CheckPoint Checkpoint Certifications 156-215.81 Questions & Answers

• Question 211:

  Can multiple administrators connect to a Security Management Server at the same time?

  A. No, only one can be connected

  B. Yes, all administrators can modify a network object at the same time

  C. Yes, every administrator has their own username, and works in a session that is independent of other administrators

  D. Yes, but only one has the right to write

  Correct Answer: C

  Multiple administrators can connect to a Security Management Server at the same time, and each administrator has their own username and works in a session that is independent of other administrators. This allows concurrent administration and prevents conflicts between different administrators. The other options are incorrect. Only one administrator can be connected is false. All administrators can modify a network object at the same time is false, as only one administrator can lock and edit an object at a time. Only one has the right to write is false, as all administrators have write permissions unless they are restricted by roles or permissions. References: Security Management Server - Check Point Software

• Question 212:

  R80 is supported by which of the following operating systems:

  A. Windows only

  B. Gaia only

  C. Gaia, SecurePlatform, and Windows

  D. SecurePlatform only

  Correct Answer: B

  R80 is supported by Gaia only, which is Check Point's unified security operating system for all Check Point appliances, open servers, and virtualized gateways, p. 14. Windows and SecurePlatform are not supported by R80. , [Check Point Learning and Training Frequently Asked Questions (FAQs)]

• Question 213:

  Which of the following is the most secure means of authentication?

  A. Password

  B. Certificate

  C. Token

  D. Pre-shared secret

  Correct Answer: B

  Certificate is the most secure means of authentication among the given options. A certificate is a digital document that contains information about the identity of a user or a device, and is signed by a trusted authority. A certificate can be used to prove the identity of a user or a device without revealing any sensitive information, such as passwords or tokens. Password, token, and pre-shared secret are less secure means of authentication because they can be easily compromised, stolen, or guessed by attackers. References: Secure User Authentication Methods - freeCodeCamp.org, What is the Most Secure Authentication Method for Your Organization ...

• Question 214:

  Fill in the blank: The_____is used to obtain identification and security information about network users.

  A. User index

  B. UserCheck

  C. User Directory

  D. User server

  Correct Answer: C

  The User Directory is used to obtain identification and security information about network users. It can be integrated with external user databases such as LDAP, RADIUS, or TACACS+. References: Certified Security Administrator (CCSA) R81.20 Course Overview, page 9.

• Question 215:

  What is the purpose of a Clean-up Rule?

  A. Clean-up Rules do not server any purpose.

  B. Provide a metric for determining unnecessary rules.

  C. To drop any traffic that is not explicitly allowed.

  D. Used to better optimize a policy.

  Correct Answer: C

  A clean-up rule is a rule that is placed at the end of the security policy to drop any traffic that is not explicitly allowed by the previous rules. It is a best practice to have a clean-up rule to prevent unauthorized access and log the dropped packets for analysis. The other options are not the purpose of a clean-up rule. References: Clean-up Rule,

• Question 216:

  The "Hit count" feature allows tracking the number of connections that each rule matches. Will the Hit count feature work independently from logging and Track the hits even if the Track option is set to "None"?

  A. No, it will not work independently. Hit Count will be shown only for rules with Track options set as Log or alert

  B. Yes, it will work independently as long as "analyze all rules" tick box is enabled on the Security Gateway

  C. No, it will not work independently because hit count requires all rules to be logged

  D. Yes, it will work independently because when you enable Hit Count, the SMS collects the data from supported Security Gateways

  Correct Answer: D

  The Hit count feature will work independently from logging and track the hits even if the Track option is set to "None"1, p. 23. When you enable Hit Count, the Security Management Server collects the data from supported Security Gateways and displays the number of connections that each rule matches in SmartConsole3. , Check Point Security Management Administration Guide R81

• Question 217:

  Why is a Central License the preferred and recommended method of licensing?

  A. Central Licensing is actually not supported with Gaia.

  B. Central Licensing is the only option when deploying Gaia

  C. Central Licensing ties to the IP address of a gateway and can be changed to any gateway if needed.

  D. Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.

  Correct Answer: D

  Central License is the preferred and recommended method of licensing because it ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. Central License allows administrators to manage licenses for all Security Gateways from one central location. If the IP address of a gateway changes, the license remains valid as long as it is connected to the same management server. Central Licensing is supported with Gaia and is not the only option when deploying Gaia. Central Licensing does not tie to the IP address of a gateway and can not be changed to any gateway if needed.

  References:

  1: Rugged Appliances

  2: SmartUpdate

  3: Check Point Software Deployment Options : [Anti-Virus] : [Check Point Software Blades] : [Central License]

• Question 218:

  When enabling tracking on a rule, what is the default option?

  A. Accounting Log

  B. Extended Log

  C. Log

  D. Detailed Log

  Correct Answer: C

  When enabling tracking on a rule, the default option is Log. This option generates a log entry for each connection that matches the rule. The log entry contains information such as the source, destination, service, action, and time of the connection.References: [Logging and Monitoring R81], [Logging and Monitoring]

• Question 219:

  Which information is included in the "Extended Log" tracking option, but is not included in the "Log" tracking option?

  A. file attributes

  B. application information

  C. destination port

  D. data type information

  Correct Answer: B

  Application information is included in the "Extended Log" tracking option, but is not included in the "Log" tracking option4. The "Extended Log" option provides additional information about the application, such as name, category, risk, and technology. References: LOGGINGAND MONITORING R80

• Question 220:

  Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use which operating system?

  A. Centos Linux

  B. Gaia embedded

  C. Gaia

  D. Red Hat Enterprise Linux version 5

  Correct Answer: B

  Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use Gaia embedded as the operating system. Gaia embedded is a lightweight version of Gaia that is designed for small and medium businesses. Centos Linux, Gaia, and Red Hat Enterprise Linux version 5 are not the operating systems used by Rugged appliances.