Check Point CCME cheat sheet
Check Point CCME · Keep the key ideas within reach.
Check Point Product and Solution Portfolio Scope
Three architecture layers: Security Management (SmartConsole, R80.x/Quantum management servers, MDS), Security Gateways (Quantum appliances, CloudGuard, Harmony endpoint), and Security Operations (SmartEvent, SmartLog, Infinity Vision, ThreatCloud).
Infinity Portal is the single cloud-based console unifying Quantum, CloudGuard, Harmony, and Horizon; Infinity Events correlates across products into one incident view.
Quantum = network security, CloudGuard = cloud-native security posture and workload protection, Harmony = user/endpoint/browser security (SASE), Horizon = managed threat prevention for small/medium businesses.
SmartConsole is the GUI client for management servers; R81.20 is the long-supported release line referenced in CCME material; API access is via Management API (REST) and Gaia API.
Infinity Vision is the exposure-management and attack-surface product; ThreatCloud AI is the shared threat-intelligence backend feeding all gateways.
Quantum Maestro (formerly 41000/61000 hyperscale) and Quantum Scalable Chassis are the high-throughput virtual-system appliances; Quantum Lightspeed is the ASIC-accelerated line.
Order of operations for a design question: identify layer (management/gateway/ops), then deployment (on-prem, cloud, SASE), then the product name that fits.
Hybrid Mesh Network Security and Firewall Platforms
Hybrid Mesh = policy-managed fabric combining on-prem Quantum gateways, cloud VMs, and remote users/branches under one management domain, with the same policy enforced everywhere.
Quantum Security Gateway is the enforcement point; each gateway runs a Security Policy installed from a management server; the gateway's software blade set determines which inspections run.
Software blades include Firewall, IPS, Application Control, URL Filtering, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction, Identity Awareness, IPsec VPN, and Mobile Access.
Policy installation flow: install policy on management server -> gateway receives policy -> gateway compiles and loads; failures are logged in SmartConsole install status and in $FWDIR/log/fwd.elg.
Threat Prevention profile binds IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction; the profile is attached to the gateway or rule, not to the blade individually.
Identity Awareness uses AD Query, LDAP, RADIUS, Captive Portal, or Identity Agent to map IP to user; without it, user-based rules cannot match.
Site-to-site VPN uses IKE/IPsec with a community object; Remote Access VPN uses Mobile Access or Endpoint Security VPN client; both are configured under the gateway's VPN blade.
ClusterXL (High Availability or Load Sharing) and VSX (Virtual Systems) are the two scaling modes for gateway redundancy and multi-tenancy; Maestro extends this to chassis-level scaling.
Gaia is the gateway OS; clish is the default shell, expert mode is bash; cpconfig, sysconfig, and cpview are the core operational tools.
Cloud, SASE and Workspace Security
CloudGuard product family: CloudGuard Network Security (gateway VMs in AWS/Azure/GCP), CloudGuard Posture Management (CSPM), CloudGuard Workload Protection (CWPP), and CloudGuard AppSec (web application and API protection).
CloudGuard Network Security is deployed as an autoscaling gateway cluster behind a load balancer, or as a single gateway; management can be on-prem Quantum or CloudGuard Dome9/Infinity Portal.
SASE = network security + secure remote access delivered as a cloud service; Check Point's SASE component is Harmony SASE (formerly Perimeter 81), covering ZTNA, SWG, CASB, DLP, and SD-WAN.
Harmony portfolio: Harmony Endpoint (EDR/EPP), Harmony Email & Collaboration (formerly Avanan, API-based for M365/Google), Harmony Browse (browser extension), Harmony Mobile, Harmony SASE.
Harmony Email & Collaboration is API-based, not MX-based: it connects to the mail provider's API and inspects mail after delivery, so it does not require mail-flow changes.
Workspace security = protecting the user's device and browser session: Harmony Endpoint for the device, Harmony Browse for the browser, Harmony SASE for the network path.
Zero Trust decision rule: identity + device posture + context are evaluated before access; ZTNA replaces VPN by brokering per-application tunnels.
