nerdexam
Check_Point

156-215.75 · Question #502

John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to a set of designated IP addresses to minimize malware infection and unauthorized access risks…

The correct answer is D. He should lock and unlock the computer. See the full explanation below for the reasoning.

Question

John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to a set of designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned a static IP address 10.0.0.19. He has received a new laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop with a static IP (10.0.0.19). He wants to move around the organization and continue to have access to the HR Web Server. To make this scenario work, the IT administrator: 1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources, and installs the policy. 2) Adds an access role object to the Firewall Rule Base that lets John Adams access the HR Web Server from any machine and from any location and installs policy. John plugged in his laptop to the network on a different network segment and was not able to connect to the HR Web server. What is the next troubleshooting step?

Options

  • AJohn should install the Identity Awareness Agent
  • BInvestigate this as a network connectivity issue
  • CAfter enabling Identity Awareness, reboot the gateway
  • DHe should lock and unlock the computer

How the community answered

(64 responses)
  • A
    5% (3)
  • B
    2% (1)
  • C
    9% (6)
  • D
    84% (54)

Community Discussion

4
Ingrid P.Ingrid P.Apr 7, 2026

The correct answer is D, lock and unlock the computer. When Identity Awareness uses AD Query, the gateway learns user-to-IP mappings by passively monitoring Kerberos authentication events in Active Directory. If John moves to a new network segment and just plugs in, his machine may not generate a fresh Kerberos ticket that the gateway can see, so the gateway has no current mapping associating his identity with his new IP address. Locking and unlocking the workstation forces a new Kerberos authentication event against the domain controller, which AD Query picks up and uses to rebuild the identity mapping, restoring his access without any agent installation or gateway changes.

29
Carlos M.Carlos M.Apr 20, 2026

The scenario says AD Query is the Identity Source, which means the gateway learns user identity passively by watching Kerberos traffic to the domain controller, no agent required on the endpoint. AD Query picks up the identity when Windows authenticates the user session, and the key trigger for that re-authentication event is locking and then unlocking the workstation, which forces a fresh Kerberos ticket exchange that the gateway can see. So D makes sense because it essentially forces the identity to be re-published to the gateway without any manual agent install or reboot. The network connectivity angle in B would make sense if the rule was IP-based, but since the whole point of the change was to allow any location via identity, that should already be handled. Quick question for anyone who knows this deeper, does AD Query only pick up the identity on that lock/unlock event, or does it also catch it on initial login when the laptop first connects to the new segment? I am trying to figure out if the lock/unlock is a workaround for a timing issue where the gateway just had not seen the Kerberos traffic yet, versus it being the only reliable trigger.

4
Wesley A.Wesley A.Apr 18, 2026

AD Query misses machines on other segments, so the agent is what fills that gap.

-1
Carlos M.Carlos M.Apr 20, 2026

Wesley, the agent actually has that same limitation since it only reports back what the local machine knows, so D is correct because Active Directory queries give you centralized, network-wide visibility into all enrolled devices regardless of segment.

0
Sign up to join the discussion
Full 156-215.75 Practice