nerdexam
Check_Point

156-215.80 · Question #185

Sally has a Hot Fix Accumulator (HFA) she wants to install on her Security Gateway which operates with GAiA, but she cannot SCP the HFA to the system. She can SSH into the Security Gateway, but she…

The correct answer is C. She needs to edit /etc/scpusers and add the Standard Mode account. In Check Point GAiA, SCP access is controlled by a separate access list file, not the SSH configuration, so even users who can SSH may be blocked from SCP transfers until explicitly permitted.

Deployment and Configuration

Question

Sally has a Hot Fix Accumulator (HFA) she wants to install on her Security Gateway which operates with GAiA, but she cannot SCP the HFA to the system. She can SSH into the Security Gateway, but she has never been able to SCP files to it. What would be the most likely reason she cannot do so?

Options

  • AShe needs to edit /etc/SSHd/SSHd_config and add the Standard Mode account.
  • BShe needs to run sysconfig and restart the SSH process.
  • CShe needs to edit /etc/scpusers and add the Standard Mode account.
  • DShe needs to run cpconfig to enable the ability to SCP files.

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    6% (2)
  • C
    82% (27)
  • D
    9% (3)

Why each option

In Check Point GAiA, SCP access is controlled by a separate access list file, not the SSH configuration, so even users who can SSH may be blocked from SCP transfers until explicitly permitted.

AShe needs to edit /etc/SSHd/SSHd_config and add the Standard Mode account.

The SSHd_config file governs SSH daemon behavior such as authentication methods and port settings, but does not control SCP file transfer permissions in GAiA.

BShe needs to run sysconfig and restart the SSH process.

Running sysconfig and restarting the SSH process would not resolve the issue because SCP access in GAiA is gated by /etc/scpusers, which is unaffected by a service restart.

CShe needs to edit /etc/scpusers and add the Standard Mode account.Correct

Check Point GAiA maintains a dedicated file at /etc/scpusers that controls which user accounts are permitted to transfer files via SCP. SSH access and SCP access are managed independently, so a user can have valid SSH login credentials without SCP being enabled. Adding the Standard Mode account to /etc/scpusers grants that account the specific right to use SCP for file transfers.

DShe needs to run cpconfig to enable the ability to SCP files.

cpconfig is the Check Point product configuration utility for settings like licenses and Secure Internal Communication, and does not include an option to enable SCP file transfers.

Concept tested: Check Point GAiA SCP access control via scpusers

Source: https://support.checkpoint.com/results/sk/sk30877

Topics

#GAiA#SCP access#scpusers#SSH configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 156-215.80 Practice