CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 131:

  Which type of attack can a firewall NOT prevent?

  A. Network Bandwidth Saturation
  B. Buffer Overflow
  C. SYN Flood
  D. SQL Injection
  A. Network Bandwidth Saturation

  ---

  Explanation/Reference:

  A firewall can NOT prevent a network bandwidth saturation attack, which is a type of denial-of-service (DoS) attack that aims to consume all the available bandwidth of a target network or device, p. 9. A firewall can prevent other types of attacks, such as buffer overflow, SYN flood, and SQL injection, by inspecting packets and applying security rules, p. 11-12.

  , 156-315.81 Checkpoint Exam Info and Free Practice Test

• Question 132:

  Tom has connected to the Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made?

  A. Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes.
  B. Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.
  C. Tom's changes will be lost since he lost connectivity and he will have to start again.
  D. Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work.
  D. Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work.

  ---

  Explanation/Reference:

  Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work. This is because SmartConsole uses a session mechanism that allows users to work offline and save their changes locally until they are ready to publish them to the Management. If Tom loses connectivity, he can resume his session when he reconnects and continue working on his Rule Base changes. He does not need to reboot his SmartConsole computer, clear the cache, or restore changes. His changes will not be lost since he lost connectivity. References: Check Point R81 Security Management Administration Guide, | Udemy

• Question 133:

  What needs to be configured if the NAT property `Translate destination on client side' is not enabled in Global properties?

  A. A host route to route to the destination IP
  B. Use the file local.arp to add the ARP entries for NAT to work
  C. Nothing, the Gateway takes care of all details necessary
  D. Enabling `Allow bi-directional NAT' for NAT to work correctly
  C. Nothing, the Gateway takes care of all details necessary

  ---

  Explanation/Reference:

  If the NAT property `Translate destination on client side' is not enabled in Global properties, nothing needs to be configured on the client side, because the Gateway takes care of all details necessary. The Gateway translates the destination IP address before sending the packet to the client, so the client does not need to know about the NAT rule or add any host route or ARP entry. References: Check Point Security Engineering Study Guide, p. 136-137

• Question 134:

  Which of the following is NOT supported by Bridge Mode Check Point Security Gateway

  A. Antivirus
  B. Data Loss Prevention
  C. NAT
  D. Application Control
  C. NAT

  ---

  Explanation/Reference:

  Bridge Mode Check Point Security Gateway does not support NAT. Bridge Mode is a deployment option that allows the Security Gateway to inspect traffic without being a routing hop. In Bridge Mode, the Security Gateway does not have an IP address and cannot perform NAT. Therefore, the correct answer is C. NAT.

• Question 135:

  Which of the following Windows Security Events will NOT map a username to an IP address in Identity Awareness?

  A. Kerberos Ticket Renewed
  B. Kerberos Ticket Requested
  C. Account Logon
  D. Kerberos Ticket Timed Out
  D. Kerberos Ticket Timed Out

  ---

  Explanation/Reference:

  The Windows Security Event that will NOT map a username to an IP address in Identity Awareness is Kerberos Ticket Timed Out. This event occurs when a Kerberos ticket expires and is not renewed, which means that the user is no longer

  active on the network. Identity Awareness does not use this event to map a username to an IP address, as it does not indicate a valid user session. The other events are used by Identity Awareness to map a username to an IP address, as

  they indicate a successful user authentication or activity on the network.

  References: [Kerberos Ticket Expiration and Renewal], [Identity Awareness AD Query]

• Question 136:

  When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

  A. None, Security Management Server would be installed by itself.
  B. SmartConsole
  C. SecureClient
  D. SmartEvent
  A. None, Security Management Server would be installed by itself.

  ---

  Explanation/Reference:

  When doing a Stand-Alone Installation, you would install the Security Management Server with none of the other Check Point architecture components. A Stand- Alone Installation is a type of installation that combines the Security Management Server and the Security Gateway on one computer or appliance, p. 14. SmartConsole, SecureClient, and SmartEvent are not Check Point architecture components, but software applications that can be installed separately.

• Question 137:

  Fill in the blanks: The Application Layer Firewalls inspect traffic through the ______ layer(s) of the TCP/IP model and up to and including the ______ layer.

  A. Upper; Application
  B. First two; Internet
  C. Lower; Application
  D. First two; Transport
  C. Lower; Application

  ---

  Explanation/Reference:

  The Application Layer Firewalls inspect traffic through the Lower layer(s) of the TCP/IP model and up to and including the Application layer. The lower layers are the Physical, Data Link, and Network layers, which deal with the transmission and routing of packets. The Application layer is the highest layer of the TCP/IP model, which provides services and protocols for specific applications such as HTTP, FTP, SMTP, etc. The Application Layer Firewalls can inspect the content and context of the traffic and enforce granular security policies based on various criteria such as user identity, application identity, content type, etc. References: [Check Point R81 Firewall Administration Guide]

• Question 138:

  Which firewall daemon is responsible for the FW CLI commands?

  A. fwd
  B. fwm
  C. cpm
  D. cpd
  A. fwd

  ---

  Explanation/Reference:

  The correct answer is A because the fwd daemon is responsible for the FW CLI commands. The fwm daemon handles the communication between the Security Management server and the GUI clients. The cpm daemon handles the communication between the Security Management server and SmartConsole. The cpd daemon monitors the status of critical processes on the Security Gateway. References: Check Point Firewall Processes and Daemons

• Question 139:

  Gaia has two default user accounts that cannot be deleted. What are those user accounts?

  A. Admin and Default
  B. Expert and Clish
  C. Control and Monitor
  D. Admin and Monitor
  D. Admin and Monitor

  ---

  Explanation/Reference:

  Gaia has two default user accounts that cannot be deleted. They are Admin and Monitor. Admin is the user account that has full administrative privileges and can access both WebUI and CLI. Monitor is the user account that has read-only privileges and can access only WebUI2. The other options are not default user accounts in Gaia.

• Question 140:

  Which default Gaia user has full read/write access?

  A. admin
  B. superuser
  C. monitor
  D. altuser
  A. admin

  ---

  Explanation/Reference:

  The default Gaia user that has full read/write access is admin The admin user is the superuser that can perform any administrative task on the Gaia system, such as configuring network settings, installing software updates, managing licenses, creating snapshots, and more. The admin user can also access the Gaia Portal, which is a web- based interface for managing Gaia settings and features. References: Check Point R81 Gaia Administration Guide