route pointing to the gateway's private IP Correct answer.
  3. An Azure DNS private zone
  4. A storage account firewall rule

Explanation

In Azure, traffic steering is done with user-defined routes (UDRs) that set the next hop to the CloudGuard gateway's private IP or internal load balancer. NSGs filter traffic but do not redirect it, and DNS zones and storage firewalls are unrelated to path insertion.

Question 45Check Point CloudGuard Network Security Deployment in Public Clouds

Which deployment template type is used to launch CloudGuard Network Security gateways in a public cloud with a single click from the marketplace?

  1. A manual RPM install on a Linux jump host
  2. A bare-metal ISO installation on a physical server
  3. A container image run with docker run
  4. A cloud marketplace/community image with a CloudFormation or ARM template Correct answer.

Explanation

Check Point publishes marketplace images packaged with infrastructure-as-code templates (CloudFormation for AWS, ARM for Azure) that automate VPC/VNet, gateway and management wiring. Bare-metal, manual RPM and plain container approaches are not the standard cloud marketplace deployment method.

Question 46Check Point CloudGuard Network Security Deployment in Public Clouds

In a CloudGuard AWS cluster, what is the role of the cluster's Virtual IP (VIP)?

  1. It is the public DNS name of the management server
  2. It is the address of the S3 endpoint
  3. It is the address to which traffic is directed and that fails over between cluster members Correct answer.
  4. It is the address used only for SSH administration of each member

Explanation

The cluster VIP is a floating address owned by the active member and moved to the standby on failover, so route targets and clients keep a stable next hop. It is not an admin-only address, a management DNS name, or a storage endpoint.

Question 47Check Point CloudGuard Network Security Deployment in Public Clouds

Why does CloudGuard recommend enabling source/destination check preservation settings or using a load balancer in front of gateways in AWS?

  1. Because AWS requires it to enable CloudWatch metrics
  2. Because instances used as next hops must be able to receive traffic not addressed to their own NIC Correct answer.
  3. Because it disables the gateway's firewall blades
  4. Because it forces all traffic through the management server

Explanation

When a gateway receives traffic via routing, packets are addressed to other hosts; the source/destination check must be disabled (or a GWLB used) so AWS does not drop them. This setting has nothing to do with metrics, blade state, or management traffic.

Question 48Check Point CloudGuard Network Security Deployment in Public Clouds

Which CloudGuard feature lets a gateway in one cloud inspect traffic from VPCs or VNets in multiple accounts without deploying a gateway in each?

  1. Host-based agents on every workload
  2. Per-account standalone gateways with no shared routing
  3. Centralized inspection through a shared security VPC/VNet with peering or transit gateway Correct answer.
  4. Cloud provider native firewall only

Explanation

A hub security VPC/VNet connected via VPC peering, Transit Gateway or VNet peering lets one CloudGuard cluster inspect many spokes. Standalone per-account gateways, host agents, and native firewalls are alternative models but not the centralized shared-inspection design described.

Question 49Check Point CloudGuard Network Security Deployment in Public Clouds

What must be configured so that a CloudGuard gateway in AWS can be reached by the Security Management Server for policy installation?

  1. The gateway's management interface must have a route and security group rules allowing SIC from the management server Correct answer.
  2. The gateway's data interfaces must have public IPs
  3. The gateway must be placed behind the GWLB only
  4. The management server must be in the same subnet as the gateway

Explanation

Policy installation uses Secure Internal Communication (SIC) over the management interface, which requires reachability and security group rules permitting it. Placement behind a GWLB, public data IPs, or co-location in the same subnet are not requirements.

Question 50Check Point CloudGuard Network Security Deployment in Public Clouds

Which statement describes how CloudGuard gateways are typically scaled in AWS to handle higher throughput?

  1. Increase the number of NACLs on the subnet
  2. Add cluster members or scale the instance type, and use GWLB for load distribution Correct answer.
  3. Add more Route 53 hosted zones
  4. Enable versioning on the S3 bucket

Explanation

Throughput scales by choosing larger instance types and adding cluster members, with the Gateway Load Balancer distributing flows across them. NACLs, DNS zones and S3 versioning do not add inspection capacity.