156-315.71 · Question #468
Which port is typically used by SSL Network Extender, if the Connectra Portal will also be used on the same IP address?
The correct answer is C. SSL (TCP/444). See the full explanation below for the reasoning.
Question
Which port is typically used by SSL Network Extender, if the Connectra Portal will also be used on the same IP address?
Options
- ASSL (TCP/900)
- BSSL (TCP/443)
- CSSL (TCP/444)
- DSSL (TCP/80)
How the community answered
(46 responses)- A4% (2)
- B9% (4)
- C72% (33)
- D15% (7)
Community Discussion
7
Fatima Z.Oct 25, 2025The answer is C, SSL on TCP port 444. Picture it this way: 443 is the "main gate" that Connectra Portal already owns, so SSL Network Extender gets the very next door over, 444, just one number higher like a neighbor knocking on the next apartment, and the trick I call "443 is taken, SNX gets 444" has never failed me on a Check Point exam.
Imani T.Nov 2, 2025Caught this one on my actual exam and almost went with 443 on reflex, but then I remembered that when Connectra is sharing the same IP, SSL Network Extender gets bumped to TCP/444 so the two services do not step on each other. Burned that into my brain after labbing it out the week before and I am glad I did.
Bao N.Nov 9, 2025TCP/443 is the obvious trap here and honestly I get why people pick it, that is the default HTTPS port and your brain just goes there automatically. But the whole point of the question is the conditional, "if the Connectra Portal will also be used on the same IP address," because when the portal is already sitting on 443, the SSL Network Extender has to move off it to avoid the conflict. That is exactly why 444 exists as the fallback for SNX in that scenario, it is literally one digit up from 443 and that is by design. So C is correct, and if you got this wrong it almost certainly means you memorized SNX uses SSL without internalizing the coexistence behavior, which is the part the exam is actually testing.
Fatima Z.Nov 11, 2025Nail it, and here is the sticky hook to never blank on it again: picture the portal as a bouncer who already owns the 443 door, so SNX just knocks on the very next door, 444, one digit up, one neighbor over, coexistence problem solved.
Orla P.Nov 28, 2025The conflict scenario is the key thing the question is testing. When Connectra Portal already holds port 443 on that IP, SSL Network Extender cannot share it, so Check Point shifts SNX to port 444 instead. Think of it as a tiebreaker rule, not a default, which is exactly why the question specifies that shared-IP condition. If you just memorized 443 as the SSL answer, that shared-IP detail is what trips you up here. Quick question for anyone who has worked through this lab: does the gateway automatically fall back to 444 when it detects the Connectra Portal is active, or do you have to configure that port shift manually in SmartDashboard?
Wesley A.Nov 19, 2025TCP/444 is correct, and the reason this one trips people up is that TCP/443 is the gut-reaction answer since that is the default HTTPS port, but when Connectra Portal is sharing the same IP, SNE gets bumped to TCP/444 to avoid the conflict. Do not let 443 steal your point here.
Imani T.Nov 19, 2025Worth adding that TCP/443 is still the correct answer when SNX is running on a gateway without Connectra Portal on the same IP, so the real exam skill is reading the scenario carefully before you pick.