156-315.81 · Question #656
Access roles allow the firewall administrator to configure network access according to:
The correct answer is B. All of the above. Access roles are objects that define a set of users, machines, or networks that can access a specific network resource. You can create access roles based on any combination of the following criteria: Users and user groups: You can use users and user groups from various sources…
Question
Access roles allow the firewall administrator to configure network access according to:
Options
- Aa combination of computer or computer groups and networks.
- BAll of the above.
- Cremote access clients.
- Dusers and user groups.
How the community answered
(64 responses)- A2% (1)
- B84% (54)
- C5% (3)
- D9% (6)
Explanation
Access roles are objects that define a set of users, machines, or networks that can access a specific network resource. You can create access roles based on any combination of the following criteria: Users and user groups: You can use users and user groups from various sources, such as LDAP, RADIUS, local database, etc. Computers or computer groups: You can use computers or computer groups that are identified by their IP address, MAC address, or hostname. Networks: You can use networks that are defined by their IP address range, subnet mask, or gateway. You can use access roles in the Source or Destination column of an Access Control rule to allow or deny network access based on the identity of the users, machines, or networks.
Topics
Community Discussion
7
Fatima Z.Feb 12, 2026The answer is B, All of the above, because Access roles are the ultimate three-in-one combo, wrapping users and user groups, machines and machine groups, and remote access clients all into one tidy policy object. Think of it as the "UMR" rule, Users plus Machines plus Remotes, and if you can say "All of the above," you always can with Access roles.
Toby R.Feb 5, 2026Saw this one show up almost word for word, and my first instinct was D because I had just been drilling user group scenarios all week, but then I remembered the lab where I set up a role that tied a specific machine group to a restricted network segment, and that clicked it for me. B is the one because roles in SmartConsole actually let you stack users, groups, machines, and networks all together, so none of the individual options covers the full picture on its own.
Fatima Z.Feb 6, 2026Toby nailed it, and here is the sticky hook to lock it in forever: remember "UGMN" like "You Gotta Map Networks," because a Check Point Role bundles Users, Groups, Machines, and Networks into one tidy package that no single letter option can touch.
Eitan E.Feb 17, 2026B is correct, and this is one of the core strengths of the Access Role object in R81.x, because it lets you stack identity dimensions together so a single rule can simultaneously match on a specific AD user group, a managed machine in a computer group, and a source network, giving you far more granular enforcement than a traditional IP-based rule ever could.
Mateus R.Feb 19, 2026Right, think of it like a bouncer holding three clipboards at once instead of one, but the real gotcha worth drilling for the exam is that all three dimensions only fire correctly when Identity Awareness is healthy, so if your AD Query or Identity Agent feed is misconfigured, that elegantly stacked rule silently degrades to a broader match and you never know until the logs tell a story you did not expect.
Mateus R.Jan 22, 2026The bouncer checks your ID, not your car, so D.
Eitan E.Jan 23, 2026Mateus, the analogy actually cuts the other way, because the gateway inspects the connection state (the "car" with its full history), not just the identity claim in a single packet, which is exactly why B is correct. Option D describes identity-based matching, but the mechanism being tested here operates at the connection layer, tracking sessions through the state table.