Exposure Management, Threat Intelligence and AI Security
Infinity Vision (formerly CloudGuard Posture Management / CNAPP) provides exposure management: asset discovery, attack-surface mapping, risk prioritization, and remediation guidance across on-prem, cloud, and SaaS.
Exposure management differs from vulnerability scanning: it prioritizes by exploitability and business impact (attack paths, internet exposure, identity risk), not by raw CVSS count.
ThreatCloud AI is Check Point's shared intelligence cloud: it aggregates feeds from gateways, endpoints, sensors, and research teams, and serves verdicts to all products.
ThreatCloud AI components include ThreatWiki, IPS/AV signatures, reputation services, sandbox (Threat Emulation) verdicts, and AI-driven anomaly detection.
Threat Emulation runs suspicious files in a sandbox; Threat Extraction strips active content and delivers a safe reconstructed file immediately, then delivers the original if clean.
AI security in Check Point scope covers two directions: protecting AI workloads (prompt/LLM guardrails, model and data exposure) and using AI in detection (ThreatCloud AI, Infinity Vision risk scoring).
Infinity Events is the correlation layer that turns product telemetry into prioritized incidents; it consumes logs from Quantum, CloudGuard, Harmony, and third-party sources.
Check Point Services, Support and Training Programs
Support tiers: Standard, Premium, and Elite; higher tiers add faster response SLAs, 24x7 coverage, and named technical account management.
Collaborative Enterprise Support (CES) and Collaborative Support are the proactive support programs: they include health checks, upgrade planning, and a designated support engineer.
Check Point Professional Services delivers design, deployment, migration, and optimization engagements; it is separate from the support contract.
Infinity Portal is the customer-facing portal for licenses, support cases, entitlements, and product downloads.
Training paths: Check Point Certified Security Administrator (CCSA), Security Expert (CCSE), and the CCME-level expert track; official courses are delivered via Check Point Authorized Training Centers (ATC).
Check Point Mind is the learning platform hosting official courses, labs, and certification exams.
Certification exams are delivered through Pearson VUE; the CCME track requires the prerequisite CCSA and CCSE certifications before the expert exam.
User Center (now Infinity Portal) is where partner and customer entitlements, license contracts, and support agreements are managed.
Check Point Product and Solution Portfolio Scope
Infinity Portal consolidates management of Quantum, CloudGuard, Harmony, and Horizon under one cloud console; it is the entry point for cross-product visibility.
Quantum is the network security platform: gateways, management, and the SmartConsole toolset; it is the product family most CCME questions anchor on.
CloudGuard is the cloud security platform: posture management, workload protection, network security, and application security for cloud environments.
Harmony is the user and access security platform: endpoint, email, browser, mobile, and SASE; it protects the user wherever they work.
Horizon is the managed security offering for SMB, delivered as a service with Check Point managing the gateways.
ThreatCloud AI is the shared intelligence layer beneath all four platforms; it is not a standalone product but the backend that feeds verdicts.
Infinity Vision is the exposure-management product; Infinity Events is the incident-correlation product; both sit above the platform products.
Hybrid Mesh Network Security and Firewall Platforms
A Hybrid Mesh design question usually asks: which gateways share policy, where management lives, and how remote users and branches connect; answer in that order.
Security Gateway blades are enabled per gateway object in SmartConsole; a blade enabled on the object still needs a matching rule and a Threat Prevention profile to act.
Policy install failure triage: check install status in SmartConsole, then fwd.elg on the gateway, then verify SIC (Secure Internal Communication) between management and gateway.
SIC uses certificates issued by the management server's internal CA; a gateway with a broken SIC cannot fetch policy or send logs.
ClusterXL High Availability uses one active member and one standby; Load Sharing distributes connections across members; both need a cluster object and a synchronization network.
VSX creates virtual systems on one physical gateway, each with its own policy and interfaces; it is used for multi-tenant or large-scale segmentation.
Gaia clish commands: show configuration, set interface, add static-route, save config; expert mode exposes cpview for real-time performance counters.
Cloud, SASE and Workspace Security
CloudGuard Network Security autoscaling in AWS uses a Gateway Load Balancer or a cluster behind an ELB; the management server can be on-prem or in the cloud.
