CheckPoint Checkpoint Certifications 156-215.80 Questions & Answers

• Question 121:

  What is NOT an advantage of Packet Filtering?

  A. Low Security and No Screening above Network Layer

  B. Application Independence

  C. High Performance

  D. Scalability

  Correct Answer: A

  Packet Filter Advantages and Disadvantages

  

  Reference: https://www.checkpoint.com/smb/help/utm1/8.2/7078.htm

• Question 122:

  In the Check Point three-tiered architecture, which of the following is NOT a function of the Security Management Server (Security Management Server)?

  A. Display policies and logs on the administrator's workstation.

  B. Verify and compile Security Policies.

  C. Processing and sending alerts such as SNMP traps and email notifications.

  D. Store firewall logs to hard drive storage.

  Correct Answer: A

• Question 123:

  Web Control Layer has been set up using the settings in the following dialogue:

  

  Consider the following policy and select the BEST answer.

  

  A. Traffic that does not match any rule in the subpolicy is dropped.

  B. All employees can access only Youtube and Vimeo.

  C. Access to Youtube and Vimeo is allowed only once a day.

  D. Anyone from internal network can access the internet, expect the traffic defined in drop rules 5.2, 5.5 and 5.6.

  Correct Answer: D

  Policy Layers and Sub-Policies R80 introduces the concept of layers and sub-policies, allowing you to segment your policy according to your network segments or business units/functions. In addition, you can also assign granular privileges by layer or sub-policy to distribute workload and tasks to the most qualified administrators

  1.

  With layers, the rule base is organized into a set of security rules. These set of rules or layers, are inspected in the order in which they are defined, allowing control over the rule base flow and the security functionalities that take precedence. If an "accept" action is performed across a layer, the inspection will continue to the next layer. For example, a compliance layer can be created to overlay across a cross-section of rules.

  2.

  Sub-policies are sets of rules that are created for a specific network segment, branch office or business unit, so if a rule is matched, inspection will continue through this subset of rules before it moves on to the next rule.

  3.

  Sub-policies and layers can be managed by specific administrators, according to their permissions profiles. This facilitates task delegation and workload distribution.

  Reference: https://community.checkpoint.com/docs/DOC-1065

• Question 124:

  When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times. No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?

  A. IKE Phase 1

  B. IPSEC Phase 2

  C. IPSEC Phase 1

  D. IKE Phase 2

  Correct Answer: A

• Question 125:

  Which command is used to add users to or from existing roles?

  A. Add rba user roles

  B. Add rba user

  C. Add user roles

  D. Add user

  Correct Answer: A

  Configuring Roles - CLI (rba) Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Gaia_WebAdmin/73101.htm

  

• Question 126:

  View the rule below. What does the lock-symbol in the left column mean? Select the BEST answer.

  

  A. The current administrator has read-only permissions to Threat Prevention Policy.

  B. Another user has locked the rule for editing.

  C. Configuration lock is present. Click the lock symbol to gain read-write access.

  D. The current administrator is logged in as read-only because someone else is editing the policy.

  Correct Answer: B

  Administrator Collaboration More than one administrator can connect to the Security Management Server at the same time. Every administrator has their own username, and works in a session that is independent of the other administrators. When an administrator logs in to the Security Management Server through SmartConsole, a new editing session starts. The changes that the administrator makes during the session are only available to that administrator. Other administrators see a lock icon on object and rules that are being edited.

  To make changes available to all administrators, and to unlock the objects and rules that are being edited, the administrator must publish the session. Reference: https://sc1.checkpoint.com/documents/R80/ CP_R80_SecMGMT/html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/124265

• Question 127:

  While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain?

  A. Security Gateways is not part of the Domain

  B. SmartConsole machine is not part of the domain

  C. SMS is not part of the domain

  D. Identity Awareness is not enabled on Global properties

  Correct Answer: B

  To enable Identity Awareness:

  1.

  Log in to SmartDashboard.

  2.

  From the Network Objects tree, expand the Check Point branch.

  3.

  Double-click the Security Gateway on which to enable Identity Awareness.

  4.

  In the Software Blades section, select Identity Awareness on the Network Security tab.

  The Identity Awareness Configuration wizard opens.

  5.

  Select one or more options. These options set the methods for acquiring identities of managed and

  unmanaged assets.

  AD Query - Lets the Security Gateway seamlessly identify Active Directory users and computers.

  Browser-Based Authentication - Sends users to a Web page to acquire identities from unidentified users. If

  Transparent Kerberos Authentication is configured, AD users may be identified transparently.

  Terminal Servers - Identify users in a Terminal Server environment (originating from one IP address).

  See Choosing Identity Sources.

  Note - When you enable Browser-Based Authentication on a Security Gateway that is on an IP Series

  appliance, make sure to set the Voyager management application port to a port other than 443 or 80.

  6.

  Click Next.

  The Integration With Active Directory window opens.

  When SmartDashboard is part of the domain, SmartDashboard suggests this domain automatically. If you

  select this domain, the system creates an LDAP Account Unit with all of the domain controllers in the

  organization's Active Directory.

  Reference: https://sc1.checkpoint.com/documents/R76/ CP_R76_IdentityAwareness_AdminGuide/62050.htm

• Question 128:

  What is the purpose of Captive Portal?

  A. It provides remote access to SmartConsole

  B. It manages user permission in SmartConsole

  C. It authenticates users, allowing them access to the Internet and corporate resources

  D. It authenticates users, allowing them access to the Gaia OS

  Correct Answer: C

  Captive Portal ?a simple method that authenticates users through a web interface before granting them

  access to Intranet resources. When users try to access a protected resource, they get a web page that

  must be filled out to continue.

  Reference : https://www.checkpoint.com/products/identity-awareness-software-blade/

• Question 129:

  Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?

  A. Anti-Virus

  B. IPS

  C. Anti-Spam

  D. Anti-bot

  Correct Answer: B

  The IPS Software Blade provides a complete Intrusion Prevention System security solution, providing comprehensive network protection against malicious and unwanted network traffic, including:

  1.

  Malware attacks

  2.

  Dos and DDoS attacks

  3.

  Application and server vulnerabilities

  4.

  Insider threats

  5.

  Unwanted application traffic, including IM and P2P

  Reference: https://www.checkpoint.com/products/ips-software-blade/

• Question 130:

  Fill in the blank: The R80 utility fw monitor is used to troubleshoot _____________

  A. User data base corruption

  B. LDAP conflicts

  C. Traffic issues

  D. Phase two key negotiation

  Correct Answer: C

  Check Point's FW Monitor is a powerful built-in tool for capturing network traffic at the packet level. The FW Monitor utility captures network packets at multiple capture points along the FireWall inspection chains. These captured packets can be inspected later using the WireShark

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal? eventSubmit_doGoviewsolutiondetails=andsolutionid=sk30583