CheckPoint 156-315.81 Exam

The type of Endpoint Identity Agent that includes packet tagging and computer authentication is Full. Packet tagging is a feature that allows the Endpoint Identity Agent to add a tag to the packets sent by the user's device, which contains the user's identity information. This way, the Security Gateway can identify the user without requiring additional authentication methods. Computer authentication is a feature that allows the Endpoint Identity Agent to authenticate the user's device using a certificate, which ensures that only authorized devices can access the network resources. The Full Endpoint Identity Agent supports both packet tagging and computer authentication, as well as other features such as Single Sign-On (SSO), Multi-Factor Authentication (MFA), and VPN.

The references are:

Check Point R81 Identity Awareness Administration Guide, page 15

Endpoint Identity Agent - Check Point CheckMates

Check Point Identity Agent - All flavors for Windows OS in a single package (Full, Light, v1 and v2 for Terminal Server)

The ''sim affinity -I'' command is a command that displays the affinity distribution of the Security Gateway's interfaces. Affinity distribution is the assignment of CPU cores to handle the traffic from different interfaces. The ''sim affinity -I'' command shows the following information for each interface:

The interface name, such as eth0, eth1, etc.

The interface index, such as 0, 1, 2, etc.

The interface type, such as physical, bond, VLAN, etc.

The interface state, such as up or down

The interface speed, such as 1000 Mbps, 10000 Mbps, etc.

The interface MTU, such as 1500, 9000, etc.

The interface MAC address, such as 00:11:22:33:44:55

The interface IP address, such as 192.168.1.1, 10.0.0.1, etc.

The interface affinity mask, such as 0x00000001, 0x00000002, etc. The affinity mask is a hexadecimal value that represents the CPU cores that are assigned to handle the traffic from the interface. For example, 0x00000001 means that only CPU core 0 is assigned, 0x00000003 means that CPU cores 0 and 1 are assigned, and so on.

The ''sim affinity -I'' command can help you to monitor and optimize the performance of your Security Gateway by showing you how the traffic load is distributed among the CPU cores. You can also use the ''sim affinity'' command with other options to change the affinity settings of the interfaces or the firewall instances. For more information, you can refer to the Check Point R81.20 (Titan) Resolved Issues and Enhancements1 or the Solved: Sim Affinity - Check Point CheckMates2.

An Endpoint Identity Agent is a software component that runs on the user's device and communicates with the Check Point gateway to provide user identity information. An Endpoint Identity Agent can use different methods for user authentication, such as username/password, Kerberos ticket, or certificate. However, the most common and recommended method is username/password or Kerberos ticket, which allows the user to log in to the device with their domain credentials and automatically authenticate with the gateway without entering additional credentials. This method also supports Single Sign-On (SSO) and Multi-Factor Authentication (MFA) features.

The references are:

Check Point R81 Identity Awareness Administration Guide, page 15

Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 14

Endpoint Identity Agent - Check Point CheckMates

The verified answer is B) SmartConsole machine is not part of the domain.

The Identity Awareness wizard uses the SmartConsole machine to detect the windows domain by querying the Active Directory server using DCOM protocol1. If the SmartConsole machine is not part of the domain, the query will fail and the wizard will not automatically detect the domain. The user will have to manually enter the domain name and credentials to proceed with the configuration.

The Security Gateway, the Security Management Server, and the Identity Awareness global properties do not affect the domain detection by the wizard. However, they are required for other aspects of the Identity Awareness blade, such as AD Query, Identity Collector, and Browser-Based Authentication2.

Identity Awareness Configuration wizard authentication fails3

Identity Awareness - Check Point Software4