You receive reports that Users cannot browse internet sites. You are using identity awareness with AD Query and Identity Collector in addition you have the Browser Based Authentication Enabled. What…

Question

Options

• Aon the gateway: ad debug on
• Bon the gateway: ad query debug on
• Con the management: ad query debug extended
• Don the gateway: pdp debug nac extended

• A
  6% (1)
• B
  6% (1)
• C
  12% (2)
• D
  76% (13)

Explanation

Option D is correct because in Check Point Identity Awareness, Browser Based Authentication (BBA) is handled by the NAC (Network Access Control) module on the gateway, and pdp debug nac extended is the command that targets exactly that component - pdp (Policy Decision Point) is the gateway process managing identity decisions, and the nac flag scopes the debug to BBA-related traffic flows.

Option A (ad debug on) is not a valid Check Point CLI command - no such syntax exists in the gateway debug toolkit. Option B (ad query debug on) conflates AD Query syntax with a non-existent command structure; AD Query issues are diagnosed differently, and the syntax is wrong. Option C is wrong on two counts: the correct location for gateway-side BBA debugging is the gateway, not the management server, and ad query debug extended targets AD Query, not the Browser-Based Authentication layer.

Memory tip: Associate NAC with BBA - both involve the "captive portal / browser challenge" flow. Whenever the question mentions Browser Based Authentication in a debugging scenario, think pdp debug nac extended on the gateway.

No community discussion yet for this question.