156-215.82 practice question 3 of 10

You are configuring security policy for your organization and need to implement traffic control based on user identity. Your security team wants to…

You are configuring security policy for your organization and need to implement traffic control based on user identity. Your security team wants to allow specific users in the Finance department to access a particular server, but deny access to all other users. You have already collected user identity information through an Identity Collector. What is the next step you should take in SmartConsole to enforce this requirement?

Answer options

A: Create a User Access Role that maps the Finance department users, then create an Access Control Policy rule that uses this role as the source and specifies the appropriate server and action Correct answer

B: Modify the network objects for Finance department users in the GATEWAYS & SERVERS view and then create a policy rule based on these modified objects

C: Create an Ordered Layer specifically for identity-based rules and configure threat prevention signatures to recognize Finance department traffic patterns

D: Configure HTTPS Inspection on the Security Gateway to decrypt user traffic and manually identify which packets belong to Finance department users

E: Use the SmartLog query interface to filter historical logs by user identity and then create a policy rule based on the filtered results

Correct Answer:

A. Create a User Access Role that maps the Finance department users, then create an Access Control Policy rule that uses this role as the source and specifies the appropriate server and action

Explanation

To enforce identity-based access control in Check Point R82, administrators must utilize Access Role objects. Once user identity information is acquired via an Identity Source (such as the Identity Collector), the next logical step is to create an Access Role object that maps to the specific users or Active Directory groups (e.g., the Finance department). This Access Role is then placed in the Source column of an Access Control Policy rule, specifying the destination server and the "Accept" action. A subsequent rule can be created to drop access for other users. This method ensures that the firewall dynamically applies access control based on authenticated user identity rather than static IP addresses.

Why Incorrect

- Option B: Network objects represent static IP addresses or subnets, not user identities. Identity Awareness requires the use of Access Roles.
- Option C: Ordered Layers are for policy structuring, and Threat Prevention signatures do not enforce basic user-based access control to specific servers.
- Option D: HTTPS Inspection decrypts SSL/TLS traffic for content inspection; it is not the mechanism for identifying users or enforcing identity-based access rules.
- Option E: SmartLog is a logging and monitoring tool, not a configuration interface for creating or enforcing access control policies.

References

- Check Point R82 Identity Awareness Administration Guide, Section: "Configuring Identity Awareness" -> "Access Roles".

- Check Point R82 Security Management Administration Guide, Section: "Creating an Access Control Policy".

Keep practicing

Take the free 156-215.82 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test