CheckPoint Checkpoint Certifications 156-215.81 Questions & Answers

• Question 231:

  Which of the following is used to initially create trust between a Gateway and Security Management Server?

  A. Internal Certificate Authority

  B. Token

  C. One-time Password

  D. Certificate

  Correct Answer: C

  A one-time password is used to initially create trust between a Gateway and Security Management Server. The administrator generates a one-time password from SmartConsole and enters it on the gateway command line interface using the cpconfig command. This establishes a Secure Internal Communication (SIC) between the gateway and the server . The other options are not used for this purpose. References: [Configuring Secure Internal Communication (SIC)], []

• Question 232:

  Which policy type is used to enforce bandwidth and traffic control rules?

  A. Access Control

  B. Threat Emulation

  C. Threat Prevention

  D. QoS

  Correct Answer: D

  The policy type that is used to enforce bandwidth and traffic control rules is QoS. QoS stands for Quality of Service and is a software blade that allows administrators to prioritize network traffic according to various criteria such as source, destination, service, application, user, etc. QoS can also limit the bandwidth consumption of certain traffic types or guarantee a minimum bandwidth for critical applications. References: [Check Point R81 QoS Administration Guide]

• Question 233:

  Gaia has two default user accounts that cannot be deleted. What are those user accounts?

  A. Admin and Default

  B. Expert and Clish

  C. Control and Monitor

  D. Admin and Monitor

  Correct Answer: D

  Gaia has two default user accounts that cannot be deleted. They are Admin and Monitor. Admin is the user account that has full administrative privileges and can access both WebUI and CLI. Monitor is the user account that has read-only privileges and can access only WebUI2. The other options are not default user accounts in Gaia.

• Question 234:

  Which Check Point Software Wade provides visibility of users, groups and machines while also providing access control through identity-based policies?

  A. Firewall

  B. Identity Awareness

  C. Application Control

  D. URL Filtering

  Correct Answer: B

  Identity Awareness is the Check Point software blade that provides visibility of users, groups and machines while also providing access control through identity-based policies. Identity Awareness enables administrators to define granular access rules based on user or machine identity, rather than just IP addresses. Identity Awareness also allows administrators to monitor user activity and generate reports based on user or machine identity.

• Question 235:

  Which command shows detailed information about VPN tunnels?

  A. cat $FWDlR/conf/vpn.conf

  B. vpn tu tlist

  C. vpn tu

  D. cpview

  Correct Answer: C

  This answer is correct because the vpn tu command is used for VPN tunnel management and shows detailed information about VPN tunnels, such as the tunnel ID, peer IP, encryption domain, and status. This command will bring up a menu for you to choose from, such as list all IPsec SAs, delete all IPsec SAs, or delete IPsec SA for given peer. The other answers are not correct because they either show different information or do not exist as commands. The cat $FWDlR/conf/ vpn.conf command shows the VPN configuration file, which contains the VPN domains, communities, and encryption settings. The vpn tu tlist command does not exist, but it might be confused with the vpn tunnelutil tlist command, which shows the tunnel utilization statistics. The cpview command shows the Check Point real-time performance monitoring tool, which displays various system and network parameters, such as CPU, memory, disk, interfaces, and VPN.

  How to use the "vpn tu" command for VPN tunnel management New VPN daemons in R81.10 / R81.20 - Check Point CheckMates Remote Access VPN R81.20 Administration Guide - Check Point Software Remote Access VPN R81 Administration Guide - Check Point Software

• Question 236:

  What are the Threat Prevention software components available on the Check Point Security Gateway?

  A. IPS, Threat Emulation and Threat Extraction

  B. IPS, Anti-Bot, Anti-Virus, SandBlast and Macro Extraction

  C. IPS, Anti-Bot, Anti-Virus, Threat Emulation and Threat Extraction

  D. IDS, Forensics, Anti-Virus, Sandboxing

  Correct Answer: C

  Threat Prevention is a comprehensive solution that protects networks from malicious attacks by using multiple security blades, such as Anti-Bot, Anti-Virus, IPS, Threat Emulation, and Threat Extraction. These are the Threat Prevention software components available on the Check Point Security Gateway. IPS (Intrusion Prevention System) is a blade that detects and prevents network attacks by using signatures and behavioral patterns. Anti-Bot is a blade that detects and blocks botnet communications by using reputation services and heuristics. Anti-Virus is a blade that scans files and web content for malware by using signatures and emulation. Threat Emulation is a blade that analyzes suspicious files in a sandbox environment and blocks malicious files from entering the network. Threat Extraction is a blade that removes exploitable content from files and delivers clean files to users. References: Check Point R81 Threat Prevention Administration Guide

• Question 237:

  Tom has connected to the Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made?

  A. Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes.

  B. Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.

  C. Tom's changes will be lost since he lost connectivity and he will have to start again.

  D. Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work.

  Correct Answer: D

  Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work. This is because SmartConsole uses a session mechanism that allows users to work offline and save their changes locally until they are ready to publish them to the Management. If Tom loses connectivity, he can resume his session when he reconnects and continue working on his Rule Base changes. He does not need to reboot his SmartConsole computer, clear the cache, or restore changes. His changes will not be lost since he lost connectivity. References: Check Point R81 Security Management Administration Guide, | Udemy

• Question 238:

  SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

  A. Smart Cloud Services

  B. Load Sharing Mode Services

  C. Threat Agent Solution

  D. Public Cloud Services

  Correct Answer: A

  Smart Cloud Services is an option for deployment of Check Point SandBlast Zero-Day Protection. It is a cloud-based service that provides advanced threat prevention for files and URLs, without requiring any on-premise infrastructure or

  appliances . References:

  [Check Point SandBlast Zero-Day Protection], [Smart Cloud Services]

• Question 239:

  You have successfully backed up your Check Point configurations without the OS information. What command would you use to restore this backup?

  A. restore_backup

  B. import backup

  C. cp_merge

  D. migrate import

  Correct Answer: A

  The command to restore a backup of Check Point configurations without the OS information is restore_backup4. This command restores the Gaia OS configuration and the firewall database from a compressed file. The other commands are not valid for this purpose. import backup is not a valid command. cp_merge is a command to merge policies or objects from different databases. migrate import is a command to import a previously exported database using migrate export. References: System Backup and Restore feature in Gaia, [cp_merge], [migrate import]

• Question 240:

  When configuring LDAP with User Directory integration, changes applied to a User Directory template are:

  A. Not reflected for any users unless the local user template is changed.

  B. Not reflected for any users who are using that template.

  C. Reflected for ail users who are using that template and if the local user template is changed as well.

  D. Reflected immediately for all users who are using that template.

  Correct Answer: D

  LDAP (Lightweight Directory Access Protocol) is a protocol that allows accessing and maintaining distributed directory information services over a network. User Directory integration is a feature of Identity Awareness that allows Check Point products to use LDAP servers as identity sources. When configuring LDAP with User Directory integration, changes applied to a User Directory template are reflected immediately for all users who are using that template. A User Directory template defines the settings for connecting to an LDAP server and retrieving user information3. References: Check Point R81 Identity Awareness Administration Guide