Check Point CCMS study plan
Check Point CCMS · Give each week a clear focus.
8 weeks · About 7 hours per week
Hybrid Mesh Network Security
Sketch the Hybrid Mesh components (Security Management Server, Security Gateway, Management plane vs. enforcement plane) from memory and label each data flow
Explain how a gateway registers with the management server and what happens to policy installation when the link is down
Compare star, mesh, and hybrid topologies and state one operational tradeoff for each
Configure a two-gateway mesh in a lab and capture the resulting topology view
Your checkpoint
A one-page annotated diagram of a working two-gateway hybrid mesh with a written note on what breaks if the management link fails
Hybrid Mesh Network Security
Trace a packet through the gateway pipeline (pre-inbound, inbound, routing, outbound, post-outbound) and name the decision at each stage
Differentiate stateless inspection, stateful inspection, and application-layer enforcement with a concrete rule example for each
Apply NAT rules (hide vs. static) and predict the translated address for three scenarios
Troubleshoot a blocked connection using logs and explain which pipeline stage rejected it
Your checkpoint
A rule-and-NAT worksheet with five scenarios, each showing the predicted decision path and the expected log entry
Hybrid Mesh Network Security & Workspace Security
Configure site-to-site VPN between two mesh peers and verify phase 1 and phase 2 negotiation
Explain certificate vs. pre-shared-key authentication and pick the right one for a given scenario
Describe how remote access clients authenticate and what role identity plays in rule matching
Map hybrid mesh concepts onto the workspace model: what is managed centrally vs. enforced locally
Your checkpoint
A working site-to-site tunnel plus a half-page comparison table of certificate and PSK tradeoffs
Workspace Security
Describe the workspace architecture: management plane, enforcement points, and how policy reaches endpoints
Explain identity-aware policy: user, group, device posture, and how they combine in a rule
Configure a posture check (e.g., disk encryption or agent version) and show its effect on access
Differentiate agent-based and agentless enforcement and state when each applies
Your checkpoint
A posture-based access policy that grants or denies based on one device condition, with a short write-up of the test results
Workspace Security & Exposure Management
Walk through a zero-trust access decision end to end: identity, device, application, and context signals
Configure least-privilege application access and prove that an unauthorized user is denied
Explain how workspace telemetry feeds exposure findings
List the top five misconfigurations that create workspace exposure and how to detect each
Your checkpoint
A least-privilege access scenario with allow and deny test evidence, plus a five-item misconfiguration checklist
Exposure Management
Explain the exposure management lifecycle: discover, assess, prioritize, remediate, verify
Differentiate CVE severity, exploitability, and business context when ranking findings
Correlate an external attack surface finding with an internal asset record and describe the matching logic
Draft a remediation SLA tiering scheme by risk level and asset criticality
Your checkpoint
A prioritized remediation plan for ten sample findings, each with a risk score, owner, and target date
Exposure Management & AI Security
Describe how AI workloads change the attack surface: model endpoints, training data, and prompt interfaces
Explain prompt injection and data leakage risks and one control for each
Identify what telemetry is needed to detect anomalous AI application usage
Map an AI service into the exposure management lifecycle and name two findings it would generate
Your checkpoint
A one-page AI workload risk register with at least six findings, each mapped to a control
Hybrid Mesh Network Security & Workspace Security & Exposure Management & AI Security
Re-derive the key architecture facts for all four domains without notes
Complete a timed mixed-domain practice set and log every miss by domain and root cause
Re-teach the three weakest concepts in writing as if explaining to a colleague
Build a one-page pre-exam cheat sheet limited to facts you have personally verified
Your checkpoint
A scored practice exam log with error analysis and a final one-page cheat sheet covering all four domains
Milestones
Week 2: Can explain the full gateway packet pipeline and predict NAT translations for unseen scenarios without notes
Week 4: Site-to-site tunnel works end to end and you can explain each negotiation phase and its failure modes
Week 6: Can take an unknown finding through discover-assess-prioritize-remediate and justify the priority with business context
Week 8: Practice score is stable across two attempts and every logged miss has a written root cause and fix