CheckPoint Checkpoint Certifications 156-215.81 Questions & Answers

• Question 201:

  Security Zones do no work with what type of defined rule?

  A. Application Control rule

  B. Manual NAT rule

  C. IPS bypass rule

  D. Firewall rule

  Correct Answer: B

  Security Zones are a feature of Application Control and Identity Awareness that allow you to define groups of network objects based on their level of trust. Security Zones do not work with Manual NAT rules, because Manual NAT rules are applied before the Application Control and Identity Awareness policy is enforced. References: Check Point R81 Security Management Administration Guide

• Question 202:

  Which method below is NOT one of the ways to communicate using the Management API's?

  A. Typing API commands using the "mgmt_cli" command

  B. Typing API commands from a dialog box inside the SmartConsole GUI application

  C. Typing API commands using Gaia's secure shell (clash)19+

  D. Sending API commands over an http connection using web-services

  Correct Answer: D

  The correct answer is D because sending API commands over an http connection using web-services is not one of the ways to communicate using the Management API's. The Management API's support HTTPS protocol only, not HTTP. The other methods are valid ways to communicate using the Management API's. References: Check Point Learning and Training Frequently Asked Questions (FAQs)

• Question 203:

  Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?

  A. AES-GCM-256

  B. AES-CBC-256

  C. AES-GCM-128

  Correct Answer: B

  The answer is B because AES-CBC-256 is not a supported encryption algorithm for IPsec Security Associations (Phase 2) in R81. The supported encryption algorithms are AES-GCM-128, AES-GCM-256, AES-CBC-128, 3DES, and NULL3 References: Check Point R81 VPN Administration Guide

• Question 204:

  What is the SOLR database for?

  A. Used for full text search and enables powerful matching capabilities

  B. Writes data to the database and full text search C. Serves GUI responsible to transfer request to the DLE server

  D. Enables powerful matching capabilities and writes data to the database

  Correct Answer: A

  The SOLR database is used for full text search and enables powerful matching capabilities . SOLR is an open source enterprise search platform that provides fast and scalable indexing and searching of data. It supports advanced features such as faceting, highlighting, spell checking, synonyms, etc. The SOLR database is used by Check Point products such as SmartLog and SmartEvent to store and query logs and events . The other options are incorrect. Option B is false, as SOLR does not write data to the database, but only reads data from it. Option C is false, as SOLR does not serve GUI, but only provides a RESTful API for queries. Option D is false, as SOLR does not enable powerful matching capabilities and write data to the database, but only enables powerful matching capabilities. References: SOLR - Check Point Software, [Apache Solr]

• Question 205:

  Which one of the following is a way that the objects can be manipulated using the new API integration in R80 Management?

  A. Microsoft Publisher

  B. JSON

  C. Microsoft Word

  D. RC4 Encryption

  Correct Answer: B

  The way that the objects can be manipulated using the new API integration in R80 Management is JSON. JSON (JavaScript Object Notation) is a lightweight data-interchange format that is easy for humans and machines to read and write. The R80 Management API uses JSON as the primary data format for requests and responses. Therefore, the correct answer is B. JSON.

• Question 206:

  What is User Check?

  A. Messaging tool user to verify a user's credentials

  B. Communication tool used to inform a user about a website or application they are trying to access

  C. Administrator tool used to monitor users on their network

  D. Communication tool used to notify an administrator when a new user is created

  Correct Answer: B

  UserCheck is a communication tool used to inform a user about a website or application they are trying to access. UserCheck allows administrators to define actions that require user interaction, such as asking for confirmation, informing about risks, or blocking access, p. 38. UserCheck is not a messaging tool, an administrator tool, or a notification tool. , [Check Point UserCheck Administration Guide R81]

• Question 207:

  When using Automatic Hide NAT, what is enabled by default?

  A. Source Port Address Translation (PAT)

  B. Static NAT

  C. Static Route

  D. HTTPS Inspection

  Correct Answer: A

  When using Automatic Hide NAT, Source Port Address Translation (PAT) is enabled by default. This means that the source IP address and port number are translated to a different IP address and port number. This allows multiple hosts to share a single IP address for outbound connections. References: Check Point R81 Firewall Administration Guide

• Question 208:

  You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway. How would you review the logs to see what is blocking this traffic?

  A. Open SmartLog and connect remotely to the wireless controller

  B. Open SmartEvent to see why they are being blocked

  C. Open SmartDashboard and review the logs tab

  D. From SmartConsole, go to the Log and Monitor and filter for the IP address of the tablet.

  Correct Answer: D

  From SmartConsole, go to the Log and Monitor and filter for the IP address of the tablet is the correct answer. This is because the Log and Monitor view in SmartConsole allows you to view and analyze logs and events from various sources, such as Security Gateways, Security Management Servers, and SmartEvent Servers. You can use filters to search for specific logs and events based on different criteria, such as source IP, destination IP, action, time, etc. References: [Logging and Monitoring Administration Guide R80.20]

• Question 209:

  Which of the following methods can be used to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server?

  A. Save Policy

  B. Install Database

  C. Save session

  D. Install Policy

  Correct Answer: A

  The method to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server is Save Policy. Saving a policy updates the trusted log server with the latest policy and configuration changes. References: Check Point R81 Logging and Monitoring Administration Guide

• Question 210:

  Fill in the blank When LDAP is integrated with Check Point Security Management it is then referred to as_____

  A. User Center

  B. User Administration

  C. User Directory

  D. UserCheck

  Correct Answer: C

  When LDAP is integrated with Check Point Security Management, it is then referred to as User Directory. User Directory is a feature that allows administrators to manage users and user groups from an external LDAP server, such as Active Directory. References: Check Point R81 Identity Awareness Administration Guide, page 9.