I85PREP
⌘ K
CCSE study materials
CCSE study resources

CCSE (EC-Council Certifications) practice questions

One question at a time. Build your CCSE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Management and Deployment

In a CCSE context, which statement best describes the purpose of a Security Gateway deployment in a distributed environment?

  1. It stores the policy and the management server enforces it on inspected traffic.
  2. It replaces the need for any policy by using implicit default allow rules.
  3. It only performs logging and forwards all decisions to the endpoint client.
  4. It enforces the security policy on traffic while the management server stores and distributes that policy. Correct answer.

Explanation

In a distributed deployment the Security Gateway is the enforcement point that inspects and acts on traffic, while the Security Management Server centrally holds objects, rules, and logs. Separating these roles lets one management server govern many gateways. The gateway does not need local policy authoring to enforce centrally managed rules.

Question 2Security Management and Deployment

An administrator wants to confirm which policy version a Security Gateway is currently enforcing. Where is this information most reliably verified?

  1. In the gateway's installed policy status shown from the management interface or gateway object. Correct answer.
  2. In the local hosts file on the gateway operating system.
  3. In the endpoint client's cached anti-malware signature list.
  4. In the DNS zone file for the gateway's management address.

Explanation

The management interface reports the policy installation status per gateway, showing which policy and version is active. This reflects the actual install operation performed by the management server. Host files, DNS, and endpoint signature caches do not track policy installation state.

Question 3Security Management and Deployment

Which component is responsible for storing the security policy, network objects, and logs in a distributed CCSE deployment?

  1. The Security Gateway
  2. The external router
  3. The Security Management Server Correct answer.
  4. The endpoint security client

Explanation

The Security Management Server is the central repository for objects, rules, and log data in a distributed deployment. Gateways receive and enforce policy but do not serve as the central store. Endpoint clients and routers play no role in policy storage.

Question 4Security Management and Deployment

A security team needs a single management server to govern gateways in three data centers. Which deployment model fits this requirement?

  1. Distributed deployment with one management server and multiple gateways Correct answer.
  2. Standalone deployment on each gateway with no central management
  3. Bridge-mode deployment with no management server
  4. Endpoint-only deployment without any gateways

Explanation

A distributed deployment centralizes management on one server while multiple gateways enforce policy across sites. This provides consistent rule authoring and unified logging. Standalone deployments duplicate management per gateway and do not centralize control.

Question 5Security Management and Deployment

What is the primary function of a Security Policy rule's Action field in a gateway rulebase?

  1. To assign the gateway's management IP address
  2. To define what the gateway does with traffic that matches the rule's source, destination, and services Correct answer.
  3. To choose the operating system kernel version on the gateway
  4. To set the logging retention period for the management database

Explanation

The Action field determines the disposition of matching traffic, such as Accept, Drop, or Reject. It is evaluated after the rule's match conditions are satisfied. Logging retention, addressing, and kernel selection are configured elsewhere.

Question 6Security Management and Deployment

Which statement correctly describes the role of NAT in a Security Gateway deployment?

  1. NAT stores the gateway's policy and distributes it to remote sites.
  2. NAT encrypts all traffic between gateways using site-to-site keys.
  3. NAT authenticates users before they can access the internet.
  4. NAT translates addresses or ports for traffic passing through the gateway according to configured rules. Correct answer.

Explanation

NAT rewrites source or destination addresses and ports as traffic traverses the gateway, based on NAT rule configuration. It does not provide encryption, user authentication, or policy distribution. Those functions belong to VPN, identity awareness, and management components respectively.

Question 7Security Management and Deployment

Why should the default cleanup or implicit rules at the bottom of a rulebase be reviewed during deployment?

  1. They automatically install the policy on all gateways without administrator action.
  2. They define the gateway's license expiration date.
  3. They determine how traffic that matches no explicit rule is handled, which affects overall security posture. Correct answer.
  4. They control the management server's backup schedule.

