Exam 156-587 topic 1 question 29 discussion

Classifier - When the “first packet” rule base check is complete Classifiers initiate streaming for subsequent packets in the session. The “first packet” rule base check identifies a list of rules that possibly may match and a list of classifier objects (CLOBs) that are required to complete the rule base matching process. The Classifier reads this list and generates the required CLOBs to complete the rule base matching. Each Classifier App executes on the packet and tells the result of the CLOB to the UP Manager. The CMI then tells the Protocol Parser to enable streaming.

Correct answer: B. Classifiers In Check Point’s packet processing infrastructure, the Classifier component is responsible for: - Creating and managing CLOBs (Classification Objects) - Analyzing traffic and attaching CLOBs that describe key attributes (e.g., application, user, file type) These CLOBs are then used by the Manager and other components to make security decisions based on policy.

Unified Policy (UP) Infrastructure Components UP Manager of the UP infrastructure Classifier creates classifier objects (CLOBs) to match against the UP policy Observer decides if enough is known in the CLOB to check it against the rule base Column based rule base enforcement matches CLOBs against the policy Handle stores the rule base execution state