I85PREP
⌘ K
Check Point CCME study materials
Check Point CCME study resources

Check Point CCME practice questions

One question at a time. Build your Check Point CCME understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Check Point product and solution portfolio scope

Which Check Point solution is specifically designed to protect cloud-native applications and workloads across AWS, Azure, and Google Cloud environments?

  1. Harmony Endpoint
  2. CloudGuard Correct answer.
  3. Infinity Vision
  4. Quantum Spark

Explanation

CloudGuard is Check Point's dedicated cloud security portfolio, covering posture management, workload protection, and cloud network security across major public cloud providers. It addresses the shared responsibility model for cloud-native assets.

Question 2Check Point product and solution portfolio scope

A security team wants to consolidate management of on-premises gateways, cloud workloads, and endpoint agents under a single console. Which Check Point architecture concept describes this unified management approach?

  1. Standalone deployment
  2. Bridge mode deployment
  3. Virtual System Extension
  4. Infinity architecture Correct answer.

Explanation

The Infinity architecture is Check Point's consolidated security platform vision, enabling unified management and threat visibility across network, cloud, endpoint, and mobile domains. It ties together multiple product families under shared management.

Question 3Check Point product and solution portfolio scope

Which Check Point product family focuses on protecting users and devices from phishing, malicious files, and zero-day threats regardless of where the user connects?

  1. Maestro
  2. CloudGuard
  3. Harmony Correct answer.
  4. Quantum Security Gateways

Explanation

Harmony is Check Point's suite of user and access security products, covering endpoint protection, mobile security, browsing protection, and email security. It is designed to protect users wherever they work.

Question 4Check Point product and solution portfolio scope

An organization needs to scale a single security gateway policy across many appliances to reach very high throughput. Which Check Point technology is purpose-built for this hyperscale orchestration?

  1. SmartConsole
  2. Infinity Portal
  3. Maestro Correct answer.
  4. ClusterXL

Explanation

Maestro is Check Point's hyperscale orchestration technology that lets a single gateway policy scale elastically across multiple security appliances. It separates the management and data planes to deliver high throughput.

Question 5Check Point product and solution portfolio scope

Which Check Point offering is a cloud-delivered service that provides threat intelligence and protects users from malicious websites without requiring on-premises hardware?

  1. Harmony Browse Correct answer.
  2. Quantum Spark
  3. SmartEvent
  4. CloudGuard Network

Explanation

Harmony Browse is a cloud-based secure web browsing service that blocks phishing and malicious sites for users regardless of device or location. It delivers protection as a service without on-premises appliances.

Question 6Check Point product and solution portfolio scope

Which Check Point product provides automated, consolidated visibility and reporting across the entire security estate for executives and analysts?

  1. Quantum Spark
  2. Harmony Email
  3. CloudGuard Posture Management
  4. Infinity Vision Correct answer.

Explanation

Infinity Vision is Check Point's consolidated visibility and analytics platform, aggregating data across the portfolio for reporting and executive dashboards. It provides cross-domain insight rather than point protection.

Question 7Check Point product and solution portfolio scope

A small retail branch needs a compact, fanless security appliance with built-in Wi-Fi for a handful of users. Which Check Point appliance family fits this requirement?

  1. Maestro
  2. Smart-1
  3. Quantum Force
  4. Quantum Spark Correct answer.

Explanation

Quantum Spark appliances are designed for small businesses and branch offices, offering compact form factors with integrated Wi-Fi and simple management. They target low-user-count deployments.

Question 8Check Point product and solution portfolio scope

Which Check Point solution applies artificial intelligence to analyze and prevent zero-day threats at the network gateway?

  1. SmartConsole
  2. Infinity Portal
  3. ThreatCloud
  4. Quantum Threat Prevention Correct answer.

Explanation

Quantum Threat Prevention includes AI-driven engines that detect and block zero-day malware and unknown threats at the gateway using behavioral analysis and emulation. It is part of the network security product line.

Question 9Check Point product and solution portfolio scope

Which Check Point product family addresses mobile device security by protecting against malicious apps and network-based attacks on smartphones and tablets?

  1. Maestro
  2. Harmony Mobile Correct answer.
  3. Quantum Force
  4. CloudGuard AppSec

Explanation

Harmony Mobile provides mobile threat defense, protecting iOS and Android devices from malicious apps, phishing, and network attacks. It is part of the Harmony user security suite.

