156-560 Sample Questions & Answers

The Security Management Server, especially if it's Smart-1 Cloud, can be located anywhere with network connectivity to the gateways. It does not need to be in the same AWS region. The gateways are configured during bootstrap to connect to the specified management server, regardless of its location.

A common misconfiguration is to base scaling decisions solely on CPU utilization. Security gateways can become bottlenecks due to high network throughput, a large number of concurrent connections, or high packets per second, even when CPU usage is not high. The most likely cause is that the scaling trigger is not aligned with the actual performance bottleneck. The solution is to use a more relevant metric, such as a network-related metric or a custom Check Point metric, for scaling decisions.

CloudGuard's Kubernetes Runtime Protection uses an agent that monitors system calls (syscalls) made by processes within containers. Attempting to load a kernel module involves specific syscalls (init_module, finit_module). The Runtime Protection agent can detect these anomalous and potentially malicious syscalls, generating an alert or blocking the action based on the configured policy. Image scanning and admission control are pre-runtime checks, and threat hunting is a post-incident analysis tool.

In Check Point terminology, a 'Standalone' deployment means that both the Security Gateway (which enforces the policy) and the Security Management Server (which manages the policy) are installed and run on the same machine or virtual instance. This is common for small deployments, labs, or proof-of-concept environments.

The correct method to represent assets from multiple, different cloud providers within a single policy object is to use a Group. You would first create a Data Center Query object for AWS filtering on the tag, then a second Data Center Query object for Azure filtering on the tag. Finally, you create a new Group object and add both of the Data Center Query objects to it. This group can then be used as a single entity in the source or destination of a security rule.

CloudGuard Workload Protection (part of the CWPP capabilities in the CNAPP suite) is the component designed to secure serverless functions. It provides runtime protection by analyzing the function's behavior, detecting threats, and preventing attacks without needing a network gateway.

Before any other API calls can be made to the Check Point Management API, a client must authenticate by sending a login command with valid credentials (username/password or an API key). The successful response to the login call contains a session identifier (SID) that must be included in the header of all subsequent API requests.

In a Transit Gateway architecture, it's critical to ensure symmetric routing, meaning both the request and response packets of a connection pass through the same CloudGuard gateway. If the VPC route tables are misconfigured, traffic might go to the gateway on the way to the destination but return directly, bypassing the gateway. The CloudGuard gateway's stateful firewall will see this as an invalid connection and drop the return packet. This is a common issue with complex cloud routing.

The CloudGuard Admission Controller acts as a validating webhook for the Kubernetes API server. Its primary function is to enforce 'shift-left' security by intercepting deployment requests (e.g., creating a Pod or Deployment) and validating them against a defined security policy before they are persisted in the cluster. It can block deployments that use insecure images, have excessive privileges, or violate other configured rules.