Check Point CCMS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Infinity Portal

Cloud management plane for Check Point products. It hosts security management, policy, and log views for cloud and SASE gateways, and can also manage connected on-premises gateways.

Hybrid mesh

Deployment where on-premises Quantum gateways and cloud-delivered SASE gateways are managed together from shared policy, while enforcement happens at each separate location.

Route-based VPN

VPN using a virtual tunnel interface. It supports multiple tunnels and dynamic routing protocols, unlike domain-based VPN where each community uses one tunnel.

Domain-based VPN

Traditional VPN community model. A single tunnel is created per community, so it scales less flexibly than route-based VPN for many peers.

Quantum SD-WAN

Feature that steers branch traffic across links by application and measured link quality such as latency, jitter, and loss. Policy enforcement remains on the gateway.

Policy installation

Action that pushes compiled policy to a specific gateway. A change is not enforced until installation succeeds on that target, and each gateway installs separately.

Single-homed site

Site with only one tunnel to one peer or PoP. It is a single point of failure because a link or PoP outage removes all connectivity.

Identity Awareness

Mechanism that maps traffic to users via AD query, browser-based auth, or identity agents. The enforcing gateway must resolve the identity source to apply user policy.

Harmony SASE

Cloud-delivered security service with PoPs that inspect branch and remote user traffic. Reached by IPsec tunnel, client agent, or SD-WAN integration.

Harmony Endpoint

Endpoint protection product with an agent and a management console. Blades include anti-malware, anti-bot, anti-exploit, behavioral guard, and forensics.

Behavioral Guard

Endpoint blade that detects malicious behavior such as process injection or credential theft by activity pattern, not by file signature, so novel malware can be caught.

Anti-ransomware remediation

Endpoint capability that detects encryption behavior and restores protected files from backup copies. Detection is behavioral, so unknown ransomware variants can be stopped.

Forensics blade

Endpoint component that records a timeline of process, file, and registry events for investigation. It gathers evidence but does not block activity itself.

Harmony Browse

Cloud-based web security for endpoints. Traffic is inspected or isolated in the cloud, so no local proxy is needed and policy is set per user group.

Harmony Email & Collaboration

Protection for SaaS email and collaboration apps such as Microsoft 365 and Google Workspace. Connects by API or journaling without an on-premises mail gateway.

Blade-scoped exclusion

Exclusion limited to one protection engine and a specific path or hash. Unscoped global exclusions disable protection across all engines and are risky.

Endpoint policy modes

Per-blade setting of prevent, detect, or inactive. Prevent blocks, detect logs only, and inactive disables the blade for the selected user group or computer.

Endpoint management server

On-premises console that holds endpoint policy and stores logs. It can be paired with cloud services for reputation and threat analysis.

Exposure Management

Continuous discovery of assets, correlation with vulnerabilities and misconfigurations, and risk ranking by exploitability, exposure, and business criticality.

CVSS base score

Technical severity metric for a vulnerability. It ignores whether the asset is reachable or critical to the business, so it is only one input to risk ranking.

Known exploited vulnerability

Vulnerability with confirmed exploitation in the wild, tracked in catalogs such as CISA KEV. It raises priority above severity alone, especially on internet-facing assets.

Shadow asset

Asset found by external scanning or cloud connectors that is not in the known inventory. It signals a coverage gap and often carries unpatched, unmanaged risk.

Attack surface

Sum of reachable entry points: internet-facing services, cloud and SaaS apps, remote access, and internal assets. Exposure Management maps and monitors it.

Risk-based prioritization

Ordering findings by combined exploitability, exposure, and asset criticality rather than raw severity. Internet-facing assets with known exploits come first.

Remediation SLA

Target fix time set by severity or risk score. Status moves from open to in progress, mitigated, or accepted risk with recorded justification.

False positive validation

Confirming a finding with a second independent source, such as agent data versus external scan, before suppressing it. Blanket suppression hides real issues.

Prompt injection

Attack where crafted text in a prompt or retrieved content makes the model follow attacker instructions. Defense treats retrieved content as data, not instructions.

Indirect prompt injection

Injection delivered through documents, web pages, or tool output instead of the user prompt. Filtering only user input does not stop it.

Shadow AI

Unsanctioned use of external AI services by employees. Detected through URL categorization, DNS, and SaaS discovery rather than endpoint signatures.

Agentic AI risk

Risk from models that call tools and take actions. Controls are least-privilege tool scopes, sandboxing, and human approval for destructive operations.

AI data leakage

Sensitive data such as PII or secrets sent to an external model through prompts or context. Controls include DLP on prompts, redaction, and approved-model allowlists.

Untrusted model output

Principle that generated text, code, or commands must be validated or sandboxed before execution, because the model can be manipulated into harmful output.