Exam 156-215.80 topic 1 question 249 discussion

Actually no, both question and answer are correct, as explained in the Identity Awareness guide: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_IdentityAwareness_AdminGuide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/CP_R80.30_IdentityAwareness_AdminGuide/138676 " In rules with Access Role objects, criteria matching works like this: • When identity data for an IP address is known: • If it matches an Access Role, the rule is enforced and traffic is allowed or blacked based on the action. • If it does not match an Access Role, it goes on to examine the next rule. • When identity data for an IP address is unknown and: • All rule fields match, besides the Source field with an Access Role. • The connection is HTTP. • The action is set to redirect to the Captive Portal. If all the conditions apply, the traffic is redirected to the Captive Portal to get credentials and see if there is a match. If not all conditions apply, there is no match, and the next rule is examined. Note - You can only redirect HTTP traffic to the Captive Portal. "

now it makes sense, thanks a lot.

There are 2 questions in the exam, but with different options: 1) matches the Access Role 2) does not match the Access Role According to the documentation, the behavior has not changed even in R81: " In rules with Access Role objects, criteria matching works like this: When identity data for an IP address is known: If it matches an Access Role, the rule is enforced and traffic is allowed or blacked based on the action. If it does not match an Access Role, it goes on to examine the next rule. " it says here that the identity is known and there is not a word about the Captive portal that's why C is the correct answer