CheckPoint 156-215.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81.20 Online Questions & Answers

• Question 121:

  Which product correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices?

  A. SmartView Monitor
  B. SmartEvent
  C. SmartUpdate
  D. SmartDashboard
  B. SmartEvent

  ---

  Explanation/Reference:

  SmartEvent correlates logs from all Check Point enforcement points, including end-points, to identify suspicious activity from the clutter. Rapid data analysis and custom event logs immediately alert administrators to anomalous behavior such as someone attempting to use the same credential in multiple geographies simultaneously.

  Reference: https://www.checkpoint.com/products/smartevent/

• Question 122:

  What type of NAT is a one-to-one relationship where each host is translated to a unique address?

  A. Source
  B. Destination
  C. Hide
  D. Static
  D. Static

• Question 123:

  In SmartConsole, on which tab are Permissions and Administrators defined?

  A. MANAGE and SETTINGS
  B. SECURITY POLICIES
  C. GATEWAYS and SERVERS
  D. LOGS and MONITOR
  A. MANAGE and SETTINGS

• Question 124:

  How many layers make up the TCP/IP model?

  A. 2
  B. 7
  C. 6
  D. 4
  D. 4

• Question 125:

  You want to set up a VPN tunnel to an external gateway. You had to make sure that the IKE P2 SA will only be established between two subnets and not all subnets defined in the default VPN domain of your gateway.

  A. In the SmartConsole create a dedicated VPN Community for both Gateways. On the Management add the following line to the $FWDIR/conf/user.def.FW1 file -> subnet_for_range_and_peer = { };
  B. In the SmartConsole create a dedicated VPN Community for both Gateways. Selecting the local gateway in the Community you can set the VPN Domain to ‘User defined’ and put in the local network.
  C. In the SmartConsole create a dedicated VPN Community for both Gateways. On the Gateway add the following line to the $FWDIR/conf/user.def.FW1 file -> subnet_for_range_and_peer = { };
  D. In the SmartConsole create a dedicated VPN Community for both Gateways. Go to Security Policies / Access Control and create an in-line layer rule with source and destination containing the two networks used for the IKE P2 SA. Put the name of the Community in the VPN column.
  B. In the SmartConsole create a dedicated VPN Community for both Gateways. Selecting the local gateway in the Community you can set the VPN Domain to ‘User defined’ and put in the local network.

• Question 126:

  Where can administrator edit a list of trusted SmartConsole clients in R80?

  A. cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server.
  B. Only using SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients.
  C. In cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole: Manage and Settings>Permissions and Administrators>Advanced>Trusted Clients.
  D. WebUI client logged to Security Management Server, SmartDashboard: Manage and Settings>Permissions and Administrators>Advanced>Trusted Clients, via cpconfig on a Security Gateway.
  C. In cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole: Manage and Settings>Permissions and Administrators>Advanced>Trusted Clients.

• Question 127:

  Fill in the blanks: The Application Layer Firewalls inspect traffic through the ________ layer(s) of the TCP/IP model and up to and including the ________ layer.

  A. Lower; Application
  B. First two; Internet
  C. First two; Transport
  D. Upper; Application
  A. Lower; Application

• Question 128:

  Which of the following is NOT a component of a Distinguished Name?

  A. Organization Unit
  B. Country
  C. Common name
  D. User container
  D. User container

  ---

  Explanation/Reference:

  Distinguished Name Components CN=common name, OU=organizational unit, O=organization, L=locality, ST=state or province, C=country name Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_SecMan_WebAdmin/html_frameset.htm?topic=documents/R76/CP_R76_SecMan_WebAdmin/71950

• Question 129:

  Sally has a Hot Fix Accumulator (HFA) she wants to install on her Security Gateway which operates with GAiA, but she cannot SCP the HFA to the system. She can SSH into the Security Gateway, but she has never been able to SCP files to it. What would be the most likely reason she cannot do so?

  A. She needs to edit /etc/SSHd/SSHd_config and add the Standard Mode account.
  B. She needs to run sysconfig and restart the SSH process.
  C. She needs to edit /etc/scpusers and add the Standard Mode account.
  D. She needs to run cpconfig to enable the ability to SCP files.
  C. She needs to edit /etc/scpusers and add the Standard Mode account.

• Question 130:

  On the following graphic, you will find layers of policies.

  

  What is a precedence of traffic inspection for the defined polices?

  A. A packet arrives at the gateway, it is checked against the rules in the networks policy layer and then if implicit Drop Rule drops the packet, it comes next to IPS layer and then after accepting the packet it passes to Threat Prevention layer.
  B. A packet arrives at the gateway, it is checked against the rules in the networks policy layer and then if there is any rule which accepts the packet, it comes next to IPS layer and then after accepting the packet it passes to Threat Prevention layer
  C. A packet arrives at the gateway, it is checked against the rules in the networks policy layer and then if there is any rule which accepts the packet, it comes next to Threat Prevention layer and then after accepting the packet it passes to IPS layer.
  D. A packet arrives at the gateway, it is checked against the rules in IPS policy layer and then it comes next to the Network policy layer and then after accepting the packet it passes to Threat Prevention layer.
  B. A packet arrives at the gateway, it is checked against the rules in the networks policy layer and then if there is any rule which accepts the packet, it comes next to IPS layer and then after accepting the packet it passes to Threat Prevention layer

  ---

  Explanation/Reference:

  To simplify Policy management, R80 organizes the policy into Policy Layers. A layer is a set of rules, or a Rule Base.

  For example, when you upgrade to R80 from earlier versions:

  Gateways that have the Firewall and the Application Control Software Blades enabled will have their Access Control Policy split into two ordered layers: Network and Applications.

  When the gateway matches a rule in a layer, it starts to evaluate the rules in the next layer.

  Gateways that have the IPS and Threat Emulation Software Blades enabled will have their Threat Prevention policies split into two parallel layers: IPS and Threat Prevention.

  All layers are evaluated in parallel

  Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/126197