156-315.71 · Question #472
Can end users be forced to authenticate by using client certificates and username/password credentials? Check Point 156-315.71 Exam
The correct answer is C. Yes, by editing the protection-level settings. See the full explanation below for the reasoning.
Question
Can end users be forced to authenticate by using client certificates and username/password credentials? Check Point 156-315.71 Exam
Options
- AYes, but by manually changing the parameter :IsPasswordWarning to true in the $FWDIR/conf/objects_5_0.C
- BNo, R71 only supports authentication by client certificates.
- CYes, by editing the protection-level settings.
- DSSL VPN only supports server certificates.
How the community answered
(49 responses)- A4% (2)
- B12% (6)
- C78% (38)
- D6% (3)
Community Discussion
5
Samuel O.Nov 8, 2025C is correct. In R71, the protection level settings are where you control how end users authenticate to the SSL VPN portal, and combining client certificates with username and password is absolutely something you configure there, not by hand-editing flat files or some other workaround.
Dejan C.Dec 2, 2025C is right, protection-level settings control dual-factor cert plus password enforcement.
Wesley A.Nov 11, 2025C is correct, but watch out for A on the first pass because that file and parameter look real enough that you second-guess yourself. The protection-level settings are exactly where you configure dual-factor enforcement combining client certs and credentials, and that is the intended path in R71.
Ola B.Nov 17, 2025SSL VPN is built around server-side authentication where the gateway presents its certificate to prove its identity to the client, and the whole handshake is designed around that model, not the other way around. I kept coming back to D every time I worked through my lab because no matter what I tried, I could not get the portal to demand a cert from the end user side.
Wesley A.Nov 18, 2025Respectfully, Ola, SSL VPN absolutely can require client certificates for endpoint authentication, which is what makes C correct here. Most enterprise SSL VPN gateways like Cisco AnyConnect and Pulse Secure have supported mutual certificate authentication for years, so the portal can and does demand a cert from the client side when configured to do so.