CloudGuard Posture Management evaluates cloud accounts against compliance frameworks (CIS, PCI DSS, SOC 2) and surfaces misconfigurations as findings.
Harmony SASE delivers ZTNA, secure web gateway, CASB, DLP, and SD-WAN from a cloud edge; it replaces traditional remote-access VPN for hybrid work.
Harmony Email & Collaboration is API-based and works with Microsoft 365 and Google Workspace; it inspects internal and external mail without MX changes.
Harmony Endpoint provides EPP plus EDR; the management is either on-prem (Endpoint Security Management Server) or cloud (Harmony Endpoint cloud console).
Harmony Browse is a browser extension that enforces safe browsing and zero-trust access at the browser level, independent of the network.
Workspace security rule: device protection (Endpoint), browser protection (Browse), and network path protection (SASE) are three separate controls; a question naming one does not imply the others.
Exposure Management, Threat Intelligence and AI Security
Infinity Vision ingests cloud, on-prem, and SaaS assets, builds an attack-path graph, and ranks exposures by exploitability and blast radius.
Prioritization inputs include internet-facing exposure, known exploited vulnerabilities, identity and permission risk, and data sensitivity.
ThreatCloud AI delivers verdicts to gateways via reputation and signature updates; gateways query it for URLs, files, and IPs.
Threat Extraction vs Threat Emulation: Extraction delivers a sanitized file immediately; Emulation detonates in a sandbox and blocks if malicious; both can run together in a Threat Prevention profile.
AI security has two axes: securing AI (prompt injection, data leakage, model access) and AI-assisted defense (anomaly detection, risk scoring).
Infinity Events correlates logs from multiple products into incidents; SmartEvent is the on-prem correlation engine, Infinity Events the cloud-delivered view.
Check Point Services, Support and Training Programs
Support SLA tiers escalate response time and coverage: Standard (business hours), Premium (24x7 with faster response), Elite (highest priority plus named resources).
Collaborative Support programs add proactive services: health monitoring, upgrade assistance, and a designated engineer; they are add-ons to the base support contract.
Professional Services engagements are project-based (design, migration, optimization) and are contracted separately from support.
Infinity Portal handles license and entitlement management, support case creation, and software downloads for customers and partners.
Certification ladder: CCSA (administration) -> CCSE (expert) -> CCME (master/expert level); each exam is delivered through Pearson VUE.
Check Point Mind hosts official e-learning, instructor-led courses, and lab environments; Authorized Training Centers deliver the same curriculum in person.
Partner tiers (e.g., 3-Star, 4-Star, 5-Star) determine discount levels and support entitlements; partner program details live in the Partner Portal.
Check Point Product and Solution Portfolio Scope
Map a scenario to a platform first: network -> Quantum, cloud -> CloudGuard, user -> Harmony, SMB managed -> Horizon, exposure -> Infinity Vision, intelligence -> ThreatCloud AI.
SmartConsole manages Quantum and CloudGuard gateways; Harmony has its own consoles (Endpoint, Email, SASE) surfaced in Infinity Portal.
The Infinity Portal is the common login for cloud-delivered services; on-prem management servers are accessed via SmartConsole, not the portal.
Quantum appliances include the 3000/5000/6000/7000/9000/16000/26000 series; higher numbers indicate higher throughput and blade capacity.
CloudGuard Dome9 is the legacy name for CloudGuard Posture Management; CCME questions may use either name.
Perimeter 81 is the legacy name for Harmony SASE; Avanan is the legacy name for Harmony Email & Collaboration; know both names.
A product-scope question that names a capability (e.g., 'sandboxing') should be answered with the product that owns it (Threat Emulation under Quantum Threat Prevention), not the platform.
Hybrid Mesh Network Security and Firewall Platforms
Hybrid Mesh unifies policy across data center, cloud, branch, and remote user; the management server is the single source of policy truth.
Rule order matters: first matching rule wins for accept/drop; Threat Prevention profiles apply after the rule matches, so a drop rule never reaches inspection.
