Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS. This is because certificate based authentication provides stronger security and easier management than pre-shared secret authentication. The other options are either incorrect or irrelevant for this scenario. References: [Check Point R80.10 - Part 6 - Certificate Based Authentication]

The Object Explorer is the part of SmartConsole that allows administrators to add, edit, delete, and clone objects. Objects are entities that represent network elements, such as hosts, networks, gateways, services, users, etc.  The Object Explorer provides a tree view of all the objects in the database and allows searching, filtering, and grouping them 2 . References:  Check Point R81 SmartConsole R81 User Guide

The Sticky Decision Function (SDF) is required to prevent  failovers  in an Active-Active cluster. The SDF ensures that the same cluster member handles all connections that belong to a certain session.  If the SDF is not enabled, different cluster members may handle different connections of the same session, which may cause a failover or a drop 1 2 . References:  ClusterXL Administration Guide R81 ,  Check Point CCSA - R81: Practice Test & Explanation

The answer is D because in R80 and above, the first administrator to connect to the Management Server using SmartConsole gets a lock on only the objects being modified in his session of the Management Database. Other administrators can connect to make changes using different sessions, but they cannot modify the same objects as the first administrator until he publishes his changes.  This is called concurrent administration and it allows multiple administrators to work on the same policy package simultaneously 1 2  References:  Check Point R80.10 Concurrent Administration ,  Check Point R80.40 Security Management Administration Guide

 Snapshot is the backup utility that captures the most information and tends to create the largest archives. Snapshot creates an image of the entire system, including operating system files, configuration files, databases, and logs. It can be used to restore the system in case of a failure or corruption. Backup creates a compressed file that contains configuration files and databases, but not operating system files or logs. It can be used to restore configuration settings and policies. Database Revision creates a backup of only the database files that store policies and objects. It can be used to revert to a previous revision of the database. Migrate export creates a compressed file that contains configuration files, databases, and logs, but not operating system files. It can be used to migrate data from one machine to another with different hardware or software versions. References: [Backup and Restore], [Database Revision Control] , [Migrate Tools], [Hewlett Packard Enterprise Support Center]

 The product that correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices is  SmartEvent . SmartEvent is a software blade that analyzes logs from various sources such as Security Gateways, Endpoint Security Servers, Identity Awareness Servers, etc. and generates security events based on predefined or custom rules. SmartEvent provides a graphical interface for viewing and managing security events in real-time or historical mode. References: [Check Point R81 SmartEvent Administration Guide]

You should generate new licenses when the existing license expires, license is upgraded or the IP-address where the license is tied changes 1 3 .  These scenarios require a new license to be generated and activated on the Security Gateway or Management Server 1 3 . Therefore, the correct answer is C.  When the existing license expires, license is upgraded or the IP-address where the license is tied changes

 SmartUpdate is the application that is used for the central management and deployment of licenses and packages.  SmartUpdate allows administrators to manage licenses, software updates, and hotfixes for multiple Security Gateways and cluster members from one central location 2 . SmartProvisioning is an application that enables centralized management of network devices. SmartLicense is a feature that simplifies license management by using a cloud-based portal.  Deployment Agent is a component that enables automatic deployment of software packages 3 .

The destination server for Security Gateway logs depends on a Security Management Server configuration. This is true because the Security Management Server defines the log servers that receive logs from the Security Gateways.  The log servers can be either the Security Management Server itself or a dedicated Log Server 1 2 . References:  Check Point R81 Logging and Monitoring Administration Guide ,  Check Point R81 Quantum Security Gateway Guide

To optimize drops, you can use Priority Queues and fully enable Dynamic Dispatcher on the Security Gateway 2 3 . Priority Queues are a mechanism that prioritizes part of the traffic when the Security Gateway is stressed and needs to drop packets. Dynamic Dispatcher is a feature that dynamically assigns new connections to a CoreXL FW instance based on the utilization of CPU cores.  To enable both features, you need to run the command  fw ctl multik set_mode 9  on the Security Gateway 4 . Therefore, the correct answer is C.  fw ctl multik set_mode 9 . References:  CoreXL Dynamic Dispatcher - Check Point Software ,  Firewall Priority Queues in R80.x / R81.x - Check Point Software ,  Separate Config for Dynamic Dispatcher and Priority Queues