Explanation

Traffic not matched by explicit rules falls to the implicit cleanup behavior, so its configuration directly shapes what is permitted or blocked. Reviewing it prevents unintended exposure. It does not install policy, manage licenses, or schedule backups.

Question 8Security Management and Deployment

An administrator must give a remote employee secure access to internal resources without exposing those resources directly to the internet. Which gateway capability addresses this?

  1. A cleanup rule that accepts all unmatched traffic
  2. Disabling logging on the gateway
  3. Static NAT that publishes the internal server publicly
  4. Remote access VPN terminating on the Security Gateway Correct answer.

Explanation

A remote access VPN lets the gateway authenticate remote users and give them encrypted access to internal resources without public exposure. Publishing servers with static NAT increases exposure rather than protecting them. Accepting unmatched traffic and disabling logging weaken security.

Question 9Security Management and Deployment

A gateway is being prepared for high availability so that a peer can take over if it fails. Which configuration element is essential to this design?

  1. A cluster object defining both members with synchronized state and a virtual IP Correct answer.
  2. A NAT rule that translates the cluster virtual IP to a public address on each member independently
  3. An endpoint policy that disables failover
  4. A separate standalone management server on each member with no shared objects

Explanation

High availability clusters require a cluster object that groups the members, manages a virtual IP, and synchronizes connection state so failover is transparent. Independent standalone management per member would fragment policy and state. Failover cannot be disabled by an endpoint policy.

Question 10Security Management and Deployment

During policy installation, the management server reports a verification failure before pushing the policy to the gateway. What is the most appropriate first step?

  1. Review the installation error details and correct the rule or object problem identified in the verification output Correct answer.
  2. Delete the gateway object and recreate it from scratch
  3. Reboot the gateway to clear the verification failure
  4. Disable logging on all rules and reinstall

Explanation

Verification failures identify specific rulebase or object issues that must be corrected before installation can succeed. Reading the reported error lets the administrator fix the root cause. Rebooting, disabling logging, or recreating objects does not address the underlying configuration defect.

Question 11Security Management and Deployment

An administrator wants logs from several gateways consolidated for correlation and reporting. Which configuration supports this?

  1. Route all traffic through a single gateway and disable the others
  2. Configure each gateway to store logs only locally with no forwarding
  3. Disable logging on the gateways and rely on endpoint logs
  4. Configure each gateway to send logs to the central management server and enable the relevant log settings Correct answer.

Explanation

Centralized logging requires gateways to forward their logs to the management server, where they can be correlated and reported on. Local-only storage prevents consolidation. Disabling logging removes the data needed for correlation.

Question 12Security Management and Deployment

A rule uses a network object that was recently redefined with a broader subnet. What is required for the gateway to enforce the new definition?

  1. Reinstall the policy so the updated object definition is pushed to the gateway Correct answer.
  2. Clear the DNS cache on the management server
  3. Change the gateway's hostname
  4. Restart the endpoint clients only

Explanation

Gateways enforce the policy and object definitions that were last installed, so object changes take effect only after the policy is reinstalled. Endpoint restarts, DNS cache clearing, and hostname changes do not propagate object updates to the gateway.

Question 13Security Management and Deployment

Which practice best supports secure administration of the Security Management Server?

  1. Restrict administrative access to trusted networks and use strong authentication for administrators Correct answer.
  2. Share a single administrator account among the whole team
  3. Allow administrative access from any source address to simplify troubleshooting
  4. Store administrator credentials in a world-readable file on the server

Explanation

Limiting administrative access to trusted sources and enforcing strong authentication reduces the risk of unauthorized policy changes. Open access, shared accounts, and exposed credentials all undermine accountability and security. Administrative controls are a core part of secure deployment.

Question 14Security Management and Deployment

An administrator is designing a rulebase and wants to minimize the number of rules while keeping intent clear. Which approach is most appropriate?