NAT is configured in the gateway's NAT rulebase or as automatic NAT on the object; automatic NAT creates both original and translated rules.
Logging: SmartLog is the query interface, SmartEvent the correlation engine; both read from the management server's log repository or a dedicated log server.
Backup and restore: upgrade_tools / migrate export on management, snapshot on Gaia; a snapshot captures the whole appliance, migrate captures the configuration.
Gateway health: cpview shows CPU, memory, connections, and blade counters in real time; top and free are the expert-mode equivalents.
SIC reset requires re-initialization on the gateway and re-establishing trust from SmartConsole; do this before deeper policy troubleshooting.
Cloud, SASE and Workspace Security
CloudGuard AppSec protects web applications and APIs; it is deployed as an inline or out-of-path proxy and is distinct from CloudGuard Network Security.
CloudGuard Workload Protection (CWPP) covers container and serverless runtime protection and image scanning; it is not the same as posture management (CSPM).
Harmony SASE zero-trust access brokers per-application connections after identity and device-posture checks; it does not place the user on the corporate network.
Harmony Email & Collaboration detects phishing, malware, and account takeover via API; remediation actions include quarantine, link rewriting, and mailbox cleanup.
Harmony Mobile protects iOS and Android with app reputation, network protection, and phishing defense; it is managed from the same Harmony consoles.
SASE vs VPN decision rule: VPN grants network-level access; SASE/ZTNA grants application-level access with continuous verification.
Cloud posture findings are prioritized by severity and exposure; a public bucket with sensitive data outranks an internal misconfiguration.
Exposure Management, Threat Intelligence and AI Security
Exposure management lifecycle: discover assets -> map attack paths -> prioritize by risk -> remediate -> verify; Infinity Vision covers the first four.
Risk scoring blends exploitability (known exploited, public exploit), exposure (internet-facing), and impact (data sensitivity, permissions).
ThreatCloud AI feeds: IPS signatures, AV signatures, URL reputation, IP reputation, sandbox verdicts, and AI models; updates are pushed to gateways automatically.
Threat Prevention profile modes: Prevent, Detect, and Inactive; Prevent blocks, Detect logs only; the profile mode overrides per-blade defaults.
AI security guardrails address prompt injection, sensitive-data leakage to models, and unauthorized model/API access; they are distinct from classic DLP.
Infinity Events and SmartEvent both correlate; SmartEvent is on-prem, Infinity Events is the cloud-delivered cross-product view.
Check Point Services, Support and Training Programs
Support contract entitlements include software updates, firmware, and access to ThreatCloud AI feeds; a lapsed contract stops signature updates.
The Infinity Portal support case flow: open case -> attach diagnostics (cpinfo) -> assign severity -> track SLA; cpinfo is the standard diagnostic bundle.
Collaborative Enterprise Support (CES) is the highest proactive program: named engineer, quarterly reviews, and upgrade planning.
Professional Services offerings include migration (e.g., from competitor firewalls), optimization, and design review; they are scoped per project.
Training curriculum: CCSA covers deployment and management basics; CCSE covers advanced blades and troubleshooting; CCME covers architecture and cross-product design.
Exam registration is through Pearson VUE; the certification record and badge are managed in the Check Point certification portal.
Partner enablement includes the Partner Portal for deal registration, tier requirements, and technical enablement paths.
Check Point Product and Solution Portfolio Scope
Quantum = network security platform (gateways + management + SmartConsole).
CloudGuard = cloud security platform (CSPM, CWPP, network security, AppSec).
Harmony = user and access security platform (endpoint, email, browser, mobile, SASE).
Horizon = managed security service for SMB, delivered and operated by Check Point.
Infinity Vision = exposure management; Infinity Events = incident correlation; Infinity Portal = unified cloud console.
ThreatCloud AI = shared intelligence backend feeding all platforms; it is not sold as a standalone product.
Legacy names to recognize: Dome9 = CloudGuard Posture Management; Perimeter 81 = Harmony SASE; Avanan = Harmony Email & Collaboration; 41000/61000 = Maestro appliances.
