CCSE Exam flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SecureXL acceleration

A Check Point performance feature that offloads accepted connections to the kernel, bypassing full rulebase inspection for subsequent packets. Managed with fwaccel commands and monitored via fwaccel stat.

CoreXL

Check Point technology distributing traffic across multiple CPU cores using worker instances. Configured in cpconfig; some features require disabling it or specific acceleration settings for correct operation.

SIC trust

Secure Internal Communication uses certificates to establish trust between management and gateways. Initialized with an activation key; if broken, policy installation fails until re-established.

ClusterXL High Availability

A cluster mode where one member is active and others standby. Failover occurs on member failure, and state sync keeps connections alive. Verified with cphaprob stat.

fw monitor

A gateway packet capture tool capturing at inspection points i, I, o, and O. Useful to determine where traffic is dropped or modified along the inspection path.

IKE Phase 1

Negotiates the ISAKMP SA between VPN peers, establishing encryption, hash, DH group, and lifetime. Both peers must match these parameters or the tunnel fails.

Encryption domain

Defines the networks protected by a gateway's VPN. Mismatched or overlapping domains between peers cause tunnel failures; it can be manual or topology-derived.

NAT traversal

Encapsulates IPSec ESP in UDP port 4500 so VPN traffic can pass through NAT devices. AH is incompatible with NAT traversal because it authenticates the IP header.

vpn tu

A gateway command that lists and deletes IPSec SAs. Used during VPN troubleshooting to clear stale tunnels and verify active security associations.

Threat Emulation

A sandbox feature sending files for behavioral analysis, returning a delayed verdict. Complements Threat Extraction, which strips risky content and delivers a sanitized file immediately.

HTTPS inspection

Decrypts, inspects, and re-encrypts TLS traffic using a certificate authority that clients must trust. Bypass rules can exclude categories or destinations from inspection.

Anti-Bot

Detects command-and-control traffic using reputation feeds and behavioral signatures. Requires ThreatCloud connectivity for updated indicators such as known C2 domains.

Policy layers

Split the rulebase into ordered layers, such as Access Control and Threat Prevention. Inline layers are evaluated within a parent layer at a specified rule position.

migrate export

Creates a portable archive of management configuration and data for migration. Restored with migrate import on a compatible version; verify with migrate verify before importing.

CPUSE

Check Point Upgrade Service Engine manages software packages and hotfixes. Commands include installer list, installer verify, and installer install; the Deployment Agent pushes packages to gateways.

Gaia snapshot

Captures the full Gaia image state and can be reverted from the boot menu. Differs from backup, which captures configuration and data rather than the entire system image.

cphaprob stat

Displays cluster member states, showing which member is active and which is standby or down. Used to verify cluster health and failover status.

Manual NAT ordering

Manual NAT rules are evaluated top-down and the first match applies. They can translate source, destination, or both, and may conflict with VPN encryption domains.

Identity Awareness

Identifies users via AD Query, browser-based authentication, or identity agents. Identity is used in access rules through Access Role objects; the PDP distributes identities to gateways.

Reject rule action

Sends a reset or ICMP unreachable to the client, unlike Drop, which silently discards traffic. Logging can be set per rule to Log, Account, or None.

Management HA

Primary and secondary management servers synchronize configuration. On failover the secondary takes over; the role is set in cpconfig and synchronization uses the management network.

Multi-Domain Management

Separates management into domains, each with its own policy and administrators. A Global Policy can apply across domains; MDS manages the domain servers.

Management API

Web services allowing automation of object creation, policy installation, and log queries. Authentication uses API keys or credentials, with access controlled by API settings.

Port 257 logging

Gateways send logs to the management server over port 257. If the server is unreachable, logs are buffered locally and forwarded later.

fw ctl zdebug

A shorthand command enabling common kernel debug scenarios on the gateway. Debugging should be disabled after troubleshooting to avoid performance impact.

Connection table flush

fw tab -t connections -x clears the gateway connection table. Used after policy changes to force existing sessions to be re-evaluated against the new rulebase.

cpview

A real-time monitoring tool showing CPU, memory, connections, and interface statistics. It can save historical data, aiding capacity planning and bottleneck identification.

VSX virtual systems

One gateway hosts multiple virtual systems, each with its own policy, interfaces, and VSID. Requires a VSX license and management support; VS0 is the management virtual system.

Gaia clish

The Gaia command-line configuration shell. Commands such as set interface and add route persist automatically, unlike expert-mode changes, which need save config.

Interface topology

Defines each interface as internal, external, or DMZ. Anti-spoofing and VPN rely on it; topology can be imported from the gateway via get interfaces.

Mobile Access

Provides remote access to internal resources via a web portal or VPN client. Configured with access roles and applications, supporting both SSL VPN and IPsec VPN.

Compliance blade

Checks gateway configuration against best practices and standards, reporting failed checks with remediation guidance. Useful before audits and after major configuration changes.