Checkpoint 156-315.82 Exam Dumps, Practice Test Questions

This action belongs to a DIFFERENT workstream that the question did not request: An annual continuity drill must distinguish an ordinary nightly export from a live, synchronized management standby that can take over. Its legitimate action would be: Run a planned Management HA failover drill that compares policy and object revisions, verifies standby synchronization and validates restoration of normal administrative operations. Underlying technical basis: Management redundancy requires repeatable role and database validation through actual controlled failover scenarios rather than only host availability metrics. None of the 3 listed workstreams asks for that separate configuration. For the primary listed case, the necessary action is: Configure supported VPN Link Selection and ISP Redundancy in SmartConsole for the intended primary/backup or load-sharing mode, then verify tunnel behavior during link failure.

This action belongs to a DIFFERENT workstream that the question did not request: A branch security gateway must preserve outbound address concealment while maintaining controlled one-to-one reachability to a dedicated mail server. Its legitimate action would be: Select static one-to-one or hide many-to-one translation as appropriate, ensure any required proxy ARP or routing support, and test bidirectional versus outbound-only reachability. Underlying technical basis: Static and hide NAT have different mapping and connection-initiation semantics; service reachability depends on policy, routes and translated IP ownership. None of the 3 listed workstreams asks for that separate configuration. For the primary listed case, the necessary action is: Configure supported VPN Link Selection and ISP Redundancy in SmartConsole for the intended primary/backup or load-sharing mode, then verify tunnel behavior during link failure.

This action belongs to a DIFFERENT workstream that the question did not request: Before an ElasticXL build, a network engineer must draw the four-interface baseline and identify management, sync and data connectivity boundaries. Its legitimate action would be: Design and verify each ElasticXL member's supported management, dedicated synchronization and data interfaces, keeping sync ports in a common isolated Layer-2 domain. Underlying technical basis: ElasticXL member synchronization depends on approved physical and logical interface topology, including a dedicated L2 broadcast domain for Sync ports. None of the 3 listed workstreams asks for that separate configuration. For the primary listed case, the necessary action is: Configure supported VPN Link Selection and ISP Redundancy in SmartConsole for the intended primary/backup or load-sharing mode, then verify tunnel behavior during link failure.

This option applies to another R82 operational problem: A company successfully imports policy objects, but Gateway SIC fails due to changed management identity mapping and an intervening NAT. In that distinct situation, the relevant decision would be: Revalidate the imported primary Management Server's gateway objects, SIC relationships, management address reachability and policy installation in the distributed environment. Its technical reason is: Distributed security environments separate central management from enforcement gateways; migration must restore secure control-plane reachability and policy ownership. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required decision is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover. The offered alternative does not meet this case’s requirement or supply its validation.

This is a shortcut explicitly unsuited to the current incident: Enable Enhanced Link Selection on an ElasticXL environment and assume all platform limitations disappear without checking the R82 feature support list. The actual operational requirement is: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The supported action instead is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover. Its technical rationale is: R82 Enhanced Link Selection uses standard peer-liveness checks and interface-level redundancy for eligible gateways, including supported third-party interoperability. Verify success by: A multi-interface peer negotiates over the expected active links, DPD detects a failed path, and new tunnels select a configured backup without packet-by-packet path mixing.