Hybrid Mesh Network Security and Firewall Platforms
A gateway object in SmartConsole holds the blades, interfaces, VPN settings, and NAT; the policy rulebase references the gateway by name.
Threat Prevention is applied via a profile on the gateway or on a rule; rule-level profiles override gateway-level profiles for matching traffic.
Identity Awareness sources: AD Query (agentless, reads DC logs), LDAP, RADIUS, Captive Portal, Identity Agent; AD Query is the most common for user-based rules.
VPN communities define which gateways and users can build tunnels; a community object references gateways and a shared secret or certificate.
ClusterXL requires a cluster object, a sync interface, and identical policy on all members; a member out of sync shows as 'Ready' but not 'Active'.
Gaia backup vs snapshot: backup captures configuration only and is portable; snapshot captures the full disk and is appliance-specific.
cpinfo collects logs and configuration for support; run it before opening a case.
Cloud, SASE and Workspace Security
CloudGuard Network Security in Azure uses an availability set or VMSS behind an Azure Load Balancer; in AWS, a Gateway Load Balancer or ELB with autoscaling groups.
CloudGuard Posture Management connects to cloud accounts via read-only roles and continuously evaluates against compliance frameworks.
Harmony SASE components: ZTNA, SWG, CASB, DLP, and SD-WAN, all delivered from the SASE cloud edge.
Harmony Email & Collaboration API integration requires admin consent in M365 or Google Workspace; no MX record change is needed.
Harmony Endpoint cloud management removes the need for an on-prem Endpoint Security Management Server; both options exist.
Harmony Browse enforces zero-trust access and safe browsing at the browser, useful for unmanaged or BYOD devices.
Workspace security controls are layered: device (Endpoint), browser (Browse), email (Email & Collaboration), network (SASE); a question naming one control does not imply the others.
Exposure Management, Threat Intelligence and AI Security
Infinity Vision attack-path analysis links identities, permissions, and network reachability to show how an attacker could reach sensitive data.
Exposure prioritization factors: internet exposure, known exploited vulnerability status, privilege level, and data classification.
ThreatCloud AI is queried at runtime for URL, IP, and file reputation; verdicts are cached and updated via signature feeds.
Threat Extraction reconstructs a safe file by removing active content; Threat Emulation detonates in a sandbox; both are part of Threat Prevention.
AI security covers protecting AI workloads (prompt injection, data leakage, model access) and using AI for defense (anomaly detection, risk scoring).
SmartEvent (on-prem) and Infinity Events (cloud) both correlate multi-product logs into incidents; the difference is deployment, not function.
Check Point Services, Support and Training Programs
Support tiers: Standard, Premium, Elite; higher tiers add faster response, 24x7 coverage, and named resources.
Collaborative Support and Collaborative Enterprise Support are proactive add-ons: health checks, upgrade planning, designated engineer.
Professional Services is project-based (design, migration, optimization) and contracted separately from support.
Infinity Portal manages licenses, entitlements, support cases, and downloads for customers and partners.
Certification ladder: CCSA -> CCSE -> CCME; exams delivered via Pearson VUE; prerequisites apply before the expert exam.
Check Point Mind hosts official courses and labs; Authorized Training Centers deliver instructor-led training.
Partner tiers (3/4/5-Star) set discount levels and support entitlements; details are in the Partner Portal.
Check Point Product and Solution Portfolio Scope
Platform mapping: network -> Quantum; cloud -> CloudGuard; user -> Harmony; SMB managed -> Horizon; exposure -> Infinity Vision; intelligence -> ThreatCloud AI.
SmartConsole manages Quantum and CloudGuard gateways; Harmony consoles are separate and surfaced in Infinity Portal.
Infinity Portal is the common cloud login; on-prem management servers use SmartConsole, not the portal.
Quantum appliance series: 3000/5000/6000/7000/9000/16000/26000; higher numbers mean higher throughput and blade capacity.
Legacy names: Dome9 = CloudGuard Posture Management; Perimeter 81 = Harmony SASE; Avanan = Harmony Email & Collaboration.
A capability question (e.g., sandboxing) maps to the owning product (Threat Emulation), not the platform.