  1. Rely on the cleanup rule to handle all legitimate traffic
  2. Place the most general accept rule at the top of the rulebase
  3. Create one rule per individual host address regardless of shared action
  4. Use grouped objects and services where they share the same action, and order rules from specific to general Correct answer.

Explanation

Grouping objects that share an action reduces rule count while preserving readability, and ordering specific rules before general ones prevents unintended matches. One rule per host creates needless sprawl. A broad accept at the top or reliance on cleanup rules creates permissive, hard-to-audit behavior.

Question 15Security Management and Deployment

A gateway in a cluster shows that one member is not receiving policy updates while the other is. What is the most likely area to investigate first?

  1. Connectivity and synchronization status between the management server and the affected cluster member Correct answer.
  2. The DNS records for public web servers
  3. The endpoint signature version on user laptops
  4. The license terms of the endpoint product

Explanation

When one cluster member misses policy updates, the likely cause is a communication or synchronization problem between that member and the management server. Checking connectivity and cluster status isolates the failing link. Endpoint signatures, public DNS, and endpoint licensing do not govern gateway policy delivery.

Question 16Security Management and Deployment

Why is it important to back up the Security Management Server configuration before major policy changes?

  1. It allows restoration of objects, rules, and settings if a change causes an unintended outage Correct answer.
  2. It removes the need to ever reinstall policy on gateways
  3. It automatically improves gateway throughput after installation
  4. It replaces the requirement for administrative authentication

Explanation

A management server backup captures objects, rules, and settings so they can be restored if a change produces an outage or error. Backups do not affect throughput, eliminate policy installation, or substitute for authentication. They are a core recovery control in secure deployment.

Question 17Security Management and Deployment

A rule is configured with the source 'Any' and destination 'Any' and action 'Accept' above more specific rules. What is the primary security concern?

  1. It shadows the specific rules below and permits traffic the design intended to restrict Correct answer.
  2. It increases the number of log entries but has no effect on access
  3. It prevents the gateway from installing the policy
  4. It disables NAT translation for all traffic

Explanation

Rule order matters: a broad accept rule placed above specific rules matches first and prevents those rules from ever being evaluated. This permits traffic the design meant to control and undermines least privilege. It does not block installation or directly disable NAT.

Question 18Security Management and Deployment

Which statement correctly distinguishes identity awareness from simple IP-based access control on a gateway?

  1. Identity awareness replaces the need for any rulebase by trusting all internal users
  2. Identity awareness associates traffic with authenticated users, enabling rules based on user or group rather than only source address Correct answer.
  3. Identity awareness assigns static IP addresses to all endpoints
  4. Identity awareness encrypts all traffic between cluster members

Explanation

Identity awareness maps connections to authenticated identities so rules can target users and groups instead of only IP addresses. This supports more precise policy in dynamic environments. It does not eliminate the rulebase, assign addresses, or provide cluster encryption.

Question 19Security Management and Deployment

An administrator must deploy a new gateway branch office quickly while keeping policy centrally managed. Which combination best meets this requirement?

  1. A standalone gateway with its own separate management and no connection to the central server
  2. A distributed deployment with a new gateway object managed by the existing management server Correct answer.
  3. An endpoint-only installation with no gateway
  4. A gateway with logging disabled to speed deployment

Explanation

Adding a new gateway object to the existing management server keeps policy centralized while extending enforcement to the branch. Standalone management would fragment control. Endpoint-only deployment provides no network gateway, and disabling logging reduces visibility without improving management.

Question 20Security Management and Deployment

Which configuration most directly reduces the risk of unauthorized changes to the security policy?

  1. Allowing policy edits from unauthenticated API calls
  2. Role-based administrative permissions with least privilege and audited change logging Correct answer.
  3. Granting every administrator full read-write access for convenience
  4. Disabling audit logs to save storage

Explanation

Least-privilege roles limit what each administrator can change, and audited change logging creates accountability. Granting full access broadly, disabling audit logs, or permitting unauthenticated API edits all increase the risk of unauthorized or untraceable changes.

