156-215.77 · Question #411
Mr. Smith needs access to other networks and should be able to use all services, but session authentication is not suitable. The Security Administrator selects client authentication with HTTP. The…
The correct answer is C. The configuration file $FWDIR/conf/fwauthd.conf is wrong. See the full explanation below for the reasoning.
Question
Mr. Smith needs access to other networks and should be able to use all services, but session authentication is not suitable. The Security Administrator selects client authentication with HTTP. The standard authentication port for client HTTP authentication (Port 900) is already in use. The Security Administrator wants to use the Port 9001, but there are some connectivity problems. What is the reason for the connectivity problems? Give the BEST answer.
Options
- AThe configuration of the service FW1_clntauth_http is not correct.
- BThe Security Policy is not correct.
- CThe configuration file $FWDIR/conf/fwauthd.conf is wrong.
- DIt is not possible to use any port other than the standard port 900 for the client authentication
How the community answered
(59 responses)- A8% (5)
- B3% (2)
- C71% (42)
- D17% (10)
Community Discussion
9
Prof. SaraJun 18, 2026The correct answer is C. On Check Point firewalls, the client authentication daemon is controlled by the configuration file $FWDIR/conf/fwauthd.conf, and that file explicitly defines which ports the authentication service will listen on. When the administrator wants to move HTTP client authentication from the default port 900 to port 9001, that change must be reflected in fwauthd.conf or the daemon has no instruction to listen on the new port, which is exactly why connectivity breaks. Option D is a trap answer that students fall for because the exam wants you to know that alternate ports ARE supported, they just require the proper config file edit. Options A and B are plausible distractors but neither the service object name nor the security policy is the root cause here, because the traffic never even reaches the policy enforcement point when the daemon itself is not listening on the right port.
Mei-Ling H.Jun 20, 2026Prof. Sara is right that fwauthd.conf is the key file, but worth noting for anyone reading that you also need to restart the fwauthd daemon after editing the file, otherwise the process keeps listening on the old port even with the correct config saved.
Mateus R.Jun 26, 2026So if the bouncer's guest list is stored in a config file, which file tells FW1 which port to listen on?
Prof. SaraJun 29, 2026The guest list analogy works, but on most modern firewalls the "which port to listen on" question is answered in the same policy or interface configuration as the rules themselves, not a separate file, so FW1 does not always have a dedicated listener config apart from its ACL or zone definitions.
Mei-Ling H.Jun 24, 2026Option D is the killer trap here because it sounds like a hard platform limit, and if you panic on exam day you might think "of course, port 900 is the only port," but that is wrong, you absolutely can change it. The real catch is that when you move away from the default port 900 for HTTP client authentication, Check Point reads the listening ports from $FWDIR/conf/fwauthd.conf, so if that file still has 900 hardcoded and the admin never updated it to 9001, the daemon will not bind to the new port and connectivity fails, which makes C the correct answer.
Bahar F.Jun 26, 2026The service object FW1_clntauth_http has port 900 hardcoded in its definition, so when you try to shift client auth to 9001 without editing that service object to reflect the new port, the gateway simply does not know to accept auth traffic on it. Fix the service, update your policy, push, and the connectivity issue goes away.
Prof. SaraJun 27, 2026Bahar, great instinct to trace the issue to port configuration, but editing a built-in Check Point service object like FW1_clntauth_http is not supported and will cause policy verification errors. Option C is correct because the proper method is to change the client authentication port in the gateway object properties under the Authentication tab, which updates the relevant configuration without touching protected service objects.
Wesley A.Jun 26, 2026The fwauthd.conf file controls ports, so A points right at the broken service config.
Prof. SaraJun 28, 2026Wesley, fwauthd.conf handles the firewall authentication daemon, not port assignments generally. The correct answer is C because port configurations are managed through the services file (or the relevant network service configuration), which is where you would go to resolve a port-mapping issue.