What is correct regarding the target device for deploying SmartEvent components?
A.
SmartEvent is just a blade on the Security Management Server and can be activated on a Primary or Secondary SMS only.
B.
SmartEvent works by correlating logs; hence, it has to be deployed on each Log Server. If any Log Server does not include SmartEvent components, then its logs will not be correlated.
C.
SmartEvent is always a dedicated standalone exclusive device.
D.
SmartEvent can be integrated with the Security Management Server or deployed on a dedicated Log or SmartEvent Server.
The correct answer isD. SmartEvent is flexible in deployment. Check Point R82 documentation states that SmartEvent can be enabled on the Security Management Server, and it also documents how to connect a dedicated SmartEvent Server and SmartEvent Correlation Unit to the Security Management Server. That means SmartEvent is not restricted to only Primary/Secondary Security Management Servers, nor is it always forced into a dedicated standalone appliance. Option A is too narrow because it ignores dedicated SmartEvent deployment. Option B is wrong because SmartEvent correlation does not require every Log Server to become a SmartEvent Server; correlation units and log servers are configured as components of the SmartEvent system. Option C is also wrong because SmartEvent can be integrated into the management deployment where supported. In production, the best design depends on log volume, event correlation load, retention needs, and management-server sizing, but the product supports both integrated and dedicated deployment models. Reference topic:Deploying SmartEvent / Connecting SmartEvent to the Security Management Server.
========
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit