nerdexam
Check_Point

156-215.80 · Question #409

After trust has been established between the Check Point components, what is TRUE about name and IP- address changes?

The correct answer is A. Security Gateway IP-address cannot be changed without re-establishing the trust. After SIC trust is established, the Security Gateway's IP address is bound to its SIC certificate, so changing that IP invalidates the trust and requires re-establishing SIC.

Deployment and Configuration

Question

After trust has been established between the Check Point components, what is TRUE about name and IP- address changes?

Options

  • ASecurity Gateway IP-address cannot be changed without re-establishing the trust
  • BThe Security Gateway name cannot be changed in command line without re-establishing trust
  • CThe Security Management Server name cannot be changed in SmartConsole without re-
  • DThe Security Management Server IP-address cannot be changed without re-establishing the trust

How the community answered

(51 responses)
  • A
    82% (42)
  • B
    6% (3)
  • C
    2% (1)
  • D
    10% (5)

Why each option

After SIC trust is established, the Security Gateway's IP address is bound to its SIC certificate, so changing that IP invalidates the trust and requires re-establishing SIC.

ASecurity Gateway IP-address cannot be changed without re-establishing the trustCorrect

SIC (Secure Internal Communication) trust is certificate-based and the Security Gateway certificate is tied to the gateway's IP address at the time of SIC initialization. If the Security Gateway IP address is changed, the Management Server can no longer authenticate communications with it, and the administrator must reinitialize SIC on the gateway to generate a new certificate bound to the new IP.

BThe Security Gateway name cannot be changed in command line without re-establishing trust

The Security Gateway's display name can be changed from the command line without breaking SIC, because the trust relationship is IP-based, not name-based.

CThe Security Management Server name cannot be changed in SmartConsole without re-

The Security Management Server name can be changed in SmartConsole without re-establishing gateway SIC trust, as the trust certificates do not encode the management server's display name.

DThe Security Management Server IP-address cannot be changed without re-establishing the trust

The Security Management Server IP address can be updated through reconfiguration steps without forcing a full SIC re-establishment on managed gateways, unlike a gateway IP change.

Concept tested: Check Point SIC trust dependency on Security Gateway IP

Source: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Topics-SMAG/Establishing-Trust-SIC.htm

Topics

#SIC trust#Security Gateway IP#component trust#re-establishing trust

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 156-215.80 Practice