156-521 · Question #214
Where does Check Point store SIC certificates?
The correct answer is B. $CPDIR/conf. Option B is correct because $CPDIR refers to the Check Point shared components directory (typically /opt/CPshared/5.0), and SIC (Secure Internal Communication) certificates are managed by the shared infrastructure layer - not the firewall engine itself - making $CPDIR/conf the…
Question
Where does Check Point store SIC certificates?
Options
- A$FWDIR/conf
- B$CPDIR/conf
- C$MDSDIR/etc
- D$PDIR/security
How the community answered
(23 responses)- A4% (1)
- B87% (20)
- C9% (2)
Explanation
Option B is correct because $CPDIR refers to the Check Point shared components directory (typically /opt/CPshared/5.0), and SIC (Secure Internal Communication) certificates are managed by the shared infrastructure layer - not the firewall engine itself - making $CPDIR/conf the correct home for these certificates.
Why the distractors are wrong:
- A (
$FWDIR/conf) -$FWDIRis the FireWall daemon directory, housing firewall-specific files like policy andobjects.C; SIC is a platform-level service, not firewall-specific. - C (
$MDSDIR/etc) -$MDSDIRis only present on Multi-Domain Security Management servers; it's not the general location for SIC certificates across all Check Point products. - D (
$PDIR/security) -$PDIRis not a standard Check Point environment variable, making this a fabricated distractor.
Memory tip: Think of it this way - SIC is a shared service that secures communication between all Check Point components, so it belongs to the shared CP directory. CPDIR = CP-wide = Certificates Path. When in doubt, SIC lives with the shared infrastructure, not the firewall (FWDIR).
Topics
Community Discussion
5
Mateus R.Feb 25, 2026The answer is B, $CPDIR/conf. Think of $CPDIR as the front office of the whole Check Point building, the place where company-wide credentials and paperwork live, while $FWDIR is just the security guard's booth down the hall. SIC is a company-wide trust system that every Check Point component uses to authenticate to each other, so its certificates naturally live in that shared front office under $CPDIR/conf, not tucked away in the firewall-specific folder.
Hiroshi T.Feb 15, 2026The Check Point R81.20 Administration Guide is explicit that SIC certificates live under the CPDIR path, not FWDIR, because SIC is a platform-level service that runs across all Check Point products rather than being tied to the firewall blade specifically. Can anyone point to the exact document section that explains why the MDS directory was ruled out for certificate storage on a Multi-Domain Server, since that tripped me up the first time I saw this question?
Nina C.Feb 15, 2026The MDS path gets ruled out because it scopes to domain-specific management data, and SIC has to authenticate at the platform level before any domain context even exists, so CPDIR is the only path that is guaranteed to be reachable regardless of which domain is active.
Nina C.Feb 19, 2026I kept going back and forth on this one, but I landed on C because the MDS layer is where the multi-domain architecture lives, and SIC is a trust infrastructure that has to span domains, so it made sense to me that those certificates would live under MDSDIR/etc rather than a product-specific path. Can anyone who has actually poked around a Provider-1 setup confirm whether they saw them there?
Mateus R.Feb 20, 2026Nina, the logic is close but the address is off. Think of the MDS like an apartment building manager's office, and each CMA like a tenant's individual unit. SIC certificates are issued to and stored with each tenant in their own CPDIR/conf space, not filed in the building manager's shared directory, so B is the one pointing to that per-object CPDIR path rather than the MDS-level tree.