Question 21Security Management and Deployment

A gateway must inspect traffic for threats beyond simple port and address matching. Which capability addresses this need?

  1. A NAT rule that changes the source port
  2. Threat prevention blades that inspect traffic content and behavior Correct answer.
  3. An endpoint policy that disables scanning
  4. A cleanup rule that accepts unmatched traffic

Explanation

Threat prevention blades examine traffic content and behavior to detect malware, intrusions, and other threats that basic five-tuple matching cannot catch. NAT and cleanup rules only affect addressing and default disposition. Disabling endpoint scanning reduces protection.

Question 22Security Management and Deployment

An administrator observes that a new rule intended to block a service is not taking effect. Which sequence of checks best isolates the cause?

  1. Recreate every network object, then disable NAT, then change DNS records
  2. Confirm the policy was installed, verify rule order, and check that the service object matches the traffic Correct answer.
  3. Delete the log files, then disable logging, then restart the management server
  4. Reboot all endpoints, then change the gateway hostname, then reinstall licenses

Explanation

A rule that appears ineffective usually involves an uninstalled policy, a higher rule matching first, or a service object that does not match the actual traffic. Checking these in order isolates the cause efficiently. Rebooting endpoints, deleting logs, or recreating objects does not target the likely cause.

Question 23Security Management and Deployment

A cluster uses a virtual IP for client connections. What is the main benefit of this design during failover?

  1. Each client must be reconfigured with a new address after every failover
  2. NAT rules are automatically deleted from the rulebase
  3. Clients continue to use the same address while a surviving member takes over enforcement Correct answer.
  4. The management server stops logging during failover

Explanation

A cluster virtual IP provides a stable address that clients connect to, so failover to a surviving member is transparent to clients. Without it, clients would need reconfiguration after each failure. Logging and NAT rules are not removed by failover.

Question 24Security Management and Deployment

An organization must demonstrate that only approved policy changes reach production gateways. Which control combination best satisfies this?

  1. Segregated administrative roles, documented change approval, and audited installation of policy versions Correct answer.
  2. A single shared administrator account with no change records
  3. Disabling installation logs to reduce noise
  4. Direct edits on gateways that bypass the management server

Explanation

Segregated roles enforce separation of duties, documented approval proves changes were authorized, and audited installation records show exactly what reached production. Shared accounts, out-of-band edits, and disabled logs remove the evidence and controls needed for such assurance.

Question 25Security Management and Deployment

A security architect must decide between standalone and distributed deployment for a small site with strict central logging requirements. Which reasoning is soundest?

  1. Choose standalone because it guarantees logs are centralized by default
  2. Choose standalone because it removes the need for any logging configuration
  3. Choose distributed only if the site has no network connectivity to the management server
  4. Choose distributed so the site gateway forwards logs to the central management server and shares the central policy Correct answer.

Explanation

Distributed deployment lets a site gateway use the central policy and forward logs to the central management server, satisfying the logging requirement. Standalone deployment keeps management and logs local unless separately configured, and it does not eliminate logging configuration. Distributed deployment requires connectivity to the management server.

Question 26Security Management and Deployment

Which component in a distributed Security Management deployment is responsible for storing the security policy and distributing it to gateways?

  1. The Security Gateway enforcement module
  2. The SmartConsole client
  3. The Security Management Server Correct answer.
  4. The cluster member

Explanation

In a distributed deployment the Security Management Server holds the policy database, objects, and logs, and installs policy to gateways. Gateways only enforce; SmartConsole is an interface; cluster members are enforcement nodes.

Question 27Security Management and Deployment

Which object type should an administrator create so that a group of gateways and their management server can be referenced together in rules and configuration?

  1. A service group
  2. A network group
  3. A gateway cluster Correct answer.
  4. A time object

Explanation

A cluster object represents a group of gateways acting as one enforcement point, allowing rules and settings to reference it as a single entity. Network and service groups aggregate addresses or services, not enforcement devices.