Question 10Check Point product and solution portfolio scope

An enterprise wants to protect its public-facing web applications and APIs from OWASP-style attacks in a cloud environment. Which Check Point solution is most appropriate?

  1. CloudGuard AppSec Correct answer.
  2. Quantum Spark
  3. SmartEvent
  4. Harmony Endpoint

Explanation

CloudGuard AppSec is a cloud web application and API protection solution that uses machine learning to defend against application-layer attacks. It is designed for protecting web apps and APIs.

Question 11Check Point product and solution portfolio scope

Which Check Point capability continuously assesses cloud environments for misconfigurations and compliance violations?

  1. CloudGuard Posture Management Correct answer.
  2. Quantum Threat Prevention
  3. Harmony Browse
  4. Maestro

Explanation

CloudGuard Posture Management (CSPM) continuously evaluates cloud configurations against security best practices and compliance frameworks. It identifies misconfigurations and drift across cloud accounts.

Question 12Check Point product and solution portfolio scope

Which Check Point management application is used by administrators to configure security policies and monitor gateways?

  1. ThreatCloud
  2. SmartConsole Correct answer.
  3. Harmony Endpoint
  4. Maestro

Explanation

SmartConsole is the administrative GUI for managing Check Point security policies, gateways, and monitoring. Administrators use it to define rules and track security status.

Question 13Check Point product and solution portfolio scope

A company wants a cloud-based email security service that blocks phishing and malicious attachments before they reach user inboxes. Which Check Point product fits?

  1. Harmony Email Correct answer.
  2. Infinity Vision
  3. CloudGuard Network
  4. Quantum Spark

Explanation

Harmony Email is a cloud email security service that inspects inbound and outbound mail for phishing, malware, and malicious links. It protects users before threats reach the inbox.

Question 14Check Point product and solution portfolio scope

Which Check Point technology provides shared threat intelligence from a global network of sensors to update protections across customer deployments?

  1. ThreatCloud Correct answer.
  2. ClusterXL
  3. SmartConsole
  4. Maestro

Explanation

ThreatCloud is Check Point's collaborative cloud threat intelligence service, aggregating data from a global sensor network to update protections in real time. It feeds products across the portfolio.

Question 15Check Point product and solution portfolio scope

Which Check Point product line is aimed at securing data centers and enterprise perimeters with high-performance appliances?

  1. Quantum Force Correct answer.
  2. Infinity Portal
  3. Harmony Mobile
  4. CloudGuard AppSec

Explanation

Quantum Force is Check Point's high-performance security gateway appliance line for data centers and large enterprise perimeters. It delivers high throughput threat prevention.

Question 16Check Point product and solution portfolio scope

An organization wants to extend consistent security policy to remote branch offices with minimal on-site IT staff. Which combination best matches Check Point's intent for this scenario?

  1. Standalone SmartConsole per branch
  2. ThreatCloud deployed on-premises
  3. Quantum Spark appliances managed centrally Correct answer.
  4. Maestro orchestration on each branch

Explanation

Quantum Spark branch appliances are designed to be centrally managed, allowing consistent policy enforcement at remote sites with little local administration. This matches the branch security use case.

Question 17Check Point product and solution portfolio scope

Which Check Point solution would a security architect select to protect containerized workloads and Kubernetes environments?

  1. CloudGuard Workload Protection Correct answer.
  2. Harmony Email
  3. SmartEvent
  4. Quantum Spark

Explanation

CloudGuard Workload Protection secures containerized and Kubernetes workloads, covering image scanning, runtime protection, and posture. It addresses cloud-native compute environments.

Question 18Check Point product and solution portfolio scope

Which Check Point component is responsible for correlating security events and generating alerts and reports for analysts?

  1. SmartEvent Correct answer.
  2. Maestro
  3. Harmony Browse
  4. Quantum Spark

Explanation

SmartEvent collects and correlates logs from gateways to detect incidents, generate alerts, and produce reports. It is the event management and analysis module of the management suite.

Question 19Check Point product and solution portfolio scope

A customer asks which Check Point offering unifies endpoint, mobile, email, and browsing protection under one user-security brand. Which answer is correct?

