156-521 · Question #245
If a gateway loses connection to the management server, it:
The correct answer is D. Continues with the last installed policy. When a gateway loses connectivity to its management server, it continues enforcing the last policy that was successfully pushed to it - this is a fundamental design principle ensuring network security and availability are never dependent on a single point of failure. Option A…
Question
If a gateway loses connection to the management server, it:
Options
- ADeletes all policies
- BStops passing traffic
- CInstalls the last backup configuration
- DContinues with the last installed policy
How the community answered
(67 responses)- A3% (2)
- B1% (1)
- C3% (2)
- D93% (62)
Explanation
When a gateway loses connectivity to its management server, it continues enforcing the last policy that was successfully pushed to it - this is a fundamental design principle ensuring network security and availability are never dependent on a single point of failure. Option A is wrong because deleting policies would leave the network completely unprotected, which violates the principle of "fail secure." Option B is wrong because dropping all traffic would cause an outage, making the gateway a single point of failure for the entire network. Option C is wrong because there is no separate "backup configuration" mechanism - the gateway simply retains whatever policy is currently installed in memory.
Memory tip: Think of it as a security guard who loses their radio - they don't abandon their post or tear up their rulebook, they keep following the last orders they were given until communication is restored.
Topics
Community Discussion
4
Amara A.Jan 15, 2026D is the correct answer, and this one trips people up because they confuse runtime behavior with installation behavior. The gateway and the management server are separate components, and the gateway holds a local copy of the policy that was last pushed to it. When the connection to the management server drops, the gateway does not go into some kind of safe-fail state or clear its tables, it just keeps enforcing whatever ruleset was already installed. Think of it like a firewall that was shipped to a remote site with a policy baked in, the Security Management Server being unreachable does not undo the work that SIC and the install job already completed. Options A and B describe catastrophic failure modes that Check Point explicitly avoids by design, and C describes a restore operation that requires deliberate action, not an automatic fallback.
Ola B.Jan 8, 2026Went with C first, but my lab showed the gateway just kept running.
Samuel O.Jan 24, 2026Two decades in network operations taught me that security devices are built to fail safe, not fail open and not fail shut, so when a gateway loses its management server connection it keeps doing its job with whatever policy was last pushed to it. That said, I always wondered whether folks understood the difference between the last *installed* policy versus whatever might be sitting in a pending or staged state that never got committed, because those are two very different things on a live network. Does anyone know if the gateway would pick up a policy that was partially staged but not yet fully installed before the connection dropped?
Ola B.Jan 26, 2026The gateway only enforces what was fully installed and pushed, so anything sitting in a staged or pending commit is completely invisible to the enforcement engine, which is exactly why you want a change freeze window before any planned management outage.