CheckPoint Checkpoint Certifications 156-215.81.20 Questions & Answers

• Question 581:

  Fill in the blank: The _________ software blade enables Application Security policies to allow, block, or limit website access based on user, group, and machine identities.

  A. Application Control

  B. Data Awareness

  C. URL Filtering

  D. Threat Emulation

  Correct Answer: A

• Question 582:

  At what point is the Internal Certificate Authority (ICA) created?

  A. Upon creation of a certificate

  B. During the primary Security Management Server installation process.

  C. When an administrator decides to create one.

  D. When an administrator initially logs into SmartConsole.

  Correct Answer: B

  Introduction to the ICA The ICA is a Certificate Authority which is an integral part of the Check Point product suite. It is fully compliant with X.509 standards for both certificates and CRLs. See the relevant X.509 and PKI documentation, as well as RFC 2459 standards for more information. You can read more about Check Point and PKI in the R76 VPN Administration Guide. The ICA is located on the Security Management server. It is created during the installation process, when the Security Management server is configured. Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_SecMan_WebAdmin/ html_frameset.htm?topic=documents/R76/CP_R76_SecMan_WebAdmin/13118

• Question 583:

  In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

  A. Pentagon

  B. Combined

  C. Meshed

  D. Star

  Correct Answer: D

  VPN communities are based on Star and Mesh topologies. In a Mesh community, there are VPN connections between each Security Gateway. In a Star community, satellites have a VPN connection with the center Security Gateway, but not to each other.

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/92709.htm

• Question 584:

  Fill in the blank: ________information is included in the "Full Log" tracking option, but is not included in the "Log" tracking option?

  A. file attributes

  B. application

  C. destination port

  D. data type

  Correct Answer: D

  Tracking Options

  Network Log - Generates a log with only basic Firewall information: Source, Destination, Source Port, Destination Port, and Protocol. Log - Equivalent to the Network Log option, but also includes the application name (for example, Dropbox),

  and application information (for example, the URL of the Website). This is the default Tracking option.

  Full Log - Equivalent to the log option, but also records data for each URL request made.

  -

  If suppression is not selected, it generates a complete log (as defined in pre-R80 management).

  -

  If suppression is selected, it generates an extended log (as defined in pre-R80 management).

  None - Do not generate a log.

  Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_LoggingAndMonitoring/html_frameset.htm?topic=documents/R80/CP_R80_LoggingAndMonitoring/131914

• Question 585:

  In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

  A. Security Policies

  B. Logs and Monitor

  C. Manage and Settings

  D. Gateway and Servers

  Correct Answer: C

• Question 586:

  Which type of Endpoint Identity Agent includes packet tagging and computer authentication?

  A. Full

  B. Light

  C. Custom

  D. Complete

  Correct Answer: A

  Endpoint Identity Agents ?dedicated client agents installed on users' computers that acquire and report identities to the Security Gateway.

• Question 587:

  Fill in the blanks: The Application Layer Firewalls inspect traffic through the ________ layer(s) of the TCP/IP model and up to and including the ________ layer.

  A. Lower; Application

  B. First two; Internet

  C. First two; Transport

  D. Upper; Application

  Correct Answer: A

• Question 588:

  There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational. When it re-joins the cluster, will it become active automatically?

  A. No, since "maintain current active cluster member" option on the cluster object properties is enabled by default

  B. No, since "maintain current active cluster member" option is enabled by default on the Global Properties

  C. Yes, since "Switch to higher priority cluster member" option on the cluster object properties is enabled by default

  D. Yes, since "Switch to higher priority cluster member" option is enabled by default on the Global Properties

  Correct Answer: A

  What Happens When a Security Gateway Recovers?

  In a Load Sharing configuration, when the failed Security Gateway in a cluster recovers, all connections are redistributed among all active members. High Availability and Load Sharing in ClusterXL ClusterXL Administration Guide R77

  Versions | 31 In a High Availability configuration, when the failed Security Gateway in a cluster recovers, the recovery method depends on the configured cluster setting. The options are:

  Maintain Current Active Security Gateway means that if one member passes on control to a lower priority member, control will be returned to the higher priority member only if the lower priority member fails. This mode is recommended if all

  members are equally capable of processing traffic, in order to minimize the number of failover events.

  Switch to Higher Priority Security Gateway means that if the lower priority member has control and the higher priority member is restored, then control will be returned to the higher priority member. This mode is recommended if one member is

  better equipped for handling connections, so it will be the default Security Gateway.

  Reference: http://dl3.checkpoint.com/paid/7e/7ef174cf00762ceaf228384ea20ea64a/CP_R77_ClusterXL_AdminGuide.pdf?HashKey=1479822138_31410b1f8360074be87fd8f1ab682464andxtn=.pdf

• Question 589:

  After the initial installation the First Time Configuration Wizard should be run. Select the BEST answer.

  A. First Time Configuration Wizard can be run from the Unified SmartConsole.

  B. First Time Configuration Wizard can be run from the command line or from the WebUI.

  C. First time Configuration Wizard can only be run from the WebUI.

  D. Connection to the internet is required before running the First Time Configuration wizard.

  Correct Answer: B

  Check Point Security Gateway and Check Point Security Management require running the First Time Configuration Wizard in order to be configured correctly. The First Time Configuration Wizard is available in Gaia Portal and also through

  CLI.

  To invoke the First Time Configuration Wizard through CLI, run the config_system command from the Expert shell.

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk111119

• Question 590:

  In order to modify Security Policies the administrator can use which of the following tools? Select the BEST answer.

  A. Command line of the Security Management Server or mgmt_cli.exe on any Windows computer.

  B. SmartConsole and WebUI on the Security Management Server.

  C. mgmt_cli or WebUI on Security Gateway and SmartConsole on the Security Management Server.

  D. SmartConsole or mgmt_cli on any computer where SmartConsole is installed.

  Correct Answer: D