  1. Harmony Correct answer.
  2. CloudGuard
  3. Maestro
  4. Quantum

Explanation

Harmony is the umbrella brand for Check Point's user and access security products, including endpoint, mobile, email, and browsing protection. It consolidates user-focused defenses under one family.

Question 20Check Point product and solution portfolio scope

Which Check Point product family provides virtual gateways for protecting traffic within public cloud networks?

  1. SmartConsole
  2. Harmony Endpoint
  3. CloudGuard Network Security Correct answer.
  4. Quantum Spark

Explanation

CloudGuard Network Security delivers virtual security gateways that protect east-west and north-south traffic inside public cloud environments. It brings perimeter-grade inspection to cloud networks.

Question 21Check Point product and solution portfolio scope

Which statement best describes the role of the Infinity Portal within the Check Point portfolio?

  1. A physical gateway appliance for branch offices
  2. A threat prevention engine embedded in gateways
  3. A high-availability clustering protocol
  4. A cloud-based console for managing and viewing multiple security services Correct answer.

Explanation

The Infinity Portal is a cloud-delivered console that provides unified management and visibility for several Check Point cloud services and products. It is an access and management layer rather than a gateway or engine.

Question 22Check Point product and solution portfolio scope

A financial institution must protect both its data center perimeter and its hybrid cloud workloads while maintaining separate policy domains. Which Check Point portfolio combination is most aligned?

  1. Quantum gateways for the perimeter and CloudGuard for cloud workloads Correct answer.
  2. Harmony Mobile and Harmony Email only
  3. ThreatCloud and SmartEvent only
  4. Quantum Spark and Maestro only

Explanation

Quantum gateways secure the on-premises perimeter, while CloudGuard covers cloud workloads and posture, together addressing a hybrid estate. This combination matches the stated requirement across both domains.

Question 23Check Point product and solution portfolio scope

Which Check Point solution focuses on securing SaaS application usage and shadow IT visibility for cloud applications?

  1. Quantum Force
  2. SmartConsole
  3. Harmony Endpoint
  4. CloudGuard SaaS Security Correct answer.

Explanation

CloudGuard SaaS Security provides visibility and control over SaaS application usage, including shadow IT discovery and threat protection for cloud apps. It targets the SaaS security use case.

Question 24Check Point product and solution portfolio scope

Which Check Point technology allows a single physical gateway to host multiple independent virtual security domains for different tenants?

  1. ThreatCloud
  2. Maestro
  3. Virtual Systems (VSX) Correct answer.
  4. Harmony Browse

Explanation

Virtual Systems, delivered through VSX, let one physical gateway run multiple independent virtual security gateways for separate tenants or domains. This provides consolidation and separation of policy.

Question 25Check Point product and solution portfolio scope

Which Check Point capability is designed to prevent credential theft and phishing by inspecting web traffic for users working remotely?

  1. Harmony Browse Correct answer.
  2. Quantum Spark
  3. CloudGuard Posture Management
  4. Maestro

Explanation

Harmony Browse inspects web traffic in the cloud to block phishing sites and credential theft attempts for remote users. It delivers zero-touch web protection without on-premises hardware.

Question 26Check Point product and solution portfolio scope

Which Check Point offering is a cloud-delivered subscription service that provides threat prevention for web browsing and SaaS use without requiring an on-premises appliance?

  1. Quantum Smart-1 appliance
  2. Infinity Portal
  3. Harmony Browse Correct answer.
  4. CloudGuard Network Security

Explanation

Harmony Browse is the Check Point product that delivers web and SaaS threat prevention as a cloud service for users regardless of location, so no gateway appliance is needed. It is part of the Harmony suite focused on user and access security rather than network perimeter enforcement.

Question 27Check Point product and solution portfolio scope

A security team wants a single cloud console from which to manage multiple Check Point cloud services, view security posture, and open support cases. Which component fulfills this role?

  1. SmartConsole
  2. CloudGuard Controller
  3. Infinity Portal Correct answer.
  4. Quantum Security Gateway

Explanation

The Infinity Portal is the unified cloud-based management and visibility console for Check Point's cloud-delivered services. It lets administrators administer subscriptions, monitor posture, and manage support from one place rather than logging into separate service portals.

Question 28Check Point product and solution portfolio scope

Which Check Point product is specifically designed to protect IoT and operational technology networks by learning device behavior and enforcing segmentation?

