Exam 156-315.80 topic 1 question 281 discussion

I think the correct answer is C. Doesn't matter what the OS level hostname is. Only smartDashboard/ smartconsole name is relevant. IP addresses do not matter as SIC is name based "SIC is completely NAT tolerant, as the protocol is based on Certificates and SIC names, not on IP addresses. A NAT device between the Security Management Server and Security Gateway will not have any effect on the ability of a Check Point enabled entity to communicate using SIC."

D is confirmed here: https://quizlet.com/au/509819782/ccsa-study-notes-flash-cards/

C Because the hostname (name of the Security Management Server) has not been changed, SIC communication should not be affected, as long as the routing is correct

It's D. IP Address of the Internal Certificate Authority (ICA) of Security Management Server / Domain Management Server is automatically added to Check Point Registry file ($CPDIR/registry/HKLM_registry.data) on Security Gateway when SIC is first established (between Security Gateway and Management Server). If the IP Address of Security Management Server / Domain Management Server is changed, and SIC is never manually reset (between Security Gateway and Management Server), then the AutoRenewal of the Certificate will fail. https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103356

Had this question today in exam. selected C

I think C is correct. From CCSA pag 27. "Note: If the Security Management Server is renamed, trust will need to be reestablished as the certificate is reissued"

Answer is C: CCSA Manual page 79: Once SIC is established, the management server and its components are identified by their SIC names rather than the IP address. If the Security Management Server is renamed, trust will need to be reestablished as the certificate is reissued.

D is correct answer. IP Address of the Internal Certificate Authority (ICA) of Security Management Server / Domain Management Server is automatically added to Check Point Registry file ($CPDIR/registry/HKLM_registry.data) on Security Gateway when SIC is first established (between Security Gateway and Management Server). If the IP Address of Security Management Server / Domain Management Server is changed, and SIC is never manually reset (between Security Gateway and Management Server), then the AutoRenewal of the Certificate will fail. https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103356

SIC is dependent on the SMS name... If you look at the CN you will notice the SMS name. Hence, it is specific to name and not IP.

C is partially correct. based on sk40993, Notes, Notes: Since the hostname (name of the Security Management) has not been changed, SIC communication should not be affected, as long as the routing is correct. Make sure that there is connectivity between the Security Management and the managed Security Gateway(s), and that DNS resolution is to the new IP Address. 3. If the DNS does not resolve to the new IP, you will need to reset SIC to confirm the change.