This option applies to another R82 operational problem: A security policy must restrict a cloud SaaS destination whose published addresses rotate weekly, and operators need a documented dynamic object rather than a broad Any rule. In that distinct situation, the relevant decision would be: Add the supported Check Point Updatable Object as a source or destination in the appropriate R82 Access Control rule, publish and install policy, and validate matching traffic. Its technical reason is: Updatable Objects represent curated dynamic external-service address sets that can update independently from static network definitions and reduce manual rule edits. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required decision is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: An R81.20 management server must be replaced with new R82 hardware while retaining hundreds of managed Gateway objects and policies. In that distinct situation, the relevant validation would be: A completed export archive and migration log identify the intended management domain and can be read by the compatible import process on a test target. Its technical reason is: Management database migration requires a supported export/import process and careful preservation of security state rather than naive file copying. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required validation is: A multi-interface peer negotiates over the expected active links, DPD detects a failed path, and new tunnels select a configured backup without packet-by-packet path mixing. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A health dashboard reports one management server offline yet firewall traffic still passes through the gateways, and the team must identify which HA role affects management availability. In that distinct situation, the relevant validation would be: The HA view names the intended single Active and synchronized Standby; a protected SmartConsole session and controlled policy query succeed through the Active member. Its technical reason is: Check Point R82 Management HA maintains one active manager with a synchronized standby using management-database revisions; control-plane roles differ from Gateway HA roles. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required validation is: A multi-interface peer negotiates over the expected active links, DPD detects a failed path, and new tunnels select a configured backup without packet-by-packet path mixing. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: An organization permits Microsoft 365 connectivity but its hard-coded provider IP rules are obsolete after vendor changes. In that distinct situation, the relevant validation would be: Authorized traffic to the provider's current dynamic address range matches the intended rule while a deliberately unrelated destination remains subject to normal policy. Its technical reason is: Updatable Objects represent curated dynamic external-service address sets that can update independently from static network definitions and reduce manual rule edits. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required validation is: A multi-interface peer negotiates over the expected active links, DPD detects a failed path, and new tunnels select a configured backup without packet-by-packet path mixing. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: An ElasticXL member shows healthy data uplinks but cannot join its cluster after technicians changed the dedicated Sync interface VLAN. In that distinct situation, the relevant risk would be: ElasticXL R82 requires dedicated sync connectivity and sufficient supported interfaces; using routed or unrelated broadcast domains can prevent member discovery. Its technical reason is: ElasticXL member synchronization depends on approved physical and logical interface topology, including a dedicated L2 broadcast domain for Sync ports. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required risk is: R82 Enhanced Link Selection has documented exclusions such as ElasticXL and certain DAIP or special VPN designs; it is not interchangeable with every legacy link mode. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A cluster deployment stalls because appliances are wired correctly but the Gaia First Time Configuration Wizard was not completed consistently. In that distinct situation, the relevant risk would be: ElasticXL requires qualified hardware and installation state; attaching an existing production Gateway without its supported initialization process can corrupt service configuration. Its technical reason is: A supported ElasticXL deployment requires compatible appliance setup, initialization and management-cluster enrollment, not merely a GUI name change. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required risk is: R82 Enhanced Link Selection has documented exclusions such as ElasticXL and certain DAIP or special VPN designs; it is not interchangeable with every legacy link mode. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: An auditor requests a monthly review of high-severity intrusion events across headquarters and two branch gateways. In that distinct situation, the relevant risk would be: Missing log retention, incomplete sources, licensing or permissions can yield partial reports even when the report generation job finishes successfully. Its technical reason is: SmartEvent reporting summarizes correlated security patterns, but defensible investigation requires time-bounded scope and traceability to source event evidence. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required risk is: R82 Enhanced Link Selection has documented exclusions such as ElasticXL and certain DAIP or special VPN designs; it is not interchangeable with every legacy link mode. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A security estate contains standalone and distributed deployments, and the team must distinguish procedures before scheduling an R82 rollout. In that distinct situation, the relevant principle would be: R82 upgrade choice depends on supported source versions, hardware, partition capacity and management topology; successful package download is not validation. Its technical reason is: R82 upgrade choice depends on supported source versions, hardware, partition capacity and management topology; successful package download is not validation. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required principle is: R82 Enhanced Link Selection uses standard peer-liveness checks and interface-level redundancy for eligible gateways, including supported third-party interoperability. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: After a supported ElasticXL expansion, the on-call team must verify all cluster members participate and that intended firewall policy is consistently enforced. In that distinct situation, the relevant principle would be: ElasticXL operational health combines member discovery, synchronization and traffic distribution; resilience claims require controlled tests and capacity headroom. Its technical reason is: ElasticXL operational health combines member discovery, synchronization and traffic distribution; resilience claims require controlled tests and capacity headroom. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required principle is: R82 Enhanced Link Selection uses standard peer-liveness checks and interface-level redundancy for eligible gateways, including supported third-party interoperability. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A financial gateway management service needs an R82 standby for planned maintenance but currently has only a daily export of the production management database. In that distinct situation, the relevant principle would be: A legitimate secondary requires the supported management role and authenticated database replication; copied disk files alone do not create safe HA membership. Its technical reason is: A legitimate secondary requires the supported management role and authenticated database replication; copied disk files alone do not create safe HA membership. Here, however, the question concerns: A third-party cloud IPsec peer requires redundant source addresses, and the R82 security gateway must avoid proprietary-only legacy Link Selection mechanisms. The specific required principle is: R82 Enhanced Link Selection uses standard peer-liveness checks and interface-level redundancy for eligible gateways, including supported third-party interoperability. The offered alternative does not meet this case’s requirement or supply its validation.

This action belongs to a DIFFERENT workstream that the question did not request: After firewall consolidation, SIC sessions from remote gateways target the management server's old private IP and cannot traverse the translated WAN path. Its legitimate action would be: Configure Security Management behind NAT with correct reachable address representations, SIC or certificate expectations, and routing so remote Gateways and SmartConsole can reach the managed server. Underlying technical basis: When Management is behind NAT, peer identity and authenticated communications need correct translated connectivity rather than blindly using internal private addressing. None of the 2 listed workstreams asks for that separate configuration. For the primary listed case, the necessary action is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover.

