156-315.81 · Question #661
Identity Awareness allows the Security Administrator to configure network access based on which of the following?
The correct answer is D. Network location, identity of a user, and identity of a machine. Implied rules are predefined rules that are automatically added to the Access Control rulebase by the Security Management Server. Implied rules allow the control connections that are essential for the functionality and security of the Check Point products, such as communication…
Question
Identity Awareness allows the Security Administrator to configure network access based on which of the following?
Options
- AName of the application, identity of the user, and identity of the machine
- BIdentity of the machine, username, and certificate
- CBrowser-Based Authentication, identity of a user, and network location
- DNetwork location, identity of a user, and identity of a machine
How the community answered
(34 responses)- A12% (4)
- B3% (1)
- C6% (2)
- D79% (27)
Explanation
Implied rules are predefined rules that are automatically added to the Access Control rulebase by the Security Management Server. Implied rules allow the control connections that are essential for the functionality and security of the Check Point products, such as communication between the Security Gateway and the Security Management Server, synchronization between cluster members, logging, VPN, and ICMP. Implied rules are not visible in the SmartConsole, but they can be viewed and modified using the Global Properties window.
Topics
Community Discussion
5
Eitan E.Jun 14, 2026The correct answer is D, network location, identity of a user, and identity of a machine. The Check Point courseware on Identity Awareness is explicit that the blade extends traditional access control by letting you write policy around all three of those dimensions together, so instead of just saying "allow traffic from this subnet," you can say "allow this specific user, on this specific machine, from this network location." Option A trips up a lot of candidates because Application Control is what gives you visibility into the application name, not Identity Awareness. Option C is a classic distractor because Browser-Based Authentication (Captive Portal) is an identity acquisition method, meaning it is one tool used to learn who a user is, but it is not itself one of the three policy dimensions the blade enforces. Burn this into memory with the acronym NUMe, Network location, User identity, Machine identity, and you will not second-guess it on exam day.
Amara A.Jun 21, 2026D is right. Identity Awareness keys off location, user identity, and machine identity to build access rules.
Grace U.Jun 26, 2026D is the right call here, and it makes sense once you think about what Identity Awareness is actually trying to do, which is give the firewall enough context to write rules that go beyond just IP addresses. Check Point built it around three pillars, network location, user identity, and machine identity, so a policy can say something like "allow this user on this machine from this subnet" rather than just "allow traffic from 10.0.0.1."
Ola B.Jun 17, 2026A is the one that clicked for me when I finally spun up my own Identity Awareness lab, because the whole point of the feature is tying together who is running what application from which machine, and that three-part combo is exactly what you configure your Access Roles around. If you pull up the Access Role object in SmartConsole yourself you will see those three pillars sitting right there, networks plus users plus machines, and application-level visibility folds right into that picture with App Control working alongside it.
Grace U.Jun 18, 2026Ola, you clearly know the Access Role object well, and that three-part breakdown is solid knowledge to hold onto, but D is the pick here because Identity Awareness's core job is mapping user identities to IP addresses so the gateway knows who is behind each connection, and that identity-to-IP binding is what the other blades, including App Control, actually consume to enforce policy.