CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 151:

  What are the two types of NAT supported by the Security Gateway?

  A. Destination and Hide
  B. Hide and Static
  C. Static and Source
  D. Source and Destination
  B. Hide and Static

  ---

  Explanation/Reference:

  The two types of NAT supported by the Security Gateway are hide NAT and static NAT. Hide NAT translates many source IP addresses into one IP address, usually the external interface of the gateway. Static NAT translates one source IP address into another IP address, usually a public IP address. The other options are not valid types of NAT. References: Network Address Translation (NAT),

• Question 152:

  Which of the following is NOT a valid deployment option for R80?

  A. All-in-one (stand-alone)
  B. CloudGuard
  C. Distributed
  D. Bridge Mode
  B. CloudGuard

  ---

  Explanation/Reference:

  CloudGuard is not a valid deployment option for R80. CloudGuard is a product name for Check Point's cloud security solutions, not a deployment mode. The valid deployment options for R80 are all-in-one (stand-alone), distributed, and bridge mode. In an all-in-one deployment, the Security Management Server and Security Gateway are installed on the same machine. In a distributed deployment, the Security Management Server and Security Gateway are installed on separate machines. In a bridge mode deployment, the Security Gateway acts as a transparent bridge between two network segments and does not have an IP address of its own

  References: CloudGuard, [Part 4 - Installing Security Gateway], [Deployment Options]

• Question 153:

  What is the most complete definition of the difference between the Install Policy button on the SmartConsole's tab, and the Install Policy within a specific policy?

  A. The Global one also saves and published the session before installation.
  B. The Global one can install multiple selected policies at the same time.
  C. The local one does not install the Anti-Malware policy along with the Network policy.
  D. The second one pre-select the installation for only the current policy and for the applicable gateways.
  D. The second one pre-select the installation for only the current policy and for the applicable gateways.

  ---

  Explanation/Reference:

  The difference between the Install Policy button on the SmartConsole's tab and the Install Policy within a specific policy is that the former installs all the policies that are selected in the Install Policy window, while the latter pre-selects the installation for only the current policy and for the applicable gateways . The other options are not accurate differences. References: Installing Policies, []

• Question 154:

  What are the software components used by Autonomous Threat Prevention Profiles in R8I.20 and higher?

  A. Sandbox, ThreatCloud, Zero Phishing, Sanitization, CandC Protection, JPS, File and URL Reputation
  B. IPS, Threat Emulation and Threat Extraction
  C. Sandbox, ThreatCloud, Sanitization, CandC Protection, IPS
  D. IPS, Anti-Bot, Anti-Virus, SandBlast and Macro Extraction
  D. IPS, Anti-Bot, Anti-Virus, SandBlast and Macro Extraction

  ---

  Explanation/Reference:

  This answer is correct because these are the software components that are used by the pre-defined Autonomous Threat Prevention Profiles in R81.20 and higher. These profiles provide zero-maintenance protection from zero-day threats and continuously and autonomously ensure that your protection is up-to-date with the latest cyber threats and prevention technologies. The other answers are not correct because they either include software components that are not part of the Autonomous Threat Prevention Profiles, such as Sandbox, ThreatCloud, Zero Phishing, Sanitization, CandC Protection, JPS, File and URL Reputation, or they omit some of the software components that are part of the Autonomous Threat Prevention Profiles, such as Anti-Bot, Anti-Virus, and Macro Extraction.

  Autonomous Threat Prevention Management - Check Point Software Check Point Quantum R81.20 (Titan) Release Threat Prevention R81.20 Best Practices - Check Point Software Check Point R81

• Question 155:

  Using ClusterXL, what statement is true about the Sticky Decision Function?

  A. Can only be changed for Load Sharing implementations
  B. All connections are processed and synchronized by the pivot
  C. Is configured using cpconfig
  D. Is only relevant when using SecureXL
  A. Can only be changed for Load Sharing implementations

  ---

  Explanation/Reference:

  The Sticky Decision Function (SDF) can only be changed for Load Sharing implementations, not for High Availability implementations. References: Check Point ClusterXL R81 Administration Guide

• Question 156:

  How Capsule Connect and Capsule Workspace differ?

  A. Capsule Connect provides a Layer3 VPN. Capsule Workspace provides a Desktop with usable applications
  B. Capsule Workspace can provide access to any application
  C. Capsule Connect provides Business data isolation
  D. Capsule Connect does not require an installed application at client
  A. Capsule Connect provides a Layer3 VPN. Capsule Workspace provides a Desktop with usable applications

  ---

  Explanation/Reference:

  Capsule Connect provides a Layer 3 VPN that allows users to access corporate resources securely from their mobile devices. Capsule Workspace provides a secure container on the mobile device that isolates business data and applications from personal data and applications. Capsule Workspace also provides a desktop with usable applications such as email, calendar, contacts, documents, and web applications. References: Check Point Capsule Connect, Check Point Capsule Workspace

• Question 157:

  If an administrator wants to restrict access to a network resource only allowing certain users to access it, and only when they are on a specific network what is the best way to accomplish this?