Maestro (41000/61000) and Scalable Chassis are the hyperscale appliances; Lightspeed is the ASIC-accelerated line.
Hybrid Mesh Network Security and Firewall Platforms
Hybrid Mesh unifies policy across data center, cloud, branch, and remote user; the management server is the single policy source.
First matching rule wins for accept/drop; Threat Prevention runs after a rule matches, so drop rules bypass inspection.
NAT: automatic NAT on the object creates original and translated rules; manual NAT is in the gateway NAT rulebase.
SmartLog queries logs; SmartEvent correlates them; both read from the management or dedicated log server.
Backup vs snapshot: backup = configuration only, portable; snapshot = full disk, appliance-specific.
cpview shows real-time CPU, memory, connections, and blade counters; top and free are expert-mode equivalents.
SIC reset: re-initialize on the gateway, then re-establish trust from SmartConsole before further troubleshooting.
Cloud, SASE and Workspace Security
CloudGuard AppSec protects web apps and APIs as an inline or out-of-path proxy; it is separate from CloudGuard Network Security.
CloudGuard Workload Protection (CWPP) covers containers and serverless runtime plus image scanning; CSPM covers posture, not runtime.
Harmony SASE ZTNA brokers per-application connections after identity and posture checks; it does not put the user on the corporate network.
Harmony Email & Collaboration is API-based and detects phishing, malware, and account takeover; remediation includes quarantine and mailbox cleanup.
Harmony Mobile protects iOS/Android with app reputation, network protection, and phishing defense.
SASE vs VPN: VPN = network-level access; SASE/ZTNA = application-level access with continuous verification.
Cloud posture findings are prioritized by severity and exposure; public sensitive data outranks internal misconfiguration.
Exposure Management, Threat Intelligence and AI Security
Exposure lifecycle: discover -> map attack paths -> prioritize -> remediate -> verify; Infinity Vision covers discovery through remediation guidance.
Risk score = exploitability (known exploited, public exploit) x exposure (internet-facing) x impact (data sensitivity, permissions).
ThreatCloud AI feeds IPS/AV signatures, URL and IP reputation, sandbox verdicts, and AI models; updates push automatically to gateways.
Threat Prevention modes: Prevent (block), Detect (log only), Inactive; the profile mode overrides per-blade defaults.
AI guardrails address prompt injection, sensitive-data leakage to models, and unauthorized model/API access; distinct from classic DLP.
SmartEvent is the on-prem correlation engine; Infinity Events is the cloud-delivered cross-product view.
Check Point Services, Support and Training Programs
Support contract entitlements include software updates, firmware, and ThreatCloud AI feeds; a lapsed contract stops signature updates.
Support case flow: open in Infinity Portal -> attach cpinfo -> set severity -> track SLA.
Collaborative Enterprise Support (CES) is the top proactive program: named engineer, quarterly reviews, upgrade planning.
Professional Services: migration, optimization, design review; scoped per project and separate from support.
Training: CCSA (deployment/management), CCSE (advanced blades/troubleshooting), CCME (architecture and cross-product design).
Exam registration via Pearson VUE; certification records and badges live in the Check Point certification portal.
Partner Portal handles deal registration, tier requirements, and technical enablement.
Check Point Product and Solution Portfolio Scope
Quantum = network security platform (gateways, management, SmartConsole).
CloudGuard = cloud security platform (CSPM, CWPP, network security, AppSec).
Harmony = user/access security platform (endpoint, email, browser, mobile, SASE).
Horizon = managed security service for SMB, operated by Check Point.
Infinity Vision = exposure management; Infinity Events = incident correlation; Infinity Portal = unified cloud console.
ThreatCloud AI = shared intelligence backend; not a standalone product.
Legacy names: Dome9, Perimeter 81, Avanan, 41000/61000 (Maestro).
Hybrid Mesh Network Security and Firewall Platforms
Gateway object holds blades, interfaces, VPN, and NAT; the rulebase references the gateway by name.
Threat Prevention profile on a rule overrides the gateway-level profile for matching traffic.
Identity Awareness sources: AD Query (agentless), LDAP, RADIUS, Captive Portal, Identity Agent; AD Query is most common.
