Free CCSA R82 Exam Flashcards

The centralized management component that stores the security policy, network objects, and administrator accounts. In a distributed deployment it runs on a dedicated server or VM and pushes policy to one or more Security Gateways via SIC.

The enforcement point that inspects traffic and applies the installed Access Control, NAT, Threat Prevention, and VPN policies. It runs on Gaia OS and receives policy from the Security Management Server over SIC.

Standalone combines SMS and Gateway functions on one machine (typical for labs/branches). Distributed separates the SMS from each Gateway, allowing centralized management of multiple gateways and is the production norm.

Check Point's hardened Linux operating system that runs Security Management and Security Gateway appliances. Managed via the clish shell for system config or expert mode for underlying Linux commands.

The restricted Gaia shell for system configuration (interfaces, routing, time, admin users). It is menu-driven and validates inputs; preferred for day-to-day appliance configuration over expert mode.

A Gaia shell escape to a root Linux prompt for advanced operations (file edits, scripts, low-level troubleshooting). Use sparingly in production because changes bypass clish input validation.

The unified Windows client for Check Point management. It launches SmartConsole and contains the Security Management, Logs, and SmartEvent perspectives; R82 unified the previously separate GUIs into one application with role-based views.

The trusted, encrypted channel between the SMS and Gateways (and between management components). Uses certificates issued by the ICA; SIC must be established before policy can be installed. Most Check Point troubleshooting starts with 'is SIC up?'

The Check Point-internal CA on the SMS that issues SIC certificates to Gateways and administrators. It is created during SMS setup and is distinct from external PKI used for VPN peers.

A named container holding one or more layers (Access Control, Threat Prevention, NAT) plus installation targets. Installing a package pushes all included layers to the listed gateways, enabling versioned, per-customer policy distribution.

The rulebase that decides which traffic is allowed, dropped, or rejected. In R82 it is built as one unified ordered rulebase that can contain ordered and inline layers, evaluated top-down with first-match for most actions.

A rulebase layer in the unified Access Control policy evaluated in sequence. When a connection matches a rule in an ordered layer with an Accept/Drop action, evaluation continues to the next ordered layer until a final rule or inline layer gives the verdict.

A layer that is invoked from a rule's action in a parent ordered layer, like a subroutine. It enables per-context rulebases (for example, a shared network layer reused by multiple gateways) and returns control to the parent layer after evaluation.

A rule placed near the top of the Access Control policy to drop traffic destined directly to the gateway itself (to the gateway's IP), protecting the gateway from direct attack. Typically placed before the cleanup rule.

The final rule in an Access Control layer that matches any remaining traffic and logs/drops it. It ensures no traffic is implicitly allowed and provides an audit trail of unmatched connections.

Automatically generated, hidden rules that allow Check Point control connections (for example, SIC, gateway-to-gateway, and ICMP). They are evaluated before explicit rules by default and can be viewed in SmartConsole's Implied Rules view.

A SmartConsole feature that shows how many times each rule has matched in a given time window. Used to identify unused rules, tune rule order, and optimize the policy for performance.

The action in SmartConsole that compiles the policy package and pushes it to selected gateways over SIC. Without installation, edits in SmartConsole are saved but not enforced by the gateway.

Translates many internal source IPs to a single public IP (typically the gateway's external IP) for outbound traffic. It is many-to-one, does not require a one-to-one public IP pool, and is the default Automatic NAT for networks behind a gateway.

A one-to-one translation that maps a single internal IP to a single public IP, typically for inbound access to a published server. Requires Proxy ARP on the gateway's interface so the upstream router can reach the translated address.

NAT rules generated automatically by SmartConsole from the object's NAT properties (Hide or Static). They are added to the NAT policy and installed with the package, reducing manual rule creation.

Hand-written NAT rules in the NAT layer that give full control over original and translated source/destination and service. Used when Automatic NAT cannot express a scenario such as conditional NAT based on destination.

The gateway answering ARP requests on behalf of a translated (public) IP so the upstream router sends packets to the gateway. Required for Static NAT to work for inbound traffic; configured per gateway interface in Gaia.

A Check Point feature that binds user/machine identity to IP addresses so Access Control rules can match on users and groups rather than only IPs. Sources include AD Query, Identity Collector, Identity Agent, and Captive Portal.

An Identity Awareness source where the gateway queries Active Directory security logs for user-IP mappings. It is read-only against AD and is the simplest identity source but has lower accuracy for shared or roaming IPs than an agent.