  1. SmartEvent
  2. Quantum IoT Protect Correct answer.
  3. CloudGuard Posture Management
  4. Harmony Endpoint

Explanation

Quantum IoT Protect focuses on discovering, profiling, and segmenting IoT and OT devices so that compromised or anomalous devices cannot spread laterally. Its behavioral learning and policy enforcement are tailored to devices that cannot run host agents.

Question 29Check Point product and solution portfolio scope

Which Check Point family is positioned for securing users and access across endpoint, mobile, browsing, and email in a unified way?

  1. Quantum
  2. Harmony Correct answer.
  3. Infinity
  4. CloudGuard

Explanation

Harmony is the Check Point family that consolidates user-centric protections such as endpoint, mobile, browsing, and email security. Quantum addresses network security, CloudGuard addresses cloud security, and Infinity is the overarching architecture and platform brand.

Question 30Check Point product and solution portfolio scope

An administrator needs to enforce a consistent security policy across physical gateways, virtual cloud gateways, and a remote branch appliance from one management server. Which Check Point architecture supports this?

  1. Separate per-site management consoles with no shared objects
  2. A Security Management Server managing Quantum and CloudGuard gateways under a unified policy Correct answer.
  3. A SmartEvent server only, with no policy management
  4. A standalone gateway managed locally with no central server

Explanation

Check Point's management architecture lets one Security Management Server define and distribute policy to multiple enforcement points, including physical Quantum gateways, virtual CloudGuard gateways, and branch appliances. Shared objects and policy packages keep rules consistent across those enforcement points.

Question 31Check Point product and solution portfolio scope

A company wants to add Check Point threat prevention to a branch office but has no rack space and wants to avoid shipping a large appliance. Which Quantum offering is most appropriate?

  1. A CloudGuard virtual gateway deployed only in the public cloud
  2. Smart-1 management appliance at the branch
  3. Quantum Spark, a compact branch appliance family Correct answer.
  4. A high-end Quantum Maestro chassis for the branch

Explanation

Quantum Spark is the compact branch appliance family intended for small and remote sites where space and on-site IT support are limited. It provides gateway security functions in a small form factor rather than requiring a data-center-class chassis.

Question 32Check Point product and solution portfolio scope

Which Check Point capability is intended to give security teams a single, prioritized view of security events across gateways, endpoints, and cloud workloads?

  1. Harmony Browse web filtering
  2. CloudGuard Posture Management compliance checks
  3. Quantum IoT Protect device profiling
  4. SmartEvent correlation and reporting Correct answer.

Explanation

SmartEvent collects and correlates logs from multiple Check Point enforcement points to produce prioritized events, alerts, and reports for analysts. The other options are preventive or compliance-focused products that do not provide cross-estate event correlation.

Question 33Check Point product and solution portfolio scope

A customer wants to prevent malicious files from reaching users through email while also applying the same threat prevention to web downloads. Which Check Point approach best meets this requirement?

  1. Rely solely on SmartEvent alerts after files are delivered
  2. Use CloudGuard Posture Management to block file downloads
  3. Use Harmony Email & Collaboration for email and enable threat prevention on the gateway for web traffic Correct answer.
  4. Deploy only Harmony Endpoint and disable gateway inspection

Explanation

Email-delivered malware is addressed by Harmony Email & Collaboration, while web-borne files are inspected by threat prevention on the Quantum gateway. Combining the two covers both channels instead of leaving one path uninspected.

Question 34Check Point product and solution portfolio scope

Which Check Point product should an organization select when it needs to enforce security policy for east-west traffic between workloads inside a public cloud VPC?

  1. Quantum Spark branch appliance
  2. Smart-1 management appliance
  3. CloudGuard Network Security virtual gateways Correct answer.
  4. Harmony Mobile

Explanation

CloudGuard Network Security provides virtual gateways that can be deployed inside public cloud networks to inspect and enforce policy on workload traffic, including east-west flows. Quantum Spark and Harmony Mobile address branch and mobile users, and Smart-1 is management hardware.

Question 35Check Point product and solution portfolio scope

Which statement accurately describes how Check Point positions its Infinity architecture?

  1. It is an umbrella architecture and platform brand that integrates network, cloud, user, and management security. Correct answer.
  2. It is a cloud-only product that cannot include on-premises gateways.
  3. It is a single appliance that replaces all other Check Point products.
  4. It is a reporting-only tool with no prevention capabilities.

