CheckPoint Checkpoint Certifications 156-215.81.20 Questions & Answers

• Question 261:

  What are the three deployment considerations for a secure network?

  A. Distributed, Bridge Mode, and Remote

  B. Bridge Mode, Remote, and Standalone

  C. Remote, Standalone, and Distributed

  D. Standalone, Distributed, and Bridge Mode

  Correct Answer: A

• Question 262:

  Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

  A. All Connections (Clear or Encrypted)

  B. Accept all encrypted traffic

  C. Specific VPN Communities

  D. All Site-to-Site VPN Communities

  Correct Answer: B

  The first rule is the automatic rule for the Accept All Encrypted Traffic feature. The Firewalls for the Security Gateways in the BranchOffices and LondonOffices VPN communities allow all VPN traffic from hosts in clients in these communities. Traffic to the Security Gateways is dropped. This rule is installed on all Security Gateways in these communities.

  2.

  Site to site VPN - Connections between hosts in the VPN domains of all Site to Site VPN communities are allowed. These are the only protocols that are allowed: FTP, HTTP, HTTPS and SMTP.

  3.

  Remote access - Connections between hosts in the VPN domains of RemoteAccess VPN community are allowed. These are the only protocols that are allowed: HTTP, HTTPS, and IMAP.

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/92709.htm

• Question 263:

  When a Security Gateways sends its logs to an IP address other than its own, which deployment option is installed?

  A. Distributed

  B. Standalone

  C. Bridge

  Correct Answer: A

• Question 264:

  One of major features in R80 SmartConsole is concurrent administration. Which of the following is NOT possible considering that AdminA, AdminB, and AdminC are editing the same Security Policy?

  A. A lock icon shows that a rule or an object is locked and will be available.

  B. AdminA and AdminB are editing the same rule at the same time.

  C. A lock icon next to a rule informs that any Administrator is working on this particular rule.

  D. AdminA, AdminB and AdminC are editing three different rules at the same time.

  Correct Answer: C

  In SmartConsole, administrators work with sessions. A session is created each time an administrator logs into SmartConsole. Changes made in the session are saved automatically. These changes are private and available only to the administrator. To avoid configuration conflicts, other administrators see a lock icon on objects and rules that are being edited in other sessions

  Reference: http://downloads.checkpoint.com/dc/download.htm?ID=65846

• Question 265:

  When should you generate new licenses?

  A. Before installing contract files.

  B. After an RMA procedure when the MAC address or serial number of the appliance changes.

  C. When the existing license expires, license is upgraded or the IP-address where the license is tied changes.

  D. Only when the license is upgraded.

  Correct Answer: B

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk84802

• Question 266:

  Fill in the blank: When a policy package is installed, ________ are also distributed to the target installation Security Gateways.

  A. User and objects databases

  B. Network databases

  C. SmartConsole databases

  D. User databases

  Correct Answer: A

  A policy package is a collection of different types of policies. After installation, the Security Gateway enforces all the policies in the package. A policy package can have one or more of these policy types: Access Control - consists of these types of rules:

  -Firewall

  -NAT

  -Application Control and URL Filtering

  -Data Awareness

  QoS

  Desktop Security - the Firewall policy for endpoint computers that have the Endpoint Security VPN remote access client installed as a standalone client.

  Threat Prevention - consists of:

  -IPS - IPS protections continually updated by IPS Services

  -

  Anti-Bot - Detects bot-infected machines, prevents bot damage by blocking bot commands and Control (CandC) communications

  -

  Anti-Virus - Includes heuristic analysis, stops viruses, worms, and other malware at the gateway

  -

  Threat Emulation - detects zero-day and advanced polymorphic attacks by opening suspicious files in a sandbox

  The installation process:

  Runs a heuristic verification on rules to make sure they are consistent and that there are no redundant rules.

  If there are verification errors, the policy is not installed. If there are verification warnings (for example, if anti-spoofing is not enabled for a Security Gateway with multiple interfaces), the policy package is installed with a warning. Makes sure

  that each of the Security Gateways enforces at least one of the rules. If none of the rules are enforced, the default drop rule is enforced.

  Distributes the user database and object database to the selected installation targets.

  Reference:

  https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/119225

• Question 267:

  Which of the following is NOT a method used by Identity Awareness for acquiring identity?

  A. RADIUS

  B. Active Directory Query

  C. Remote Access

  D. Certificates

  Correct Answer: D

  Reference: https://www.checkpoint.com/products/identity-awareness-software-blade/

• Question 268:

  Which Check Point software blade provides Application Security and identity control?

  A. Identity Awareness

  B. Data Loss Prevention

  C. URL Filtering

  D. Application Control

  Correct Answer: D

  Check Point Application Control provides the industry's strongest application security and identity control to organizations of all sizes.

  Reference: https://www.checkpoint.com/products/application-control-software-blade/

• Question 269:

  How are the backups stored in Check Point appliances?

  A. Saved as*.tar under /var/log/CPbackup/backups

  B. Saved as*tgz under /var/CPbackup

  C. Saved as*tar under /var/CPbackup

  D. Saved as*tgz under /var/log/CPbackup/backups

  Correct Answer: B

  Backup configurations are stored in: /var/CPbackup/backups/

  Reference: https://sc1.checkpoint.com/documents/R77/CP_R77_Gaia_Installation_and_Upgrade_Guide/html_frameset.htm?topic=documents/R77/CP_R77_Gaia_Installation_and_Upgrade_Guide/107104

• Question 270:

  You are going to perform a major upgrade. Which back up solution should you use to ensure your database can be restored on that device?

  A. backup

  B. logswitch

  C. Database Revision

  D. snapshot

  Correct Answer: D

  The snapshot creates a binary image of the entire root (lv_current) disk partition. This includes Check Point products, configuration, and operating system. Starting in R77.10, exporting an image from one machine and importing that image on

  another machine of the same type is supported.

  The log partition is not included in the snapshot. Therefore, any locally stored FireWall logs will not be saved.

  Reference:

  https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk108902