VPN community object references gateways and a shared secret or certificate; it defines allowed tunnels.
ClusterXL needs a cluster object, sync interface, and identical policy; a member can be 'Ready' but not 'Active'.
Gaia backup = configuration only, portable; snapshot = full disk, appliance-specific.
cpinfo collects logs and config for support; run before opening a case.
Cloud, SASE and Workspace Security
CloudGuard Network Security in Azure: availability set or VMSS behind Azure Load Balancer; in AWS: Gateway Load Balancer or ELB with autoscaling.
CloudGuard Posture Management connects via read-only cloud roles and continuously evaluates compliance frameworks.
Harmony SASE components: ZTNA, SWG, CASB, DLP, SD-WAN, delivered from the SASE cloud edge.
Harmony Email & Collaboration needs admin consent in M365/Google Workspace; no MX change required.
Harmony Endpoint supports on-prem (Endpoint Security Management Server) and cloud management.
Harmony Browse enforces zero-trust access and safe browsing at the browser, useful for BYOD.
Workspace controls are layered: device, browser, email, network; naming one does not imply the others.
Exposure Management, Threat Intelligence and AI Security
Infinity Vision attack-path analysis links identities, permissions, and reachability to show paths to sensitive data.
Prioritization factors: internet exposure, known exploited status, privilege level, data classification.
ThreatCloud AI is queried at runtime for URL/IP/file reputation; verdicts are cached and updated via feeds.
Threat Extraction reconstructs a safe file by removing active content; Threat Emulation detonates in a sandbox.
AI security: protect AI workloads (prompt injection, data leakage, model access) and use AI for defense (anomaly detection, risk scoring).
SmartEvent (on-prem) and Infinity Events (cloud) both correlate multi-product logs; the difference is deployment.
Check Point Services, Support and Training Programs
Support tiers: Standard, Premium, Elite; higher tiers add faster response, 24x7 coverage, and named resources.
Collaborative Support and CES are proactive add-ons: health checks, upgrade planning, designated engineer.
Professional Services is project-based and contracted separately from support.
Infinity Portal manages licenses, entitlements, support cases, and downloads.
Certification ladder: CCSA -> CCSE -> CCME; exams via Pearson VUE; prerequisites apply.
Check Point Mind hosts official courses and labs; Authorized Training Centers deliver instructor-led training.
Partner tiers (3/4/5-Star) set discount levels and support entitlements.
Check Point Product and Solution Portfolio Scope
Platform mapping: network -> Quantum; cloud -> CloudGuard; user -> Harmony; SMB managed -> Horizon; exposure -> Infinity Vision; intelligence -> ThreatCloud AI.
SmartConsole manages Quantum and CloudGuard gateways; Harmony consoles are separate and surfaced in Infinity Portal.
Infinity Portal is the common cloud login; on-prem management uses SmartConsole.
Quantum appliance series: 3000/5000/6000/7000/9000/16000/26000; higher numbers mean higher throughput and blade capacity.
Legacy names: Dome9 = CloudGuard Posture Management; Perimeter 81 = Harmony SASE; Avanan = Harmony Email & Collaboration.
A capability question maps to the owning product (e.g., sandboxing -> Threat Emulation), not the platform.
Maestro (41000/61000) and Scalable Chassis are hyperscale appliances; Lightspeed is ASIC-accelerated.
Hybrid Mesh Network Security and Firewall Platforms
Hybrid Mesh unifies policy across data center, cloud, branch, and remote user; the management server is the single policy source.
First matching rule wins for accept/drop; Threat Prevention runs after a rule matches, so drop rules bypass inspection.
NAT: automatic NAT on the object creates original and translated rules; manual NAT is in the gateway NAT rulebase.
SmartLog queries logs; SmartEvent correlates them; both read from the management or dedicated log server.
Backup vs snapshot: backup = configuration only, portable; snapshot = full disk, appliance-specific.
cpview shows real-time CPU, memory, connections, and blade counters; top and free are expert-mode equivalents.
SIC reset: re-initialize on the gateway, then re-establish trust from SmartConsole before further troubleshooting.