Explanation

Infinity is the overarching architecture and brand under which Check Point integrates network, cloud, user, and management security into a coordinated platform. It is not a single appliance and is not limited to cloud-only deployments.

Question 36Check Point product and solution portfolio scope

A security architect must protect containerized workloads and Kubernetes clusters with Check Point policy. Which offering is designed for this requirement?

  1. Harmony Endpoint
  2. CloudGuard Workload Protection Correct answer.
  3. SmartEvent
  4. Quantum IoT Protect

Explanation

CloudGuard Workload Protection is the Check Point offering aimed at container and Kubernetes security, including workload posture and runtime protection. The other options target IoT/OT devices, user endpoints, or event correlation.

Question 37Check Point product and solution portfolio scope

Which Check Point technology is used to apply multiple independent virtual security domains on a single physical gateway so that separate tenants can have their own policies?

  1. Harmony Browse
  2. SmartConsole
  3. Virtual Systems Correct answer.
  4. Infinity Portal

Explanation

Virtual Systems allow a single physical Quantum gateway to host multiple independent security domains, each with its own policy and administrators. This supports multi-tenant or separated-department designs without separate hardware.

Question 38Check Point product and solution portfolio scope

A customer asks which Check Point service continuously evaluates cloud accounts for misconfigurations and regulatory compliance violations. Which product should be recommended?

  1. Harmony Email & Collaboration
  2. Quantum IoT Protect
  3. Quantum Smart-1 appliance
  4. CloudGuard Posture Management Correct answer.

Explanation

CloudGuard Posture Management continuously assesses cloud environments for misconfigurations and compliance gaps against frameworks. It provides visibility and remediation guidance rather than inline traffic enforcement or email filtering.

Question 39Check Point product and solution portfolio scope

An enterprise needs to protect public-facing web applications from OWASP-style attacks and also wants a managed cloud WAF service option. Which Check Point offering fits?

  1. Quantum Spark
  2. SmartEvent
  3. Harmony Mobile
  4. CloudGuard AppSec Correct answer.

Explanation

CloudGuard AppSec is the Check Point web application and API protection offering, available with cloud-delivered and managed options to defend against OWASP-style attacks. It is distinct from branch appliances, mobile protection, and event correlation.

Question 40Check Point product and solution portfolio scope

A security operations team wants to reduce alert noise by correlating events from Quantum gateways, Harmony Endpoint, and CloudGuard into a single prioritized incident view. Which combination best delivers this?

  1. Only gateway logs reviewed manually each morning
  2. Separate per-product dashboards with no central correlation
  3. Harmony Browse alone with no other telemetry
  4. SmartEvent with log export from all enforcement points Correct answer.

Explanation

SmartEvent ingests logs from multiple Check Point enforcement points and correlates them into prioritized events, which reduces noise compared with reviewing each product separately. Central correlation requires telemetry from all relevant sources rather than a single product view.

Question 41Hybrid Mesh Network Security and firewall platforms

In a Check Point Hybrid Mesh deployment, which component holds the Security Management Server and is also a full Security Gateway participating in traffic inspection?

  1. A Security Management Server that is co-located on a Security Gateway Correct answer.
  2. A dedicated Management Server appliance only
  3. A Log Server that never enforces policy
  4. A SmartConsole client workstation

Explanation

Hybrid Mesh allows the Security Management Server to run on a gateway, so that single machine both manages the environment and enforces policy on its own traffic. The other deployment pattern separates management onto a standalone server. This co-location is the defining trait of the hybrid model.

Question 42Hybrid Mesh Network Security and firewall platforms

What is the primary purpose of a Distributed Security Gateway deployment in a Check Point environment?

  1. To separate the management plane from the enforcement plane across multiple gateways Correct answer.
  2. To consolidate all enforcement onto a single appliance
  3. To eliminate the need for any management server
  4. To replace SmartConsole with a command-line tool

Explanation

Distributed deployment separates the Security Management Server from the gateways that enforce policy, letting one management plane control many enforcement points. This scales policy administration across sites. Hybrid Mesh is a variant where some enforcement also hosts management.

Question 43Hybrid Mesh Network Security and firewall platforms

Which Check Point feature lets multiple Security Gateways share a single virtual IP address so that traffic fails over transparently if one gateway fails?

