Getting Your Check Point Firewall-1 Certifications
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
There are several different certifications that are offered by Check Point:
CCSA: Check Point Certified Security Administrator
CCSE: Check Point Certified Security Expert
CCSI: Check Point Certified Security Instructor
CCQE: Check Point Certified Quality of Service Expert
CCAE: Check Point Certified Addressing Expert
The first three certifications are related to the FireWall-1 product; the other two are related to other Check Point products. In this article, I focus on the CCSA and CCSE certifications.
A CCSA is someone who is skilled in the basic administration of FireWall-1, and knows how to utilize its basic features. Some details must be known about the default behaviors of FireWall-1, how to load/unload policies (both from the command line and GUI), how the different forms of authentication work, and about address translation. Also, the architecture of FireWall-1 must be understood, such as the SVN Foundation, Policy Editor, management console, and firewall modules.
A CCSE is someone who knows FireWall-1 at a deeper level. Aside from what a CCSA must know, which must be understood in greater detail, a CCSE must also know about encryption (both site-to-site and client-to-site), load balancing with the connect control module, content security, SYNDefender, and how TCP works. The recently introduced CCSE plus also covers troubleshooting, high availability, and performance tuning. CCSE plus is geared toward advanced users and customer support engineers tasked with supporting FireWall-1.
In order to obtain any of the Check Point certifications, you must pass a certification exam. These exams are given in authorized testing centers via computer. Check Point currently uses a company called VUE to administer the exams. In order to take a test, one simply logs onto VUE's Web page (http://www.vue.com), pays a testing fee of $150, and schedules a test at a nearby facility. The tests are each 90 minutes in length and have approximately 100 questions each. The multiple-choice questions range from "complete the sentence" to case-study situations in which you have to provide an answer based on the scenario and details presented in the question.
Passing the CCSA exam is relatively easy. Most of the questions are directly lifted (some verbatim) from the Check Point Security Courseware books that you get when you take the Management I or CCSA 2000 class from an authorized training center. The CCSE exam is a bit more difficult because all the tested material isn't in the Management II/CCSE 2000 courseware; it comes from a variety of sources, including the product documentation, and even a little real-world experience. As of this writing, the CCSE Plus exams are not being offered yet, but I imagine the tests will be similar to the CCSE.
Here are the biggest tips I can give you. Read the questions very carefully. The questions, particularly on the CCSE exam, can be semantically misleading. Also, don't try and read too much into the questions. Take them pretty much at face value. If you overthink the questions, you will likely get them wrong.
Check Point provides a topic list for the CCSA and CCSE exams at http://www.checkpoint.com/services/education/certification/studyaids.html. However, having just taken the CCSA and CCSE tests for NG myself very recently (and passed), I can give you a slightly better idea about the kinds of questions to expect on this test. Note that the questions you are asked come from a larger pool of questions, so you may get slightly different questions than I did.
CCSA:
There were many questions about the default settings for the Policy Editor, specifically—ones having to do with Address Translation and ICMP. There were a lot of other GUI-type questions, such as how to hide a column in the log viewer, what the defaults are for the "Block Intruder" option, and what the default user template is called.
There were several questions about Address Translation. Know Address Translation well.
There were several questions about the different authentication types in FireWall-1. You should know what they are and when they are most appropriate to use.
You should definitely know what a firewall is and is not. Yes, they ask questions about this.
You should know what components make up the management GUIs.
You should know where FireWall-1 locates itself in the OSI model.
You should know the various commands to load and fetch a security policy from the command line.
CCSE:
There are a lot of installation-related questions, such as memory and disk space requirements, the order of installation, how many administrator users are needed on installation, how to upgrade from previous versions, how to run the installation, and so on.
There are several questions on licensing: where to get licenses, the various commands for installing and viewing licenses, and requirements for licensing.
Logging and alerting questions are asked, including those about the various types of alerts that can be done, questions about the supplied 'alertf' command, the "Excessive Log Grace Period," and where alert scripts are run.
Know how the Connect Control Module works. Questions will be asked in "Persistent Server Mode," how to set up the rulebase, and the various load balancing algorithms that are available.
For Content Security, know what CVP and UFP are and how they operate. Know what the file format of a URI Specification file is and where it is stored, how HTML Weeding actually works, the various options when defining resources, and how TCP resources work (particularly with UFP).
There are a couple of questions related to SYNDefender. You need to understand the three SYNDefender modes and how they interact with the three-way TCP handshake.
There are several encryption-related questions. Know the distinction between and algorithm and a scheme, and which ones of each are supported; how symmetric and asymmetric encryption work, and where FireWall-1 uses them; how FWZ and IKE work; and how to configure them.
There are several Secure Client-related questions. Aside from knowing how it works, you need to know what a policy server is; what indication shows in Secure Client when you've authenticated to one; what the properties "Cache static passwords on desktop" and "Respond to unauthenticated topology requests" do; what hybrid authentication is, and how to configure and troubleshoot it; and what RDP status queries are.
Sample tests can be obtained from a variety of sources:
Boson Software: http://www.boson.com/tests/firewalls.htm
CramSession: http://studyguides.cramsession.com/cramsession/checkpoint/
BeachFront Quizzer: http://www.bfq.com/checkpoint.html
SimulationExams.com: http://www.simulationexams.com/checkpoint.htm
Good luck with your certification.