  A. Create an inline layer where the destination is the target network resource Define sub- rules allowing only specific sources to access the target resource
  B. Use a "New Legacy User at Location", specifying the LDAP user group that the users belong to, at the desired location
  C. Create a rule allowing only specific source IP addresses access to the target network resource.
  D. Create an Access Role object, with specific users or user groups specified, and specific networks defined Use this access role as the "Source" of an Access Control rule
  D. Create an Access Role object, with specific users or user groups specified, and specific networks defined Use this access role as the "Source" of an Access Control rule

  ---

  Explanation/Reference:

  The best way to restrict access to a network resource only allowing certain users to access it, and only when they are on a specific network, is to create an Access Role object, with specific users or user groups specified, and specific networks defined. Then, use this access role as the "Source" of an Access Control rule. This allows for granular control over network traffic based on user identity and location.

  References: Check Point R81 Security Gateway Administration Guide, page 13.

• Question 158:

  You want to set up a VPN tunnel to a external gateway. You had to make sure that the IKE P2 SA will only be established between two subnets and not all subnets defined in the default VPN domain of your gateway.

  A. In the SmartConsole create a dedicated VPN Community for both Gateways. On the Management add the following line to the $FWDIR/conf/user.def.FWI file subnet_for_range_and_peer = { );
  B. In the SmartConsole create a dedicated VPN Community for both Gateways. Selecting the local gateway in the Community you can set the VPN Domain to 'User defined' and put in the local network.
  C. In the SmartConsole create a dedicated VPN Community for both Gateways. On the Gateway add the following line to the $FWDlR/cont/user.def.FW1 file subnet_for_range_and_peer = { };
  D. In the SmartConsole create a dedicated VPN Community for both Gateways. Go to Security Policies / Access Control and create an in-line layer rule with source and destination containing the two networks used for the IKE P2 SA. Put the name of the Community in the VPN column.
  B. In the SmartConsole create a dedicated VPN Community for both Gateways. Selecting the local gateway in the Community you can set the VPN Domain to 'User defined' and put in the local network.

  ---

  Explanation/Reference:

  This answer is correct because this is the recommended way to configure a VPN tunnel between two subnets and not all subnets defined in the default VPN domain of your gateway. By creating a dedicated VPN Community, you can specify the VPN peers and the encryption settings for the VPN tunnel. By selecting the local gateway in the Community, you can set the VPN Domain to `User defined' and put in the local network that you want to include in the VPN tunnel. This way, you can limit the VPN traffic to the subnets that you want and avoid unnecessary encryption and decryption of other traffic. The other answers are not correct because they are either outdated or incorrect ways to configure a VPN tunnel between two subnets. Answer A and C are outdated methods that involve editing the user.def file, which is not recommended and can cause problems with the VPN configuration. Answer D is incorrect because creating an in-line layer rule with source and destination containing the two networks used for the IKE SA will not affect the VPN tunnel establishment, but only the access control policy. The VPN column in the rule is used to specify the VPN direction, not the VPN Community name.

  How to configure a Site-to-Site VPN with a universal tunnel Site to Site VPN R81 Administration Guide - Check Point Software How to configure a Site-to-Site VPN with a 3rd-party remote gateway Access Control Policy R81 Administration Guide - Check Point Software

• Question 159:

  Which of the following is NOT an identity source used for Identity Awareness?

  A. Remote Access
  B. UserCheck
  C. AD Query
  D. RADIUS
  B. UserCheck

  ---

  Explanation/Reference:

  UserCheck is not an identity source used for Identity Awareness. UserCheck is a feature that allows you to interact with users when they trigger Data Loss Prevention or Threat Prevention incidents. Identity Awareness uses different methods to acquire identities, such as AD Query, Identity Agent, Browser-Based Authentication, Terminal Servers, Captive Portal, and RADIUS3 . Therefore, the correct answer is B. UserCheck.

• Question 160:

  When configuring LDAP with User Directory integration, changes applied to a User Directory template are:

  A. Not reflected for any users unless the local user template is changed.
  B. Not reflected for any users who are using that template.
  C. Reflected for ail users who are using that template and if the local user template is changed as well.
  D. Reflected immediately for all users who are using that template.
  D. Reflected immediately for all users who are using that template.

  ---

  Explanation/Reference:

  LDAP (Lightweight Directory Access Protocol) is a protocol that allows accessing and maintaining distributed directory information services over a network. User Directory integration is a feature of Identity Awareness that allows Check Point products to use LDAP servers as identity sources. When configuring LDAP with User Directory integration, changes applied to a User Directory template are reflected immediately for all users who are using that template. A User Directory template defines the settings for connecting to an LDAP server and retrieving user information3. References: Check Point R81 Identity Awareness Administration Guide