CheckPoint 156-215.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81.20 Online Questions & Answers

• Question 401:

  From the Gaia web interface, which of the following operations CANNOT be performed on a Security Management Server?

  A. Verify a Security Policy
  B. Open a terminal shell
  C. Add a static route
  D. View Security Management GUI Clients
  B. Open a terminal shell

• Question 402:

  Which of the following is a valid deployment option?

  A. CloudSec deployment
  B. Disliked deployment
  C. Router only deployment
  D. Standalone deployment
  D. Standalone deployment

• Question 403:

  The SIC Status "Unknown" means

  A. There is connection between the gateway and Security Management Server but it is not trusted.
  B. The secure communication is established.
  C. There is no connection between the gateway and Security Management Server.
  D. The Security Management Server can contact the gateway, but cannot establish SIC.
  C. There is no connection between the gateway and Security Management Server.

  ---

  Explanation/Reference:

  SIC Status

  After the gateway receives the certificate issued by the ICA, the SIC status shows if the Security Management Server can communicate securely with this gateway:

  Communicating - The secure communication is established.

  Unknown - There is no connection between the gateway and Security Management Server.

  Not Communicating - The Security Management Server can contact the gateway, but cannot establish SIC. A message shows more information. Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/

  html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/125443

• Question 404:

  When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times. No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?

  A. IKE Phase 1
  B. IPSEC Phase 2
  C. IPSEC Phase 1
  D. IKE Phase 2
  A. IKE Phase 1

• Question 405:

  Which one of the following is the preferred licensing model? Select the Best answer.

  A. Local licensing because it ties the package license to the IP-address of the gateway and has no dependency of the Security Management Server.
  B. Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency of the gateway.
  C. Local licensing because it ties the package license to the MAC-address of the gateway management interface and has no Security Management Server dependency.
  D. Central licensing because it ties the package license to the MAC-address of the Security Management Server Mgmt-interface and has no dependency of the gateway.
  B. Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency of the gateway.

  ---

  Explanation/Reference:

  Central License

  A Central License is a license attached to the Security Management server IP address, rather than the gateway IP address. The benefits of a Central License are:

  1.

  Only one IP address is needed for all licenses.

  2.

  A license can be taken from one gateway and given to another.

  3.

  The new license remains valid when changing the gateway IP address. There is no need to create and install a new license. Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Installation_and_Upgrade_Guide-webAdmin/13128.htm#o13527

• Question 406:

  Which one of the following is TRUE?

  A. One policy can be either inline or ordered, but not both.
  B. Inline layer can be defined as a rule action.
  C. Ordered policy is a sub-policy within another policy.
  D. Pre-R80 Gateways do not support ordered layers.
  B. Inline layer can be defined as a rule action.

• Question 407:

  What are the two types of NAT supported by the Security Gateway?

  A. Destination and Hide
  B. Source and Destination
  C. Static and Source
  D. Hide and Static
  D. Hide and Static

• Question 408:

  What command from the CLI would be used to view current licensing?

  A. cplic print
  B. show license -s
  C. fw ctl tab -t license -s
  D. license view
  A. cplic print

• Question 409:

  What is required for a site-to-site VPN tunnel that does not use certificates?

  A. Unique Passwords
  B. Pre-Shared Secret
  C. SecureID
  D. RSA Token
  B. Pre-Shared Secret

• Question 410:

  Study the Rule base and Client Authentication Action properties screen.

  

  

  After being authenticated by the Security Gateways, a user starts a HTTP connection to a Web site. What happens when the user tries to FTP to another site using the command line? The:

  A. user is prompted for authentication by the Security Gateways again.
  B. FTP data connection is dropped after the user is authenticated successfully.
  C. user is prompted to authenticate from that FTP site only, and does not need to enter his username and password for Client Authentication
  D. FTP connection is dropped by Rule 2.
  C. user is prompted to authenticate from that FTP site only, and does not need to enter his username and password for Client Authentication