CheckPoint Checkpoint Certifications 156-215.81 Questions & Answers

• Question 251:

  Which Security Blade needs to be enabled in order to sanitize and remove potentially malicious content from files, before those files enter the network?

  A. Threat Emulation

  B. Anti-Malware

  C. Anti-Virus

  D. Threat Extraction

  Correct Answer: D

  Threat Extraction is the Security Blade that needs to be enabled in order to sanitize and remove potentially malicious content from files, before those files enter the network. It can strip out active content, embedded objects, and other risky elements from documents and deliver a safe version of the file to the user. References: Remote Access VPN R81.20 Administration Guide, page 18.

• Question 252:

  What is the Transport layer of the TCP/IP model responsible for?

  A. It transports packets as datagrams along different routes to reach their destination.

  B. It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.

  C. It defines the protocols that are used to exchange data between networks and how host programs interact with the Application layer.

  D. It deals with all aspects of the physical components of network connectivity and connects with different network types.

  Correct Answer: B

  The Transport layer of the TCP/IP model is responsible for managing the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application. It also provides error detection and correction, flow control, and multiplexing. The Transport layer uses protocols such as TCP and UDP. References: Check Point Security Engineering Study Guide, p. 10-11

• Question 253:

  What are the two types of NAT supported by the Security Gateway?

  A. Destination and Hide

  B. Hide and Static

  C. Static and Source

  D. Source and Destination

  Correct Answer: B

  The two types of NAT supported by the Security Gateway are hide NAT and static NAT. Hide NAT translates many source IP addresses into one IP address, usually the external interface of the gateway. Static NAT translates one source IP address into another IP address, usually a public IP address. The other options are not valid types of NAT. References: Network Address Translation (NAT),

• Question 254:

  A security zone is a group of one or more network interfaces from different centrally managed gateways. What is considered part of the zone?

  A. The zone is based on the network topology and determined according to where the interface leads to.

  B. Security Zones are not supported by Check Point firewalls.

  C. The firewall rule can be configured to include one or more subnets in a zone.

  D. The local directly connected subnet defined by the subnet IP and subnet mask.

  Correct Answer: A

  A security zone is a group of one or more network interfaces from different centrally managed gateways that have the same security requirements. The zone is based on the network topology and determined according to where the interface leads to. For example, a zone can be defined as internal, external, DMZ, VPN, etc. Security zones are supported by Check Point firewalls and can be used to simplify security policies and network segmentation. The firewall rule can be configured to include one or more zones as source or destination objects. The local directly connected subnet defined by the subnet IP and subnet mask is not considered part of the zone, but rather a property of the interface.References: [Security Zones], [Security Zones Best Practices]

• Question 255:

  Which product correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices?

  A. SmartDashboard

  B. SmartEvent

  C. SmartView Monitor

  D. SmartUpdate

  Correct Answer: B

  The product that correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices is SmartEvent. SmartEvent is a software blade that analyzes logs from various sources such as Security Gateways, Endpoint Security Servers, Identity Awareness Servers, etc. and generates security events based on predefined or custom rules. SmartEvent provides a graphical interface for viewing and managing security events in real-time or historical mode. References: [Check Point R81 SmartEvent Administration Guide]

• Question 256:

  John is using Management HA. Which Smartcenter should be connected to for making changes?

  A. secondary Smartcenter

  B. active Smartcenter

  C. connect virtual IP of Smartcenter HA

  D. primary Smartcenter

  Correct Answer: B

  The SmartCenter that should be connected to for making changes is the active SmartCenter. The active SmartCenter is the one that is currently synchronizing its configuration with the secondary SmartCenter and handling the communication with the gateways . The primary SmartCenter is the one that was initially configured as the main server, but it may become inactive if a failover occurs. The virtual IP of SmartCenter HA is used to access the SmartConsole, not to make changes. References: [Security Management Server High Availability (HA) R81 Administration Guide], [], [How to configure ClusterXL High Availability on Security Management Server]

• Question 257:

  To increase security, the administrator has modified the Core protection `Host Port Scan' from `Medium' to `High' Predefined Sensitivity. Which Policy should the administrator install after Publishing the changes?

  A. The Access Control and Threat Prevention Policies.

  B. The Access Control Policy.

  C. The Access Control and HTTPS Inspection Policy.

  D. The Threat Prevention Policy.

  Correct Answer: D

  To increase security, the administrator has modified the Core protection `Host Port Scan' from `Medium' to `High' Predefined Sensitivity. The administrator should install the Threat Prevention Policy after Publishing the changes. The Threat Prevention Policy defines how the Security Gateway inspects and protects against threats such as port scans, bot attacks, and zero-day exploits. References: Check Point R81 Firewall Administration Guide, Check Point R81 Threat Prevention Administration Guide

• Question 258:

  What are the three deployment considerations for a secure network?

  A. Distributed, Bridge Mode, and Remote

  B. Bridge Mode, Remote, and Standalone

  C. Remote, Standalone, and Distributed

  D. Standalone, Distributed, and Bridge Mode

  Correct Answer: C

  The three deployment considerations for a secure network are Remote, Standalone, and Distributed. Remote deployment means that the Security Management Server and Security Gateway are installed on different machines. Standalone deployment means that the Security Management Server and Security Gateway are installed on the same machine. Distributed deployment means that there are multiple Security Gateways managed by one or more Security Management Servers. Therefore, the correct answer is C. Remote, Standalone, and Distributed.

• Question 259:

  While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain Why does it not detect the windows domain?

  A. SmartConsole machine is not part of the domain

  B. Security Gateway is not part of the Domain

  C. Identity Awareness is not enabled on Global properties

  D. Security Management Server is not part of the domain

  Correct Answer: A

  While enabling the Identity Awareness blade, the Identity Awareness wizard does not automatically detect the Windows domain because the SmartConsole machine is not part of the domain. The SmartConsole machine needs to be a member of the Windows domain or have access to a domain controller in order to detect the domain automatically.

  References: Check Point R81 Identity Awareness Administration Guide, page 10.

• Question 260:

  True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway

  A. True, CLI is the prefer method for Licensing

  B. False, Central License are handled via Security Management Server

  C. False, Central License are installed via Gaia on Security Gateways

  D. True, Central License can be installed with CPLIC command on a Security Gateway

  Correct Answer: D

  In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway using the CPLIC command. This command allows you to install a license from a file or from the User Center. Therefore, the correct answer is D. True, Central License can be installed with CPLIC command on a Security Gateway.