CCSE Exam key terms

The enforcement point of a Check Point deployment: the engine that inspects and filters traffic according to a policy installed from a management server, and that logs connections for analysis.

The central component that stores objects, rules, and logs, and that compiles and pushes policy to gateways. It does not inspect traffic itself; enforcement happens on gateways.

The graphical client used to manage objects, edit rules, install policy, and view logs on a management server. Multiple administrators can connect simultaneously, with changes tracked in sessions.

A licensed, independently configurable function on a gateway, such as firewall, IPS, application control, or VPN. Blades share the same policy framework and inspection path.

The operation in which the management server compiles the rulebase and pushes it to gateways. A failed install leaves the gateway running its previous policy, which is a common troubleshooting clue.

The ordered set of firewall rules evaluated top-down for each connection. The first matching rule determines the action, so rule order and implicit cleanup rules strongly affect behavior.

The final, non-editable rule that drops traffic matching no explicit rule above it. Administrators cannot reorder it, so any permit must be written as an explicit rule.

An explicit final rule, commonly configured to drop and log all traffic, placed above the implicit drop. It provides visibility into denied traffic that would otherwise be silently discarded.

A translation rule that rewrites source or destination addresses and ports for connections. Check Point evaluates original and translated packets against separate rulebases.

A per-object setting that generates NAT rules automatically, for example hiding internal networks behind a gateway address. It coexists with manual NAT rules and can create unexpected precedence conflicts.

Source NAT that translates many internal addresses to one or a few external addresses, using ports to distinguish connections. It is the typical way internal clients reach the internet.

A one-to-one mapping between an internal address and an external address, often used to publish internal servers. Unlike hide NAT it preserves the address, so inbound connections can be directed to a specific host.

A named entity in the management database, such as a host, network, group, or service, referenced by rules. Changing an object affects every rule that uses it after the next policy install.

A container object holding hosts, networks, or other groups. Groups simplify rules but can become very large, which affects policy compilation time and rule readability.

A management deployment that hosts several independent domain management servers under a single global policy. It is used by service providers and large enterprises to separate customers or business units.

The architecture in which a global management layer defines shared objects and policies, while each domain manages its own gateways and local rules. Domains remain isolated from one another.

In multi-domain deployments, a rulebase defined at the global level and applied to gateways across domains. It is enforced in addition to each domain's local policy.

A configuration in which a secondary management server synchronizes with the primary, so administrators can fail over and continue managing gateways if the primary becomes unavailable.

Check Point's high availability and load-sharing technology for gateways. Members synchronize connection state so that traffic survives a member failure without re-establishing sessions.

The process by which cluster members exchange connection tables and kernel state, allowing another member to continue existing sessions after a failure. It runs over a dedicated synchronization network.

A cluster address that clients use as their gateway, owned by the active member and moved during failover. It hides member-specific addresses from hosts and routing devices.

The transition of cluster duties from a failed or degraded member to another member. It depends on health checks and synchronized state to avoid dropping established connections.

A cluster setting that keeps all connections from one client handled by the same member. It helps applications that would break if packets arrived at different members.

A ClusterXL mode in which multiple members actively process traffic simultaneously. It requires careful handling of asymmetric routing and is not suitable for every environment.

The combined gateway protection layer that includes IPS, antivirus, anti-bot, and threat emulation blades. It inspects traffic after firewall acceptance and can drop or sanitize malicious content.

A set of activated protections and their actions, assigned to gateways or rules. Profiles determine which signatures are enforced, in detect or prevent mode, and how alerts are generated.

An individual IPS signature or behavioral detection in the Check Point database. Each protection has a severity, confidence, and performance impact that administrators weigh when enabling it.

A sandboxing blade that sends suspicious files to an emulated environment to observe behavior before delivery. Verdicts can later block the file for other users.

A blade that removes potentially malicious content, such as macros or embedded objects, from downloaded files and delivers a sanitized version. It protects users without waiting for a sandbox verdict.

A blade that identifies applications regardless of port and lets policy allow, block, or limit them. It complements port-based firewall rules with signatures for thousands of applications.

A blade that categorizes web destinations and enforces allow or block decisions by category. It can also apply per-user rules and quota limits on browsing.

A blade that associates connections with users or machines, using sources such as Active Directory, captive portals, or terminal agents. Rules can then match on identity instead of address.

An object that maps users or groups, from an identity source, to a role used in rules. It lets policy be written once for a population rather than per IP address.

An encrypted tunnel between gateways that connects remote networks transparently to hosts. It is defined by community objects and matched by rules in the VPN column.

A deployment in which individual clients, using a Check Point or third-party client, connect to a gateway and receive encrypted access to internal resources. It often includes endpoint compliance checks.

A management object that groups gateways and defines the encryption methods, topology, and shared settings used for tunnels between them. Rules reference the community in the VPN column.

The protocol that negotiates security associations, authenticates peers, and derives keys for IPsec. Phase 1 protects the negotiation itself; phase 2 establishes the data tunnels.

The suite that encrypts and authenticates IP packets for VPN traffic, using protocols such as ESP. It operates on the data path after IKE has established keys and parameters.

A property in which compromising one key does not expose past sessions, because fresh keys are derived for each exchange. It is configured per phase and must match on both peers.

The blade that publishes internal web and client applications to remote users through a portal, with authentication and access control. It can also provide SSL-based connectivity.

A policy that checks a connecting client's posture, such as antivirus status or patch level, before granting access. Non-compliant clients may be remediated or blocked.

The recording of connections and security events by the gateway to the management server. Log fields, indexing, and retention determine how quickly incidents can be investigated.

The component that correlates logs into events and dashboards, highlighting trends and anomalies. It helps administrators find patterns that individual log entries would not reveal.

A named, configurable condition in SmartEvent that triggers when log activity matches defined thresholds or patterns. Indicators feed events and can trigger notifications.