CheckPoint 156-215.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81.20 Online Questions & Answers

• Question 81:

  An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets

  are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install). Your partner site indicates they are successfully receiving the GRE

  encapsulated keep-alive packets on the 1-minute interval. If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.

  Which of the following is the BEST explanation for this behavior?

  A. The setting Log does not capture this level of detail for GRE. Set the rule tracking action to Audit since certain types of traffic can only be tracked this way.
  B. The log unification process is using a LUUID (Log Unification Unique Identification) that has become corrupt. Because it is encrypted, the R77 Security Gateway cannot distinguish between GRE sessions. This is a known issue with GRE. Use IPSEC instead of the non-standard GRE protocol for encapsulation.
  C. The Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracker. GRE traffic has a 10 minute session timeout, thus each keep-alive packet is considered part of the original logged connection at the beginning of the day.
  D. The Log Server is failing to log GRE traffic properly because it is VPN traffic. Disable all VPN configuration to the partner site to enable proper logging.
  C. The Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracker. GRE traffic has a 10 minute session timeout, thus each keep-alive packet is considered part of the original logged connection at the beginning of the day.

• Question 82:

  Which firewall daemon is responsible for the FW CLI commands?

  A. fwd
  B. fwm
  C. cpm
  D. cpd
  A. fwd

• Question 83:

  Which of the following is NOT a set of Regulatory Requirements related to Information Security?

  A. ISO 37001
  B. Sarbanes Oxley (SOX)
  C. HIPPA
  D. PCI
  A. ISO 37001

  ---

  Explanation/Reference:

  ISO 37001 - Anti-bribery management systems Reference: http://www.iso.org/iso/home/standards/management-standards/iso37001.htm

• Question 84:

  Your bank's distributed R77 installation has Security Gateways up for renewal. Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?

  A. SmartView Tracker
  B. SmartPortal
  C. SmartUpdate
  D. SmartDashboard
  C. SmartUpdate

• Question 85:

  Which of the following is NOT an option for internal network definition of Anti-spoofing?

  A. Specific ?derived from a selected object
  B. Route-based ?derived from gateway routing table
  C. Network defined by the interface IP and Net Mask
  D. Not-defined
  B. Route-based ?derived from gateway routing table

• Question 86:

  Which back up method uses the command line to create an image of the OS?

  A. System backup
  B. Save Configuration
  C. Migrate
  D. snapshot
  D. snapshot

• Question 87:

  Which encryption algorithm is the least secured?

  A. 3DES
  B. AES-128
  C. DES
  D. AES-256
  C. DES

• Question 88:

  What are the steps to configure the HTTPS Inspection Policy?

  A. Go to ManageandSettings > Blades > HTTPS Inspection > Configure in SmartDashboard
  B. Go to Applicationandurl filtering blade > Advanced > Https Inspection > Policy
  C. Go to ManageandSettings > Blades > HTTPS Inspection > Policy
  D. Go to Applicationandurl filtering blade > Https Inspection > Policy
  C. Go to ManageandSettings > Blades > HTTPS Inspection > Policy

• Question 89:

  Which statement is TRUE of anti-spoofing?

  A. Anti-spoofing is not needed when IPS software blade is enabled
  B. It is more secure to create anti-spoofing groups manually
  C. It is BEST Practice to have anti-spoofing groups in sync with the routing table
  D. With dynamic routing enabled, anti-spoofing groups are updated automatically whenever there is a routing change
  C. It is BEST Practice to have anti-spoofing groups in sync with the routing table

• Question 90:

  Review the rules. Assume domain UDP is enabled in the implied rules.

  

  What happens when a user from the internal network tries to browse to the internet using HTTP? The user:

  A. can connect to the Internet successfully after being authenticated.
  B. is prompted three times before connecting to the Internet successfully.
  C. can go to the Internet after Telnetting to the client authentication daemon port 259.
  D. can go to the Internet, without being prompted for authentication.
  D. can go to the Internet, without being prompted for authentication.