View all questions & answers for the Check Point Certified Security Administrator (CCSA) R82 Exam Materials exam
Check Point Certified Security Administrator (CCSA) R82 Exam Materials-Question 164 Discussion
Comments
Selected Answers: D
Application Control, URL Filtering, and Content Awareness use a Negative (Blacklist) enforcement model by default — meaning all traffic is implicitly allowed unless a rule specifically identifies and blocks it (e.g., blocking specific applications, URL categories, or content types). This differs from the Firewall Rule Base, which by default uses a Positive (Whitelist) model — traffic must be explicitly allowed, or it's dropped.
Why the others are wrong:
A. Permissive Control Model (also known as Whitelist Model) — This describes the opposite approach (explicit allow-only enforcement), which is how the core Firewall policy typically operates, not App Control/URL Filtering/Content Awareness.
B. Restrictive Control Model (also known as Blacklist Model) — "Restrictive" mislabels the blacklist approach — a blacklist model is inherently permissive-by-default (allow unless blocked), not restrictive-by-default, so this pairing of terms is inconsistent.
C. Positive Control Model (also known as Whitelist Model) — Same issue as A — this is the Firewall's typical default enforcement style, not the model these three blades use.
Which type of Control Model is used in Application Control & URL Filtering and Content Awareness Policy? (Choose one answer)
Brave-Dump Clients Votes