nerdexam
Check_Point

156-215.80 · Question #537

Examine the sample Rule Base. What will be the result of a verification of the policy from SmartConsole?

The correct answer is C. Verification Error: Rule 4 (Web Inbound) hides Rule 6 (Webmaster access). Check Point SmartConsole policy verification detects rule shadowing, where a broader earlier rule prevents a later more specific rule from ever being matched.

Security Policy Management

Question

Examine the sample Rule Base. What will be the result of a verification of the policy from SmartConsole?

Exhibit

156-215.80 question #537 exhibit

Options

  • ANo errors or Warnings
  • BVerification Error: Empty Source-List and Service-List in Rule 5 (Mail Inbound)
  • CVerification Error: Rule 4 (Web Inbound) hides Rule 6 (Webmaster access)
  • DVerification Error: Rule 7 (Clean-Up Rule) hides Implicit Clean-up Rule

How the community answered

(26 responses)
  • A
    15% (4)
  • B
    19% (5)
  • C
    62% (16)
  • D
    4% (1)

Why each option

Check Point SmartConsole policy verification detects rule shadowing, where a broader earlier rule prevents a later more specific rule from ever being matched.

ANo errors or Warnings

The policy does contain at least one verification error due to rule shadowing, so a clean verification result is incorrect.

BVerification Error: Empty Source-List and Service-List in Rule 5 (Mail Inbound)

An empty Source-List or Service-List would produce a different category of verification error unrelated to rule ordering or shadowing.

CVerification Error: Rule 4 (Web Inbound) hides Rule 6 (Webmaster access)Correct

Rule 4 (Web Inbound) is positioned before Rule 6 (Webmaster access) and is broad enough to match all traffic that Rule 6 would also match. Because Check Point evaluates rules top-down and stops at the first match, Rule 6 is permanently shadowed and unreachable. SmartConsole's policy verification flags this as a verification error to alert the administrator.

DVerification Error: Rule 7 (Clean-Up Rule) hides Implicit Clean-up Rule

The implicit cleanup rule is a system-level construct, and Rule 7 being a cleanup rule does not constitute a shadowing error - this is expected and allowed configuration.

Concept tested: Check Point policy verification and rule shadowing detection

Source: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Verifying-Policies.htm

Topics

#rule base verification#rule shadowing#policy analysis

Community Discussion

No community discussion yet for this question.

Full 156-215.80 Practice