This action belongs to a DIFFERENT workstream that the question did not request: A SmartEvent administrator wants to trend compliance score changes after correcting outdated inspection settings in a controlled policy deployment. Its legitimate action would be: Assess applicable Check Point Compliance Blade findings against explicit security best-practice or regulatory baseline, record exceptions, and prioritize verified remediation. Underlying technical basis: Compliance checks compare security policy configuration to recognized rules and baselines; actual regulatory assurance also needs context, scope and independent evidence. None of the 2 listed workstreams asks for that separate configuration. For the primary listed case, the necessary action is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover.

This action belongs to a DIFFERENT workstream that the question did not request: An R82 gateway has multiple active IPsec tunnels and an engineer must correlate one peer's negotiation logs with user traffic before making a disruptive change. Its legitimate action would be: Inspect IKE and IPsec negotiations, VPN community state, Security Gateway logs and actual protected traffic paths to isolate tunnel or policy failures before changing proposals. Underlying technical basis: IPsec tunnel troubleshooting separates control-plane security-association negotiation from inner packet routing, selectors and firewall policy outcomes. None of the 2 listed workstreams asks for that separate configuration. For the primary listed case, the necessary action is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover.

This option applies to another R82 operational problem: A datacenter migration changes management appliance hardware, and the owner needs independent proof that critical configuration archives are readable. In that distinct situation, the relevant decision would be: Capture and verify supported Security Gateway or Management backups, snapshots, configuration exports and restore dependencies before upgrading production software. Its technical reason is: Reliable upgrade rollback requires explicit recovery artifacts and supported restoration paths for the affected server roles and their dependent data. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required decision is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A SOC engineer must generate a security event report for one affected VPN peer and verify it does not include unrelated events. In that distinct situation, the relevant decision would be: Run an authorized SmartEvent report or investigation with scoped time, sources and event criteria, then validate counts against underlying gateway log evidence. Its technical reason is: SmartEvent reporting summarizes correlated security patterns, but defensible investigation requires time-bounded scope and traceability to source event evidence. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required decision is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover. The offered alternative does not meet this case’s requirement or supply its validation.

This is a shortcut explicitly unsuited to the current incident: Enable Enhanced Link Selection on an ElasticXL environment and assume all platform limitations disappear without checking the R82 feature support list. The actual operational requirement is: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The supported action instead is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover. Its technical rationale is: R82 Enhanced Link Selection uses standard peer-liveness checks and interface-level redundancy for eligible gateways, including supported third-party interoperability. Verify success by: A multi-interface peer negotiates over the expected active links, DPD detects a failed path, and new tunnels select a configured backup without packet-by-packet path mixing.

