156-215.80 · Question #278
The technical-support department has a requirement to access an intranet server. When configuring a User Authentication rule to achieve this, which of the following should you remember?
The correct answer is B. The Security Gateway first checks if there is any rule that does not require authentication for this. When configuring User Authentication rules, you must remember that the Security Gateway checks all non-authentication rules first before enforcing authentication.
Question
The technical-support department has a requirement to access an intranet server. When configuring a User Authentication rule to achieve this, which of the following should you remember?
Options
- AYou can only use the rule for Telnet, FTP, SMPT, and rlogin services.
- BThe Security Gateway first checks if there is any rule that does not require authentication for this
- COnce a user is first authenticated, the user will not be prompted for authentication again until
- DYou can limit the authentication attempts in the User Properties' Authentication tab.
How the community answered
(30 responses)- A3% (1)
- B77% (23)
- C13% (4)
- D7% (2)
Why each option
When configuring User Authentication rules, you must remember that the Security Gateway checks all non-authentication rules first before enforcing authentication.
User Authentication is indeed limited to specific protocols such as Telnet, FTP, SMTP, and rlogin, but this limitation is not the most critical operational behavior to remember when configuring the rule placement.
Check Point processes rules sequentially from top to bottom, and if any rule without an authentication requirement matches the traffic before the User Authentication rule, the connection is permitted without prompting for credentials. Administrators must place the User Authentication rule above any permissive rules that would otherwise match the same traffic to ensure authentication is enforced.
User Authentication does re-prompt the user for credentials after a session ends or times out - persistent single sign-on behavior without re-prompting is characteristic of Client Authentication, not User Authentication.
Authentication attempt limits are not configurable in the User Properties Authentication tab; this setting is managed at the policy or gateway level, not per-user object.
Concept tested: User Authentication rule order and gateway processing behavior
Source: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SMAG/User-Authentication.htm
Topics
Community Discussion
No community discussion yet for this question.