An Identity Awareness source that aggregates identity from multiple sources (for example, Identity Agents and AD) into a consolidated feed on the gateway. It improves accuracy and reduces the per-gateway load of querying AD directly.

Software installed on endpoints that reports the logged-in user's identity directly to the gateway/collector. It provides the most accurate user-IP mapping but requires deployment and management on each endpoint.

A web page presented to unidentified users so they can authenticate (for example, against AD) and have their identity bound to their IP. Used as a fallback identity source when AD Query or agents cannot resolve a user.

A Threat Prevention/Access Control feature that identifies and controls applications by signature and behavior (not just port/protocol). Rules can allow, block, or limit applications and are enforced in the Application Control/URL Filtering layer.

Control of web access by category, site, or reputation. Categories are provided by Check Point's cloud-based categorization service and can be allowed, blocked, or alerted in the Access Control policy.

A Threat Prevention blade that inspects traffic for known attacks and exploits using signatures and protections. It can drop, block, or alert and is configured with IPS profiles and protections in the Threat Prevention policy.

A Threat Prevention blade that detects communication with botnet command-and-control servers using DNS and IP reputation. It blocks or alerts on outbound bot traffic and works alongside Anti-Virus in the Threat Prevention profile.

A Threat Prevention blade that scans traffic for known malware using signature and cloud-based detection. It drops or alerts based on the Anti-Virus profile and is commonly enabled with Anti-Bot and IPS.

A SandBlast feature that detonates files in a cloud or local sandbox to detect zero-day and evasive malware before delivery. It returns a verdict to the gateway, which can hold or release the file per the Threat Emulation profile.

A SandBlast feature that actively strips potentially malicious content (macros, active content, embedded objects) from documents in real time, delivering a sanitized version while Threat Emulation is still running. It protects before a verdict is available.

Predefined protection templates that control how aggressively IPS, Anti-Bot, Anti-Virus, and Threat Emulation act. Basic is permissive for performance, Optimized is balanced, and Strict blocks high-confidence threats aggressively.

An IPsec tunnel between two Security Gateways (or a gateway and a third-party peer) that encrypts traffic between sites as if on a private network. Configured using VPN communities in SmartConsole.

An IPsec or SSL VPN that lets individual remote users connect to the corporate network through the Security Gateway. Check Point provides this via the Mobile Access blade and Endpoint Security clients.

The set of networks behind a gateway that are eligible to be encrypted over a VPN tunnel. Each peer advertises its encryption domain; tunnels only establish when domains overlap with the negotiated traffic selectors.

A named group of gateways that participate in a VPN topology. A star community has one center and satellites; a mesh community fully connects all members. Communities simplify site-to-site VPN configuration over individual tunnels.

The Check Point blade that provides SSL VPN remote access through a browser or the Endpoint Security client. It integrates with Identity Awareness and Application Control for granular access to internal resources.

The gateway decrypting inbound and/or outbound HTTPS traffic so that IPS, Anti-Bot, Anti-Virus, and Application Control can inspect the payload. Requires a trusted CA certificate distributed to clients; outbound inspection raises privacy and compliance considerations.

Check Point's clustering solution that groups gateways for high availability and load sharing. Members synchronize state and connections so failover is transparent; configured via the ClusterXL blade and managed by the SMS.

A ClusterXL mode where one member actively handles traffic while others stand by. On failure, a standby member takes over using synchronized state. Simplest and most common HA deployment.

A ClusterXL mode where all members actively forward traffic simultaneously, distributing load via multicast or unicast CCP. Provides both redundancy and throughput scaling, but requires switch support for multicast where used.

The protocol ClusterXL members use to communicate cluster state and heartbeats. Multicast CCP sends to a group address (requires switch support); Unicast CCP sends point-to-point between members and works where multicast is not available.

The ClusterXL process that replicates connection tables and key state between members so a failover preserves established connections. Required for HA and load sharing; without sync, failover drops active connections.

A CLI command that shows the current cluster member state (Active, Standby, Down) and cluster status. It is the primary troubleshooting command for ClusterXL, alongside 'cphaprob -a if' for interface status.

A Check Point packet capture tool that inspects traffic at defined inspection points in the firewall chain (for example, before and after NAT, before and after VPN). Output is parsed with 'fw monitor -m' filters and helps pinpoint where traffic is dropped.

A lightweight kernel debug command that shows connection and drop decisions with minimal overhead, useful for live troubleshooting on production gateways. Commonly used with 'fw ctl zdebug +drop' to see why packets are dropped.