  1. Identity Awareness
  2. ClusterXL Correct answer.
  3. Threat Extraction
  4. Site-to-Site VPN

Explanation

ClusterXL groups gateways into a cluster that presents one virtual IP to clients and provides high availability and load sharing. If a member fails, another takes over the virtual address. The other features address identity, content sanitization, and VPN connectivity rather than gateway redundancy.

Question 44Hybrid Mesh Network Security and firewall platforms

A gateway is configured in Bridge mode rather than Router mode. How does it handle IP addressing as it inspects traffic?

  1. It rewrites source addresses for every packet
  2. It drops all non-IP protocols
  3. It requires every protected host to use NAT
  4. It forwards frames at Layer 2 without changing IP addresses Correct answer.

Explanation

A bridge-mode gateway inspects traffic at Layer 2 and forwards frames without altering IP addressing, so it can be inserted transparently into an existing network. Router mode, by contrast, routes and often applies NAT. Transparent insertion is the key operational difference.

Question 45Hybrid Mesh Network Security and firewall platforms

In Check Point policy, what does the Install Policy operation do for a selected gateway?

  1. It upgrades the gateway firmware automatically
  2. It rotates the gateway's SSL certificates
  3. It backs up the gateway configuration to a remote server
  4. It compiles and pushes the security policy to that gateway Correct answer.

Explanation

Installing policy compiles the rulebase and pushes it to the chosen enforcement points so they enforce the current rules. It is not a backup, upgrade, or certificate operation. Policy installation is the routine step that activates rule changes.

Question 46Hybrid Mesh Network Security and firewall platforms

Which Check Point blade inspects application-layer traffic to identify and control applications such as social media or peer-to-peer clients regardless of port?

  1. Anti-Bot
  2. Application Control Correct answer.
  3. IPS
  4. Anti-Virus

Explanation

Application Control classifies traffic by application signature rather than by port, allowing rules that permit or block specific applications. IPS targets vulnerabilities, Anti-Bot targets command-and-control traffic, and Anti-Virus targets malware. Application identity is the distinguishing capability.

Question 47Hybrid Mesh Network Security and firewall platforms

What role does a Check Point SmartConsole provide in a Hybrid Mesh environment?

  1. It enforces the security policy on the gateway
  2. It stores all connection logs permanently
  3. It serves as the graphical interface for managing policy and monitoring Correct answer.
  4. It provides the virtual IP for cluster failover

Explanation

SmartConsole is the management GUI used to build policy, manage objects, and monitor the environment. Enforcement happens on gateways, logging on log servers, and failover via clustering. SmartConsole itself does not enforce or store logs.

Question 48Hybrid Mesh Network Security and firewall platforms

A company wants gateway redundancy where both members actively process traffic to use available capacity. Which ClusterXL mode should they choose?

  1. Standby only
  2. High Availability
  3. Bridge mode
  4. Load Sharing Correct answer.

Explanation

Load Sharing mode distributes traffic across cluster members so all of them actively process connections, using capacity that High Availability leaves idle on standby members. High Availability keeps one member active and others on standby. Bridge mode concerns Layer 2 forwarding, not cluster distribution.

Question 49Hybrid Mesh Network Security and firewall platforms

An administrator needs remote users to reach internal resources through a Check Point gateway without installing a full desktop client, using a browser-based portal. Which capability applies?

  1. Site-to-Site VPN
  2. Mobile Access with a web portal Correct answer.
  3. Threat Emulation
  4. Identity Awareness

Explanation

Mobile Access provides browser-based and client-based remote access portals so users can reach internal applications without a full VPN client. Site-to-Site VPN connects networks, not individual browsers. Identity Awareness and Threat Emulation serve other purposes.

Question 50Hybrid Mesh Network Security and firewall platforms

A gateway uses Identity Awareness with an AD Query source. What does this configuration primarily achieve?

  1. It encrypts all Active Directory replication traffic
  2. It maps source IP addresses to authenticated Active Directory users for policy decisions Correct answer.
  3. It authenticates the gateway to the domain controller
  4. It replaces the need for a firewall rulebase

Explanation

AD Query reads logon events from domain controllers to associate IP addresses with user identities, enabling user-based rules. It does not encrypt replication or replace the rulebase. The association of identity to IP is what policy then matches on.