Study the Rule base and Client Authentication Action properties screen. After being authenticated by the Security Gateways, a user starts a HTTP connection to a Web site. What happens when the user tr

The user is not prompted to authenticate to the Security Gateway generically again; the prompt is scoped specifically to the new FTP service connection, not a full gateway-level re-authentication.

The FTP data connection is not dropped after authentication; the purpose of Client Authentication is to permit the connection to proceed once credentials are successfully verified.

Client Authentication in Check Point operates on a per-connection, per-service basis, meaning each distinct service session can require its own credential verification. When the already-authenticated HTTP user initiates an FTP connection from the command line, Client Authentication prompts them specifically for that FTP session only - the user authenticates for FTP independently and does not need to re-authenticate for the previously established HTTP connection, since each service is tracked separately.

Rule 2 dropping the FTP connection is incorrect because the Client Authentication action is configured to challenge and then allow the FTP session upon successful authentication, not to drop it outright.