CheckPoint Checkpoint Certifications 156-215.80 Questions & Answers

• Question 411:

  Which Check Point software blade provides Application Security and identity control?

  A. Identity Awareness

  B. Data Loss Prevention

  C. URL Filtering

  D. Application Control

  Correct Answer: D

  Check Point Application Control provides the industry's strongest application security and identity control to organizations of all sizes.

  Reference: https://www.checkpoint.com/products/application-control-software-blade/

• Question 412:

  One of major features in R80 SmartConsole is concurrent administration. Which of the following is NOT possible considering that AdminA, AdminB, and AdminC are editing the same Security Policy?

  A. A lock icon shows that a rule or an object is locked and will be available.

  B. AdminA and AdminB are editing the same rule at the same time.

  C. A lock icon next to a rule informs that any Administrator is working on this particular rule.

  D. AdminA, AdminB and AdminC are editing three different rules at the same time.

  Correct Answer: C

  In SmartConsole, administrators work with sessions. A session is created each time an administrator logs into SmartConsole. Changes made in the session are saved automatically. These changes are private and available only to the administrator. To avoid configuration conflicts, other administrators see a lock icon on objects and rules that are being edited in other sessions

  Reference: http://downloads.checkpoint.com/dc/download.htm?ID=65846

• Question 413:

  When should you generate new licenses?

  A. Before installing contract files.

  B. After an RMA procedure when the MAC address or serial number of the appliance changes.

  C. When the existing license expires, license is upgraded or the IP-address where the license is tied changes.

  D. Only when the license is upgraded.

  Correct Answer: B

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal? eventSubmit_doGoviewsolutiondetails=andsolutionid=sk84802

• Question 414:

  Fill in the blank: When a policy package is installed, ________ are also distributed to the target installation Security Gateways.

  A. User and objects databases

  B. Network databases

  C. SmartConsole databases

  D. User databases

  Correct Answer: A

  A policy package is a collection of different types of policies. After installation, the Security Gateway enforces all the policies in the package. A policy package can have one or more of these policy types: Access Control - consists of these types of rules:

  -Firewall

  -NAT

  -Application Control and URL Filtering

  -Data Awareness QoS Desktop Security - the Firewall policy for endpoint computers that have the Endpoint Security VPN remote access client installed as a standalone client. Threat Prevention - consists of:

  -IPS - IPS protections continually updated by IPS Services

  -

  Anti-Bot - Detects bot-infected machines, prevents bot damage by blocking bot commands and Control (CandC) communications

  -

  Anti-Virus - Includes heuristic analysis, stops viruses, worms, and other malware at the gateway

  -

  Threat Emulation - detects zero-day and advanced polymorphic attacks by opening suspicious files in a sandbox

  The installation process:

  Runs a heuristic verification on rules to make sure they are consistent and that there are no redundant

  rules.

  If there are verification errors, the policy is not installed. If there are verification warnings (for example, if

  anti-spoofing is not enabled for a Security Gateway with multiple interfaces), the policy package is installed

  with a warning. Makes sure that each of the Security Gateways enforces at least one of the rules. If none

  of the rules are enforced, the default drop rule is enforced.

  Distributes the user database and object database to the selected installation targets.

  Reference:

  https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/

  R80/CP_R80_SecMGMT/119225

• Question 415:

  When a Security Gateways sends its logs to an IP address other than its own, which deployment option is installed?

  A. Distributed

  B. Standalone

  C. Bridge

  Correct Answer: A

• Question 416:

  What are the three deployment considerations for a secure network?

  A. Distributed, Bridge Mode, and Remote

  B. Bridge Mode, Remote, and Standalone

  C. Remote, Standalone, and Distributed

  D. Standalone, Distributed, and Bridge Mode

  Correct Answer: A

• Question 417:

  Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

  A. All Connections (Clear or Encrypted)

  B. Accept all encrypted traffic

  C. Specific VPN Communities

  D. All Site-to-Site VPN Communities

  Correct Answer: B

  The first rule is the automatic rule for the Accept All Encrypted Traffic feature. The Firewalls for the Security Gateways in the BranchOffices and LondonOffices VPN communities allow all VPN traffic from hosts in clients in these communities. Traffic to the Security Gateways is dropped. This rule is installed on all Security Gateways in these communities.

  2.

  Site to site VPN - Connections between hosts in the VPN domains of all Site to Site VPN communities are allowed. These are the only protocols that are allowed: FTP, HTTP, HTTPS and SMTP.

  3.

  Remote access - Connections between hosts in the VPN domains of RemoteAccess VPN community are allowed. These are the only protocols that are allowed: HTTP, HTTPS, and IMAP.

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/92709.htm

• Question 418:

  Access roles allow the firewall administrator to configure network access according to: A. a combination of computer groups and network

  B. users and user groups

  C. all of above

  D. remote access clients

  Correct Answer: C

  To create an access role:

  1.

  Select Users and Administrators in the Objects Tree.

  2.

  Right-click Access Roles > New Access Role.

  The Access Role window opens.

  3.

  Enter a Name and Comment (optional) for the access role.

  4.

  In the Networks tab, select one of these:

  Any network

  Specific networks - Click the plus sign and select a network.

  Your selection is shown in the Networks node in the Role Preview pane.

  5.

  In the Users tab, select one of these:

  Any user

  All identified users - Includes users identified by a supported authentication method (internal users, AD

  users or LDAP users).

  Specific users - Click the plus sign.

  A window opens. You can search for Active Directory entries or select them from the list.

  6.

  In the Machines tab, select one of these:

  Any machine

  All identified machines - Includes machines identified by a supported authentication method (AD).

  Specific machines - Click the plus sign.

  You can search for AD entries or select them from the list.

  7.

  Optional: For computers that use Full Identity Agents, from the Machines tab select Enforce IP spoofing

  protection.

  8.

  Click OK.

  The access role is added to the Users and Administrators tree.

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/92705.htm

• Question 419:

  When configuring Spoof Tracking, which tracking actions can an administrator select to be done when spoofed packets are detected?

  A. Log, send snmp trap, email

  B. Drop packet, alert, none

  C. Log, alert, none

  D. Log, allow packets, email

  Correct Answer: C

  Explanation: Configure Spoof Tracking - select the tracking action that is done when spoofed packets are detected:

  1.

  Log - Create a log entry (default)

  2.

  Alert - Show an alert

  3.

  None - Do not log or alert

  Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/ R80/CP_R80_SecMGMT/126197

• Question 420:

  In Unified SmartConsole Gateways and Servers tab you can perform the following functions EXCEPT

  A. Upgrade the software version

  B. Open WebUI

  C. Open SSH

  D. Open service request with Check Point Technical Support

  Correct Answer: C