Explanation: if a user belong to several groups and the user authenticates successfully it means that he have matched his user & authentication restrictions and also the ones of the groups he belongs to. This is the way checkpoint authentication works, you have to pass your personal authentication restrictions, and the ones in your groups to authenticate successfully.
Incorrect Answers
B:This answer is wrong because you have to get a match in your user & group authentication restrictions to get a successful authentication. You must get a match in all of them.

Explanation: As it says in the question, the administrator wants granular control and that requires authentication in a user basis, he also wants logging from any place, so the best option is to use "User Authentication" because we can have a centralized user database that will provide successfully provide the mobility requirements exposed in the question.
Incorrect Answers
A:Session authentication does not provide the mobility requirements because the user will have to install the session authentication agent on every PC and that's not a transparent experience for him.
C:Client authentication does not provide a transparent experience to the user because he / she have to make a manual logon to the firewall with Telnet or HTTP.
D:This is not one of the 3 authentication methods supported by the NG suite.
E:This is not one of the 3 authentication methods supported by the NG suite.

Pending

Explanation: this is one of the best practices recommended by Checkpoint engineers, if you have a large number of entries in your rulebase for multiple remote firewalls you can have one rulebase for each remote one, so you can simplify your administration for each of them.
Incorrect Answers
A:This is not recommended because you could have hosts in one network sending packets through multiple firewalls modules, so you don't need to manipulate Network Range objects.
B:Checkpoint is trying to make their products as consolidated as possible, they are trying to put all the components in the same console, as is the case of the Policy Editor that includes "Object Tree", "Visual Policy Editor" and "Security Policy Editor", in the same console.
C:this is not an option because this rules are often necessary to comply with business requirements, they are best practices too.
E:is incorrect because Answer D is the only valid choice.