Check Point Certified Security Administrator - R81 (CCSA)

To use Application objects in a rule, the "Applications & URL Filtering" blade should be enabled on the policy layer where the rule is being created. Enabling the "Application Control" blade on a gateway is not enough.
References:
Check Point R81 Security Management Administration Guide, page 102.

Service blades must be attached to a Security Gateway. A Security Gateway is a device that enforces security policies on traffic that passes through it. A service blade is a software module that provides a specific security function, such as firewall, VPN, IPS, etc. A Security Gateway can have one or more service blades attached to it, depending on the license and hardware capabilities. The other options are incorrect. A management container is a virtualized environment that hosts a Security Management Server or a Log Server. A management server is a device that manages security policies and distributes them to Security Gateways. A Security Gateway container is not a valid term in Check Point terminology.
References:
[Check Point R81 Security Management Administration Guide], [Check Point R81 CloudGuard
Administration Guide]

The GUI tool that can be used to view and apply Check Point licenses is SmartUpdate. SmartUpdate is a centralized tool that allows you to manage licenses, software packages, and hotfixes for multiple gateways and clusters. cpconfig, Management Command Line, and SmartConsole are not tools for license management.
References:
Check Point R81 SmartUpdate Administration Guide, | Udemy

The two types of NAT supported by the Security Gateway are hide NAT and static NAT. Hide NAT translates many source IP addresses into one IP address, usually the external interface of the gateway.
Static NAT translates one source IP address into another IP address, usually a public IP address. The other options are not valid types of NAT.
References:
Network Address Translation (NAT),

Central License is the preferred and recommended method of licensing because it ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. Central License allows administrators to manage licenses for all Security Gateways from one central location. If the IP address of a gateway changes, the license remains valid as long as it is connected to the same management server. Central Licensing is supported with Gaia and is not the only option when deploying Gaia. Central Licensing does not tie to the IP address of a gateway and can not be changed to any gateway if needed.

References:
1: Rugged Appliances
2: SmartUpdate
3: Check Point Software Deployment Options : [Anti-Virus] : [Check Point Software Blades] : [Central
License]

The User Directory is used to obtain identification and security information about network users. It can be integrated with external user databases such as LDAP, RADIUS, or TACACS+.
References:
Certified Security Administrator (CCSA) R81.20 Course Overview, page 9.

The Secure Network Distributor (SND) is a feature of the Security Gateway that is used to distribute packets among Firewall instances . It improves the performance and scalability of the Firewall by utilizing multiple CPU cores. The other options are not related to SND.
References:
[Check Point Security Gateway Architecture and Packet Flow], [Free Check Point CCSA Sample Questions and Study Guide]

Certificate is the most secure means of authentication among the given options. A certificate is a digital document that contains information about the identity of a user or a device, and is signed by a trusted authority. A certificate can be used to prove the identity of a user or a device without revealing any sensitive information, such as passwords or tokens. Password, token, and pre-shared secret are less secure means of authentication because they can be easily compromised, stolen, or guessed by attackers.
References:
Secure User Authentication Methods - freeCodeCamp.org, What is the Most Secure
Authentication Method for Your Organization ...

The correct answer is D because the command save configuration <filename> stores the Gaia configuration in a file for later reference. The other commands are not valid in Gaia Clish.
References:
Gaia R81.10 Administration Guide

A SAM (Suspicious Activity Monitoring) rule is implemented to provide the function or benefit of blocking suspicious activity. A SAM rule is a rule that defines an action to be taken by the firewall when it detects a suspicious activity, such as an attack, a scan, or a policy violation. The action can be blocking, dropping, rejecting, or logging the traffic that triggered the suspicious activity. A SAM rule can be created manually or automatically by other security features, such as IPS, Anti-Bot, or SmartEvent.
References:
[SAM Rules], [Suspicious Activity Rules]