CCSA R82 key terms

A Check Point component that enforces the security policy on traffic passing through it, performing inspection, access control, and threat prevention before forwarding or dropping packets.

The central Check Point server that stores the security policy, objects, and logs, and distributes policy to gateways. Administrators connect to it through SmartConsole to configure and manage the environment.

The graphical management client used to configure objects, build rules, install policy, and view logs on a Check Point management server. It replaced the older separate SmartDashboard and SmartView Tracker tools.

The process of compiling the rule base and pushing it from the management server to gateways, where it takes effect. It validates the policy and reports warnings or errors before committing.

The ordered set of rules that defines which traffic is accepted, dropped, or subjected to further inspection. Rules are evaluated top-down, and the first matching rule applies.

A hidden final rule that blocks all traffic not explicitly permitted by earlier rules. It enforces default-deny behavior without appearing in the visible rule base.

An explicit final rule, commonly configured to drop or reject all remaining traffic, placed at the bottom of the rule base to log and document unmatched connections clearly.

A named entity in the management database, such as a host, network, service, or gateway, that rules reference. Objects centralize configuration so changes propagate everywhere they are used.

A representation of an IP address range, subnet, or group used in rules and NAT. It lets administrators reference logical networks by name instead of literal addresses.

A container that bundles an access control policy, NAT policy, and threat prevention settings, installed together onto selected gateways. Different packages can serve different gateway groups.

A translation rule that rewrites source or destination IP addresses and ports as packets traverse a gateway. Original and translated columns define the before and after values.

A form of source NAT where many internal hosts share one external IP address, with the gateway tracking ports to route return traffic. It conserves public addresses and hides internal topology.

A one-to-one mapping between an internal address and an external address, often used to publish internal servers. Inbound and outbound traffic both translate consistently.

NAT rules generated by the gateway from object properties rather than written manually. They apply translation based on the NAT settings defined on network and host objects.

A Check Point feature that associates network traffic with specific users or machines, enabling rules based on identity rather than only IP address. It relies on sources such as AD Query, browser-based authentication, and identity agents.

A client installed on user endpoints that reports logged-in user identity to the gateway, enabling identity-based rules without prompting for credentials.

An object that defines a set of users, groups, or machines for use in identity-based rules. It lets policy match on who a user is rather than on a fixed IP address.

A Check Point blade that identifies and controls applications regardless of port or protocol, allowing granular permit, block, or limit actions on specific applications and categories.

A pattern definition that lets the gateway recognize a specific application's traffic, even when it uses nonstandard ports or is tunneled inside other protocols.

A blade that classifies web destinations into categories and enforces allow or block actions per category or specific site, controlling which websites users may reach.

A blade that inspects data inside permitted traffic, such as files or text, to detect sensitive information and apply actions like blocking or logging based on content.

A Check Point capability that detects and blocks attempts to send sensitive data outside the organization, using content inspection and predefined or custom data types.

The umbrella of Check Point blades, including IPS, antivirus, anti-bot, and threat emulation, that detect and block malicious traffic after access is granted.

A configuration that groups intrusion prevention protections and their actions, such as prevent or detect, and is applied to gateways to control how attacks are handled.

A sandboxing feature that sends suspicious files to an isolated environment for behavioral analysis and blocks them if malicious activity is detected.

A blade that detects communication between infected hosts and command-and-control servers, blocking botnet traffic based on reputation and behavioral indicators.

The log analysis component of SmartConsole that lets administrators search, filter, and investigate logs generated by gateways to troubleshoot and audit security events.

A record generated by a gateway for traffic or events matching rules configured to log, capturing details such as source, destination, action, and blade that inspected the connection.

The setting on a rule that determines whether and how matching connections are recorded, such as log, detailed log, or accounting, and whether alerts are sent.

A Check Point component that correlates logs into events and alerts according to configured policies, helping administrators detect trends and security incidents across the environment.

A command-line utility on gateways that displays real-time performance and health statistics, such as CPU, memory, and interface counters, for monitoring and troubleshooting.

A diagnostic command that collects system configuration, version, and status information from a gateway or management server into a file for support and troubleshooting.

A gateway command-line capture tool that shows packets at multiple inspection points within the kernel chain, useful for diagnosing where traffic is dropped.

Management operations that save the full server configuration and database to a file and later restore it, used for disaster recovery and migration between servers.

A programmatic interface that lets administrators automate management tasks, such as creating objects or installing policy, through HTTPS requests instead of the SmartConsole interface.