Question 28Security Management and Deployment

What is the primary purpose of installing a policy to a Security Gateway?

  1. To export the rulebase to a text file for backup
  2. To upgrade the gateway operating system
  3. To compile the rulebase and push the enforcement configuration to the gateway Correct answer.
  4. To synchronize logs from the gateway to the management server

Explanation

Policy installation compiles the rulebase and related settings and pushes the resulting enforcement configuration to the gateway. Logging, backups, and OS upgrades are separate operations performed through other mechanisms.

Question 29Security Management and Deployment

Which statement best describes the function of a Security Gateway in a deployment?

  1. It enforces the installed security policy on traffic passing through it Correct answer.
  2. It generates reports from historical log data
  3. It authorizes administrators and stores their credentials
  4. It provides the graphical interface for editing objects

Explanation

A Security Gateway is the enforcement point that inspects and acts on traffic according to the installed policy. Credential storage, reporting, and the editing interface belong to management-side components.

Question 30Security Management and Deployment

An administrator needs remote administrators to manage policy without exposing the management server to the internet. Which approach best meets this requirement?

  1. Allow management access from any source but log the connections
  2. Enable all management services on the external interface and rely on the gateway rulebase
  3. Place the management server behind a VPN or restricted management network reachable only by authorized hosts Correct answer.
  4. Publish the management server's web interface on a public IP with a long password

Explanation

Management interfaces should be reachable only through a protected path such as a VPN or a dedicated management network limited to trusted hosts. Exposing management services directly to the internet, even with logging or strong passwords, widens the attack surface significantly.

Question 31Security Management and Deployment

A gateway must apply different rules to traffic depending on which interface the packet arrived on. Which configuration element enables this?

  1. A NAT rule placed above the security rule
  2. Anti-spoofing settings on each interface
  3. Directional rule matching using the install-on or interface context Correct answer.
  4. A time object in the rule

Explanation

Rules can be scoped so they apply based on the gateway or interface context in which traffic is evaluated. Anti-spoofing validates source addresses, NAT rewrites addresses, and time objects schedule rule activity, none of which select by ingress interface.

Question 32Security Management and Deployment

During deployment planning, why should an administrator define a separate management network segment?

  1. To reduce the number of gateways required
  2. To eliminate the need for a firewall policy on the gateway
  3. To allow unauthenticated access to SmartConsole
  4. To isolate administrative traffic from user traffic and limit exposure of management services Correct answer.

Explanation

A dedicated management segment keeps administrative protocols off user-facing networks and restricts who can reach management services. It does not reduce gateway count, remove the need for policy, or permit unauthenticated access.

Question 33Security Management and Deployment

An administrator must ensure that a gateway continues to enforce the last installed policy if the management server becomes unreachable. Which behavior supports this?

  1. The gateway keeps the last installed policy loaded and enforcing Correct answer.
  2. The gateway contacts a public policy repository
  3. The gateway reverts to a default permit-all policy
  4. The gateway stops forwarding all traffic

Explanation

Gateways retain and enforce the last successfully installed policy when the management server is unavailable, so enforcement continues. They do not fall back to permit-all, halt traffic, or contact external repositories.

Question 34Security Management and Deployment

Which setting most directly prevents a gateway interface from accepting packets whose source address does not belong on that network?

  1. Logging of accepted traffic
  2. A time object
  3. Anti-spoofing configuration on the interface Correct answer.
  4. A NAT hide rule

Explanation

Anti-spoofing defines which source addresses are legitimate for an interface and drops packets that do not match. Logging, NAT, and time objects do not validate source address legitimacy.

Question 35Security Management and Deployment

An administrator wants to verify that a policy change will not break connectivity before applying it to production gateways. Which practice best supports this?