This option applies to another R82 operational problem: A secondary manager was restored from a snapshot, and SIC identity validation fails while an administrator attempts to synchronize a new policy revision. In that distinct situation, the relevant validation would be: The HA status moves from Not Communicating to synchronized and an authorized peer-to-peer connectivity and SIC check passes with expected policy revision IDs. Its technical reason is: Management database synchronization depends on reliable authenticated management-to-management communication, not on mere reachability of the host interfaces. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required validation is: A multi-interface peer negotiates over the expected active links, DPD detects a failed path, and new tunnels select a configured backup without packet-by-packet path mixing. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A branch security gateway must preserve outbound address concealment while maintaining controlled one-to-one reachability to a dedicated mail server. In that distinct situation, the relevant validation would be: The mapped private server is reachable in the approved inbound design while internal clients share the intended egress address, and unexpected inbound sessions remain denied. Its technical reason is: Static and hide NAT have different mapping and connection-initiation semantics; service reachability depends on policy, routes and translated IP ownership. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required validation is: A multi-interface peer negotiates over the expected active links, DPD detects a failed path, and new tunnels select a configured backup without packet-by-packet path mixing. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: An annual continuity drill must distinguish an ordinary nightly export from a live, synchronized management standby that can take over. In that distinct situation, the relevant validation would be: A documented simulated management outage moves administrative access to the intended peer, preserves required policies and objects and confirms post-recovery synchronization. Its technical reason is: Management redundancy requires repeatable role and database validation through actual controlled failover scenarios rather than only host availability metrics. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required validation is: A multi-interface peer negotiates over the expected active links, DPD detects a failed path, and new tunnels select a configured backup without packet-by-packet path mixing. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: The HA status displays Sync Error after a forced switch, and a security lead must choose a safe investigation before another policy install. In that distinct situation, the relevant risk would be: Demoting a peer can overwrite its database with the authoritative Active data, so save required changes and understand collision direction before taking action. Its technical reason is: An HA collision is a control-plane state conflict, and explicit authoritative role selection and subsequent sync are needed to avoid divergent management policies. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required risk is: R82 Enhanced Link Selection has documented exclusions such as ElasticXL and certain DAIP or special VPN designs; it is not interchangeable with every legacy link mode. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A new security architect wants to ensure that redundancy on management hosts is not being confused with ClusterXL failover for internet traffic. In that distinct situation, the relevant risk would be: Management HA protects the management database, not Security Gateway packet forwarding; a standby manager does not automatically provide a second traffic-enforcing Gateway. Its technical reason is: Check Point R82 Management HA maintains one active manager with a synchronized standby using management-database revisions; control-plane roles differ from Gateway HA roles. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required risk is: R82 Enhanced Link Selection has documented exclusions such as ElasticXL and certain DAIP or special VPN designs; it is not interchangeable with every legacy link mode. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: An engineer receives an archived primary management export and must restore it to a new appliance without treating log backups as policy objects. In that distinct situation, the relevant risk would be: A fresh R82 installation alone does not import prior policies or ICA state, and an incompatible archive can fail or produce incomplete configuration. Its technical reason is: The advanced upgrade via migration has distinct export, target installation and import stages; the new server must preserve required management identity and data. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required risk is: R82 Enhanced Link Selection has documented exclusions such as ElasticXL and certain DAIP or special VPN designs; it is not interchangeable with every legacy link mode. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A security team must keep cloud provider address sets current when the managed gateway resides behind a restricted outbound firewall. In that distinct situation, the relevant principle would be: Cloud-provided Updatable Object content must reach the enforcement Gateway or approved proxy to remain useful after external address changes. Its technical reason is: Cloud-provided Updatable Object content must reach the enforcement Gateway or approved proxy to remain useful after external address changes. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required principle is: R82 Enhanced Link Selection uses standard peer-liveness checks and interface-level redundancy for eligible gateways, including supported third-party interoperability. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A high-throughput perimeter needs to expand beyond a single Security Gateway and an architect evaluates ElasticXL against a conventional two-node cluster. In that distinct situation, the relevant principle would be: ElasticXL provides a supported scalable cluster of security appliances with coordinated traffic handling; platform compatibility and membership limits apply. Its technical reason is: ElasticXL provides a supported scalable cluster of security appliances with coordinated traffic handling; platform compatibility and membership limits apply. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required principle is: R82 Enhanced Link Selection uses standard peer-liveness checks and interface-level redundancy for eligible gateways, including supported third-party interoperability. The offered alternative does not meet this case’s requirement or supply its validation.

This option applies to another R82 operational problem: A security architect moves a primary management domain to another appliance but has no verified database export or documented migration tool version. In that distinct situation, the relevant principle would be: Management database migration requires a supported export/import process and careful preservation of security state rather than naive file copying. Its technical reason is: Management database migration requires a supported export/import process and careful preservation of security state rather than naive file copying. Here, however, the question concerns: Two active ISP links are configured for a VPN community, but the team expects individual packets to alternate between interfaces instead of connections. The specific required principle is: R82 Enhanced Link Selection uses standard peer-liveness checks and interface-level redundancy for eligible gateways, including supported third-party interoperability. The offered alternative does not meet this case’s requirement or supply its validation.

This action belongs to a DIFFERENT workstream that the question did not request: A security estate contains standalone and distributed deployments, and the team must distinguish procedures before scheduling an R82 rollout. Its legitimate action would be: Review official R82 supported upgrade paths, target versions, platform prerequisites, available disk resources and rollback requirements before selecting the upgrade method. Underlying technical basis: R82 upgrade choice depends on supported source versions, hardware, partition capacity and management topology; successful package download is not validation. None of the 3 listed workstreams asks for that separate configuration. For the primary listed case, the necessary action is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover.

This action belongs to a DIFFERENT workstream that the question did not request: A SOC wants a disaster-recovery evidence package showing the policy revision before changeover, the newly active manager and later restored synchronization. Its legitimate action would be: Run a planned Management HA failover drill that compares policy and object revisions, verifies standby synchronization and validates restoration of normal administrative operations. Underlying technical basis: Management redundancy requires repeatable role and database validation through actual controlled failover scenarios rather than only host availability metrics. None of the 3 listed workstreams asks for that separate configuration. For the primary listed case, the necessary action is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover.

This action belongs to a DIFFERENT workstream that the question did not request: A branch security gateway must preserve outbound address concealment while maintaining controlled one-to-one reachability to a dedicated mail server. Its legitimate action would be: Select static one-to-one or hide many-to-one translation as appropriate, ensure any required proxy ARP or routing support, and test bidirectional versus outbound-only reachability. Underlying technical basis: Static and hide NAT have different mapping and connection-initiation semantics; service reachability depends on policy, routes and translated IP ownership. None of the 3 listed workstreams asks for that separate configuration. For the primary listed case, the necessary action is: Use R82 Enhanced Link Selection where the peer and platform support it, explicitly configure active and backup interfaces, priorities and DPD-based availability, then test per-connection failover.