CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 281:

  Fill in the blank: When a policy package is installed, ________ are also distributed to the target installation Security Gateways.

  A. User and objects databases
  B. Network databases
  C. SmartConsole databases
  D. User databases
  A. User and objects databases

  ---

  Explanation/Reference:

  When a policy package is installed, user and objects databases are also distributed to the target installation Security Gateways. The user and objects databases contain information about network objects, users, groups, services, VPN domains, and more. Therefore, the correct answer is A. User and objects databases.

• Question 282:

  Which option in tracking allows you to see the amount of data passed in the connection?

  A. Data
  B. Accounting
  C. Logs
  D. Advanced
  B. Accounting

  ---

  Explanation/Reference:

  Accounting is the option in tracking that allows you to see the amount of data passed in the connection. Accounting tracks the number of bytes and packets for each connection and generates reports based on the collected data. References: Certified Security Administrator (CCSA) R81.20 Course Overview, page 14.

• Question 283:

  What is the BEST command to view configuration details of all interfaces in Gaia CLISH?

  A. ifconfig -a
  B. show interfaces
  C. show interfaces detail
  D. show configuration interface
  D. show configuration interface

  ---

  Explanation/Reference:

  The BEST command to view configuration details of all interfaces in Gaia CLISH is show configuration interface. This command displays the interface name, IP address, netmask, state, MTU, and other parameters for each interface. ifconfig a, show interfaces, and show interfaces detail are not valid commands in Gaia CLISH. References: How to configure static routes in CLISH on Gaia OS and IPSO OS, GAIA CLISH Commands - Fir3net, Gaia Administration Guide R80 Check Point Software, Gaia Clish commands including User Defined (Extended) commands

• Question 284:

  Which of the following is used to extract state related information from packets and store that information in state tables?

  A. STATE Engine
  B. TRACK Engine
  C. RECORD Engine
  D. INSPECT Engine
  D. INSPECT Engine

  ---

  Explanation/Reference:

  The INSPECT Engine is the core component of Check Point's Stateful Inspection technology. It is used to extract state related information from packets and store that information in state tables. The INSPECT Engine also evaluates the security policy and enforces it on the packets. References: Check Point R81 Security Gateway Technical Administration Guide

• Question 285:

  Which of the following describes how Threat Extraction functions?

  A. Detect threats and provides a detailed report of discovered threats
  B. Proactively detects threats
  C. Delivers file with original content
  D. Delivers PDF versions of original files with active content removed
  D. Delivers PDF versions of original files with active content removed

  ---

  Explanation/Reference:

  Threat Extraction delivers PDF versions of original files with active content removed, such as macros, embedded objects, and scripts. This ensures that users receive clean and safe files in seconds. References: Check Point SandBlast Zero-Day Protection, Check Point Threat Extraction

• Question 286:

  In SmartEvent, a correlation unit (CU) is used to do what?

  A. Collect security gateway logs, Index the logs and then compress the logs.
  B. Receive firewall and other software blade logs in a region and forward them to the primary log server.
  C. Analyze log entries and identify events.
  D. Send SAM block rules to the firewalls during a DOS attack.
  C. Analyze log entries and identify events.

  ---

  Explanation/Reference:

  A correlation unit (CU) is a component of SmartEvent that analyzes log entries on log servers and identifies events based on predefined or custom rules. A CU receives logs from one or more log servers and forwards them to the SmartEvent server, where they are stored in the events database

• Question 287:

  What is a role of Publishing?

  A. The Publish operation sends the modifications made via SmartConsole in the private session and makes them public
  B. The Security Management Server installs the updated policy and the entire database on Security Gateways
  C. The Security Management Server installs the updated session and the entire Rule Base on Security Gateways
  D. Modifies network objects, such as servers, users, services, or IPS profiles, but not the Rule Base
  A. The Publish operation sends the modifications made via SmartConsole in the private session and makes them public

  ---

  Explanation/Reference:

  The Publish operation sends the modifications made via SmartConsole in the private session and makes them public is the correct answer. This is because publishing is the process of saving your changes to the database and making them

  available to other administrators. Publishing also allows you to install policies on Security Gateways.

  References: [Publishing Changes]

• Question 288:

  Which type of Check Point license ties the package license to the IP address of the Security Management Server?

  A. Central
  B. Corporate
  C. Local
  D. Formal
  A. Central

  ---

  Explanation/Reference:

  The type of Check Point license that ties the package license to the IP address of the Security Management Server is Central license. A Central license is a license that is installed on the Security Management Server and applies to all the Security Gateways that are managed by it. The Central license is based on the IP address of the Security Management Server and cannot be transferred to another Security Management Server with a different IP address.References: [Check Point R81 Licensing Guide], [Managing and Installing license via SmartUpdate]

• Question 289:

  SmartConsole provides a consolidated solution for everything that is necessary for the security of an organization, such as the following

  A. Security Policy Management and Log Analysis
  B. Security Policy Management. Log Analysis. System Health Monitoring. Multi-Domain Security Management.
  C. Security Policy Management Log Analysis and System Health Monitoring
  D. Security Policy Management. Threat Prevention rules. System Health Monitoring and Multi-Domain Security Management.
  A. Security Policy Management and Log Analysis

  ---

  Explanation/Reference:

  SmartConsole provides a consolidated solution for everything that is necessary for the security of an organization, such as Security Policy Management and Log Analysis. Security Policy Management is the process of defining and enforcing rules that control the access and protection of network resources. Log Analysis is the process of collecting, analyzing, and reporting on log data that is generated by network devices and applications. SmartConsole is a unified graphical user interface that allows administrators to manage multiple security functions from a single console. The other options are not part of SmartConsole, but rather separate software blades or features that can be integrated with SmartConsole.

• Question 290:

  Fill in the blank: In Security Gateways R75 and above, SIC uses ______________ for encryption.

  A. AES-128
  B. AES-256
  C. DES
  D. 3DES
  A. AES-128

  ---

  Explanation/Reference:

  In Security Gateways R75 and above, SIC uses AES-128 for encryption. SIC stands for Secure Internal Communication, which is a mechanism that establishes trust between Check Point components, such as Security Gateways, Security Management Servers, Log Servers, etc. SIC uses certificates to authenticate and encrypt the communication between the components. AES-128 is an encryption algorithm that uses a 128-bit key to encrypt and decrypt data. The other options are incorrect. AES-256 is an encryption algorithm that uses a 256-bit key, but it is not used by SIC. DES and 3DES are older encryption algorithms that use 56-bit and 168-bit keys respectively, but they are not used by SIC either. References: [Secure Internal Communication (SIC) between Check Point components], AES - Wikipedia, DES - Wikipedia, Triple DES - Wikipedia