  1. Disable logging to reduce load during installation
  2. Install the policy directly to production during peak hours
  3. Delete the previous policy version immediately
  4. Use policy verification and, where available, test installation or a staging gateway before production rollout Correct answer.

Explanation

Verification and staged testing let administrators detect conflicts and connectivity issues before impacting production. Installing during peak hours, disabling logging, or discarding prior versions increases risk rather than reducing it.

Question 36Security Management and Deployment

Which configuration ensures that a cluster's members share a consistent security policy and state during failover?

  1. Separate management servers per member
  2. Cluster object referenced in rules with synchronized policy installation and state sharing Correct answer.
  3. Each member installed with an independently edited rulebase
  4. Disabling synchronization to reduce overhead

Explanation

A cluster object is installed as a single policy target, and members synchronize state so a peer can take over seamlessly. Independent rulebases, separate management, or disabled synchronization break consistency.

Question 37Security Management and Deployment

An administrator must document which administrator made a policy change and when. Which capability provides this?

  1. Interface statistics
  2. Gateway traffic logs
  3. NAT translation tables
  4. Audit logs recording administrative actions Correct answer.

Explanation

Audit logs capture administrative actions such as logins, object changes, and policy installations, attributing them to an administrator and time. Traffic logs, NAT tables, and interface statistics describe data-plane activity, not administrative changes.

Question 38Security Management and Deployment

A security architect is designing a deployment where the management server must remain available even if a single data center fails. Which design element best addresses this requirement?

  1. A single management server in the primary data center
  2. Management high availability with a secondary management server in another site Correct answer.
  3. A larger gateway appliance
  4. A standalone gateway at the branch

Explanation

Management high availability pairs a primary and secondary management server so administrative and policy functions survive a site failure. A single server, a branch gateway, or a larger appliance does not provide management redundancy across sites.

Question 39Security Management and Deployment

An administrator notices that a gateway is dropping legitimate traffic after a policy installation. Which analysis approach best isolates the cause?

  1. Reinstall the operating system on the gateway
  2. Delete the cluster object and recreate it
  3. Disable all logging and retest
  4. Review the gateway's traffic logs and rule hit counts for the dropped connections and compare with the intended rule order Correct answer.

Explanation

Traffic logs and rule hit counts reveal which rule matched or dropped the connection, allowing comparison with intended ordering and objects. Reinstalling the OS, disabling logging, or recreating cluster objects are disproportionate and remove diagnostic evidence.

Question 40Security Management and Deployment

Which combination best demonstrates that only approved policy changes reach production gateways?

  1. Change management approval records plus audit logs showing who installed which policy and when Correct answer.
  2. A single shared administrator account plus weekly manual reviews
  3. Allowing all administrators to install directly without review
  4. Disabling audit logging to reduce storage use

Explanation

Approval records establish that changes were authorized, while audit logs prove who installed what and when, together providing traceability. Shared accounts, disabled auditing, or unreviewed direct installs undermine that evidence.

Question 41Advanced Firewall Configuration and Policy

In Check Point Security Management architecture, what is the primary function of the Security Gateway (the enforcement module)?

  1. It enforces the installed security policy on traffic passing through it Correct answer.
  2. It provides the GUI used to edit objects and rules
  3. It stores the rule base and audit logs for all managed gateways
  4. It distributes licenses to remote gateways

Explanation

The Security Gateway is the enforcement point that inspects and acts on traffic using the policy pushed to it. The management server holds the rule base, objects, and logs, while the SmartConsole GUI is just a client to that server.

Question 42Advanced Firewall Configuration and Policy

Which Check Point software blade is responsible for inspecting and controlling application-layer traffic regardless of port?

  1. Firewall blade
  2. IPS blade
  3. Anti-Bot blade
  4. Application Control blade Correct answer.

Explanation

Application Control identifies and controls applications by their traffic signatures rather than by port, allowing it to block or limit apps even when they use nonstandard ports. The Firewall blade works on addresses, ports, and services, while IPS and Anti-Bot focus on exploits and malicious communication respectively.

