156-215.80 · Question #537
Examine the sample Rule Base. What will be the result of a verification of the policy from SmartConsole?
The correct answer is C. Verification Error: Rule 4 (Web Inbound) hides Rule 6 (Webmaster access). Check Point SmartConsole policy verification detects rule shadowing, where a broader earlier rule prevents a later more specific rule from ever being matched.
Question
Examine the sample Rule Base. What will be the result of a verification of the policy from SmartConsole?
Exhibit
Options
- ANo errors or Warnings
- BVerification Error: Empty Source-List and Service-List in Rule 5 (Mail Inbound)
- CVerification Error: Rule 4 (Web Inbound) hides Rule 6 (Webmaster access)
- DVerification Error: Rule 7 (Clean-Up Rule) hides Implicit Clean-up Rule
How the community answered
(26 responses)- A15% (4)
- B19% (5)
- C62% (16)
- D4% (1)
Why each option
Check Point SmartConsole policy verification detects rule shadowing, where a broader earlier rule prevents a later more specific rule from ever being matched.
The policy does contain at least one verification error due to rule shadowing, so a clean verification result is incorrect.
An empty Source-List or Service-List would produce a different category of verification error unrelated to rule ordering or shadowing.
Rule 4 (Web Inbound) is positioned before Rule 6 (Webmaster access) and is broad enough to match all traffic that Rule 6 would also match. Because Check Point evaluates rules top-down and stops at the first match, Rule 6 is permanently shadowed and unreachable. SmartConsole's policy verification flags this as a verification error to alert the administrator.
The implicit cleanup rule is a system-level construct, and Rule 7 being a cleanup rule does not constitute a shadowing error - this is expected and allowed configuration.
Concept tested: Check Point policy verification and rule shadowing detection
Source: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Verifying-Policies.htm
Topics
Community Discussion
No community discussion yet for this question.
