Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

In Threat Prevention, you can create new or clone profiles but you CANNOT change the out-of-the-box profiles of:

Which of the following authentication methods ARE NOT used for Mobile Access?

Which method below is NOT one of the ways to communicate using the Management API's?

When a packet arrives at the gateway, the gateway checks it against the rules in the hop Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet.
Which of the following statements about the order of rule enforcement is true?