Question 43Advanced Firewall Configuration and Policy

A rule in the Security Policy has the Source set to 'Any' and the Destination set to a specific web server. What does this rule match?

  1. Only traffic between internal networks
  2. Traffic from any source address to that web server Correct answer.
  3. Traffic from the web server to any destination
  4. Only traffic originating from the web server

Explanation

A rule matches traffic that satisfies every column simultaneously, so Source 'Any' means any origin address is acceptable. Combined with the specific destination, the rule matches traffic from any source toward that web server. Direction is determined by the source-to-destination relationship, not by the object type.

Question 44Advanced Firewall Configuration and Policy

What is the default action applied to traffic that matches no explicit rule in a Check Point Security Policy?

  1. Accept
  2. Reject
  3. Ask
  4. Drop Correct answer.

Explanation

Check Point policies end with an implicit cleanup rule that drops traffic not matched by any explicit rule. This default-deny behavior ensures unanticipated traffic does not pass. Administrators can add explicit rules above the cleanup rule to permit required traffic.

Question 45Advanced Firewall Configuration and Policy

Which object type should be used to represent a group of network addresses so that a single rule can reference all of them?

  1. Network Group Correct answer.
  2. User Group
  3. Service Group
  4. Time object

Explanation

A Network Group is a container for network and host objects, letting one rule reference many addresses at once. Service Groups hold services, Time objects define schedules, and User Groups hold identity objects, so none of those aggregate addresses.

Question 46Advanced Firewall Configuration and Policy

Which NAT method hides multiple internal hosts behind a single public IP address?

  1. Identity NAT
  2. Static NAT
  3. Port forwarding
  4. Hide NAT Correct answer.

Explanation

Hide NAT (also called dynamic NAT or PAT) translates many internal addresses to one public address and tracks sessions by port. Static NAT maps one internal address to one external address one-to-one, which does not conserve public addresses in the same way.

Question 47Advanced Firewall Configuration and Policy

In SmartConsole, which view is used to create and order security rules for a gateway?

  1. Logs & Monitor
  2. Gateway properties
  3. Access Control policy Correct answer.
  4. Threat Prevention policy

Explanation

The Access Control policy view is where firewall, application control, and URL filtering rules are created and ordered. Threat Prevention holds IPS and anti-malware profiles, while Logs & Monitor is for reviewing events.

Question 48Advanced Firewall Configuration and Policy

What does the 'Install Policy' operation do on a Security Management Server?

  1. Restarts the gateway inspection daemons
  2. Backs up the management database to a remote server
  3. Imports rules from a third-party firewall
  4. Compiles the policy and pushes it to the selected gateways Correct answer.

Explanation

Installing policy compiles the rule base and related profiles and pushes the result to the selected enforcement points. Until installation succeeds, edits made in SmartConsole exist only on the management server and do not affect traffic.

Question 49Advanced Firewall Configuration and Policy

An administrator wants traffic to a specific server to be logged even though other traffic in the same rule is not. Which action is appropriate?

  1. Set the rule's Track to Log and split the server into its own rule above the general rule Correct answer.
  2. Set the rule's Track to None and enable global logging
  3. Move the rule below the cleanup rule
  4. Change the rule action to Reject

Explanation

Track is set per rule, so isolating the server in a dedicated rule above the broader rule allows logging only for that traffic. The general rule below can then use Track None. Global logging settings do not override per-rule Track behavior in the way described.

Question 50Advanced Firewall Configuration and Policy

Two rules could match the same connection. Which rule is applied?

  1. The rule with the lowest rule number in the Threat Prevention policy
  2. The rule with logging enabled
  3. The rule with the most specific source object
  4. The first matching rule in top-down order Correct answer.

Explanation

Check Point evaluates Access Control rules sequentially from the top, and the first rule whose columns all match the connection is applied. Specificity does not override order, so administrators must place narrow exceptions above broad rules.