View all questions & answers for the Check Point Certified Security Administrator (CCSA) R82 Exam Materials exam
Check Point Certified Security Administrator (CCSA) R82 Exam Materials-Question 174 Discussion
Comments
Selected Answers: B
Check Point's HTTPS Inspection documentation confirms directly: to prevent users from getting warnings about the generated CA certificates that HTTPS Inspection uses, install the generated CA certificate used by HTTPS Inspection as a trusted CA — distributed via mechanisms like Windows GPO — which adds the generated CA to the trusted root certificates repository on client computers. The R80.30 guide's step-by-step confirms the exact store name: click Trusted Root Certification Authorities... to install a copy of the certificate to that store, and since this is deployed machine-wide (e.g., via GPO to all users of a computer), it's installed to the **Local Computer** store, not the per-user profile.
Why the other options are wrong:
- **A. Third-party Root Certification Authorities certificate store – (Local Computer)** — The HTTPS Inspection CA is Check Point's own internally generated CA (not a third-party CA), so it belongs in the "Trusted Root Certification Authorities" store, not the "Third-Party Root Certification Authorities" store, which is reserved for CAs issued by external/commercial certificate authorities.
- **C. Third-party Root Certification Authorities certificate store – (Current User)** — Wrong store type (same issue as A) and wrong scope (Current User only trusts the cert for that one profile, not machine-wide, which defeats the purpose of a domain-wide GPO deployment).
- **D. Trusted Root Certification Authorities certificate store – (Current user)** — Correct store type, but wrong scope. Deploying to "Current User" would only suppress warnings for that one logged-in profile; for organization-wide GPO deployment to prevent warnings for all users on a machine, the certificate needs to go into the **Local Computer** store.
After enabling and configuring Outbound HTTPS inspection on Security Gateway, you need to prevent users from getting warnings about the generated CA certificates that HTTPS inspection uses. In which certificate store do you need to add exported HTTPS inspection certificate to client computer? (Choose one answer)
Brave-Dump Clients Votes