CheckPoint Checkpoint Certifications 156-215.80 Questions & Answers

• Question 441:

  John is the administrator of a R80 Security Management server managing r R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole. To make John's changes available to other administrators, and to save the database before installing a policy, what must John do?

  A. Logout of the session

  B. File > Save

  C. Install database

  D. Publish the session

  Correct Answer: D

  Installing and Publishing

  It is important to understand the differences between publishing and installing.

  You must do this: After you did this:

  Publish Opened a session in SmartConsole and made changes.

  The Publish operation sends all SmartConsole modifications to other

  administrators, and makes the changes you made in a private session

  public.

  Install the database Modified network objects, such as servers, users, services, or IPS

  profiles, but not the Rule Base.

  Updates are installed on management servers and log servers.

  Install a policy Changed the Rule Base.

  The Security Management Server installs the updated policy and the

  entire database on Security Gateways (even if you did not modify any

  network objects).

  Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?

  topic=documents/R80/CP_R80_SecMGMT/119225

• Question 442:

  Vanessa is attempting to log into the Gaia Web Portal. She is able to login successfully. Then she tries the same username and password for SmartConsole but gets the message in the screenshot image below. She has checked that the IP address of the Server is correct and the username and password she used to login into Gaia is also correct.

  

  What is the most likely reason?

  A. Check Point R80 SmartConsole authentication is more secure than in previous versions and Vanessa requires a special authentication key for R80 SmartConsole. Check that the correct key details are used.

  B. Check Point Management software authentication details are not automatically the same as the Operating System authentication details. Check that she is using the correct details.

  C. SmartConsole Authentication is not allowed for Vanessa until a Super administrator has logged in first and cleared any other administrator sessions.

  D. Authentication failed because Vanessa's username is not allowed in the new Threat Prevention console update checks even though these checks passed with Gaia.

  Correct Answer: B

• Question 443:

  What is the most complete definition of the difference between the Install Policy button on the SmartConsole's tab, and the Install Policy within a specific policy?

  A. The Global one also saves and published the session before installation.

  B. The Global one can install multiple selected policies at the same time.

  C. The local one does not install the Anti-Malware policy along with the Network policy.

  D. The second one pre-select the installation for only the current policy and for the applicable gateways.

  Correct Answer: D

• Question 444:

  What are the two types of NAT supported by the Security Gateway?

  A. Destination and Hide

  B. Hide and Static

  C. Static and Source D. Source and Destination

  Correct Answer: B

  A Security Gateway can use these procedures to translate IP addresses in your network:

  1.

  Static NAT - Each internal IP address is translated to a different public IP address. The Firewall can allow external traffic to access internal resources.

  2.

  Hide NAT - The Firewall uses port numbers to translate all specified internal IP addresses to a single public IP address and hides the internal IP structure. Connections can only start from internal computers, external computers CANNOT access internal servers. The Firewall can translate up to 50,000 connections at the same time from external computers and servers.

  3.

  Hide NAT with Port Translation - Use one IP address and let external users access multiple application servers in a hidden network. The Firewall uses the requested service (or destination port) to send the traffic to the correct server. A typical configuration can use these ports: FTP server (port 21), SMTP server (port 25) and an HTTP server (port 80). It is necessary to create manual NAT rules to use Port Translation.

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/6724.htm

• Question 445:

  What are the advantages of a "shared policy" in R80?

  A. Allows the administrator to share a policy between all the users identified by the Security Gateway

  B. Allows the administrator to share a policy between all the administrators managing the Security Management Server

  C. Allows the administrator to share a policy so that it is available to use in another Policy Package

  D. Allows the administrator to install a policy on one Security Gateway and it gets installed on another managed Security Gateway

  Correct Answer: C

• Question 446:

  To view statistics on detected threats, which Threat Tool would an administrator use?

  A. Protections

  B. IPS Protections

  C. Profiles

  D. ThreatWiki

  Correct Answer: D

• Question 447:

  What is the purpose of a Clean-up Rule?

  A. Clean-up Rules do not server any purpose.

  B. Provide a metric for determining unnecessary rules.

  C. To drop any traffic that is not explicitly allowed.

  D. Used to better optimize a policy.

  Correct Answer: C

  These are basic access control rules we recommend for all Rule Bases:

  1.

  Stealth rule that prevents direct access to the Security Gateway.

  2.

  Cleanup rule that drops all traffic that is not allowed by the earlier rules.

  There is also an implied rule that drops all traffic, but you can use the Cleanup rule to log the traffic.

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/92703.htm

• Question 448:

  The Network Operations Center administrator needs access to Check Point Security devices mostly for troubleshooting purposes. You do not want to give her access to the expert mode, but she still should be able to run tcpdump. How can you achieve this requirement?

  A. Add tcpdump to CLISH using add command. Create a new access role. Add tcpdump to the role.

  Create new user with any UID and assign role to the user.

  B. Add tcpdump to CLISH using add command. Create a new access role. Add tcpdump to the role. Create new user with UID 0 and assign role to the user.

  C. Create a new access role. Add expert-mode access to the role. Create new user with UID 0 and assign role to the user.

  D. Create a new access role. Add expert-mode access to the role. Create new user with any UID and assign role to the user.

  Correct Answer: A

• Question 449:

  After the initial installation on Check Point appliance, you notice that the Management interface and default gateway are incorrect. Which commands could you use to set the IP to 192.168.80.200/24 and default gateway to 192.168.80.1.

  A. set interface Mgmt ipv4-address 192.168.80.200 mask-length 24 set static-route default nexthop gateway address 192.168.80.1 on save config

  B. add interface Mgmt ipv4-address 192.168.80.200 255.255.255.0 add static-route 0.0.0.0.0.0.0.0 gw 192.168.80.1 on save config

  C. set interface Mgmt ipv4-address 192.168.80.200 255.255.255.0 add static-route 0.0.0.0.0.0.0.0 gw 192.168.80.1 on save config

  D. add interface Mgmt ipv4-address 192.168.80.200 mask-length 24 add static-route default nexthop gateway address 192.168.80.1 on save config

  Correct Answer: A

• Question 450:

  What Check Point tool is used to automatically update Check Point products for the Gaia OS?

  A. Check Point INSPECT Engine

  B. Check Point Upgrade Service Engine

  C. Check Point Update Engine

  D. Check Point Upgrade Installation Service

  Correct Answer: B

  Reference: https://sc1.checkpoint.com/documents/R77/CP_R77_Gaia_Installation_and_Upgrade_Guide/ html_frameset.htm?topic=documents/R77/CP_R77_Gaia_Installation_and_Upgrade_Guide/129978