CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 21:

  Identify the ports to which the Client Authentication daemon listens on by default?

  A. 259, 900
  B. 256, 257
  C. 8080, 529
  D. 80, 256
  A. 259, 900

  ---

  Explanation/Reference:

  The ports to which the Client Authentication daemon listens on by default are 259 and 900. Client Authentication is a method that allows users to authenticate with the Security Gateway before they are allowed access to protected resources. The Client Authentication daemon (fwauthd) runs on the Security Gateway and listens for authentication requests on TCP ports 259 and 900 . References: [Check Point R81 Remote Access VPN Administration Guide], [Check Point R81 Quantum Security Gateway Guide]

• Question 22:

  Fill in the blank: To create policy for traffic to or from a particular location, use the _____________.

  A. DLP shared policy
  B. Geo policy shared policy
  C. Mobile Access software blade
  D. HTTPS inspection
  B. Geo policy shared policy

  ---

  Explanation/Reference:

  The answer is B because Geo policy shared policy is used to create policy for traffic to or from a particular location based on the source or destination country. DLP shared policy is used to prevent data loss by inspecting files and data for sensitive information. Mobile Access software blade is used to provide secure remote access to corporate resources from various devices. HTTPS inspection is used to inspect encrypted web traffic for threats and compliance References: Check Point R81 Geo Policy Administration Guide, [Check Point R81 Data Loss Prevention Administration Guide], [Check Point R81 Mobile Access Administration Guide], [Check Point R81 HTTPS Inspection Administration Guide]

• Question 23:

  How do logs change when the "Accounting" tracking option is enabled on a traffic rule?

  A. Involved traffic logs will be forwarded to a log server.
  B. Provides log details view email to the Administrator.
  C. Involved traffic logs are updated every 10 minutes to show how much data has passed on the connection.
  D. Provides additional information to the connected user.
  C. Involved traffic logs are updated every 10 minutes to show how much data has passed on the connection.

  ---

  Explanation/Reference:

  The Accounting tracking option is used to monitor the amount of data that passes through a connection. When this option is enabled on a traffic rule, the involved traffic logs are updated every 10 minutes to show how much data has passed on the connection. This information can be used for billing or auditing purposes. References: Check Point R81 Logging and Monitoring Administration Guide

• Question 24:

  What is the Transport layer of the TCP/IP model responsible for?

  A. It transports packets as datagrams along different routes to reach their destination.
  B. It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.
  C. It defines the protocols that are used to exchange data between networks and how host programs interact with the Application layer.
  D. It deals with all aspects of the physical components of network connectivity and connects with different network types.
  B. It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.

  ---

  Explanation/Reference:

  The Transport layer of the TCP/IP model is responsible for managing the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application. It also provides error detection and correction, flow control, and multiplexing. The Transport layer uses protocols such as TCP and UDP. References: Check Point Security Engineering Study Guide, p. 10-11

• Question 25:

  The ______ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

  A. Next Generation Threat Prevention
  B. Next Generation Threat Emulation
  C. Next Generation Threat Extraction
  D. Next Generation Firewall
  B. Next Generation Threat Emulation

  ---

  Explanation/Reference:

  The Next Generation Threat Emulation software blade package uses CPU-level and OS- level sandboxing in order to detect and block malware, p. 41. It emulates files in a virtual environment and inspects their behavior for malicious activity. , Check Point Threat Emulation Administration Guide R81

• Question 26:

  Which GUI tool can be used to view and apply Check Point licenses?

  A. cpconfig
  B. Management Command Line
  C. SmartConsole
  D. SmartUpdate
  D. SmartUpdate

  ---

  Explanation/Reference:

  The GUI tool that can be used to view and apply Check Point licenses is SmartUpdate. SmartUpdate is a centralized tool that allows you to manage licenses, software packages, and hotfixes for multiple gateways and clusters. cpconfig, Management Command Line, and SmartConsole are not tools for license management. References: Check Point R81 SmartUpdate Administration Guide, | Udemy

• Question 27:

  What does it mean if Deyra sees the gateway status:

  

  Choose the BEST answer.

  A. SmartCenter Server cannot reach this Security Gateway
  B. There is a blade reporting a problem C. VPN software blade is reporting a malfunction
  D. Security Gateway's MGNT NIC card is disconnected.
  B. There is a blade reporting a problem C. VPN software blade is reporting a malfunction

  ---

  Explanation/Reference:

  If Deyra sees the gateway status as shown in the image, it means that there is a blade reporting a problem. The red "X" in the status column indicates that one or more blades on the Security Gateway have a problem that requires attention. The other options are not correct, as they do not match the status shown in the image. If the SmartCenter Server cannot reach this Security Gateway, the status column would show a yellow triangle with an exclamation mark. If the VPN software blade is reporting a malfunction, the blades column would show a red "X" on the VPN icon. If the Security Gateway's MGNT NIC card is disconnected, the IP column would show "N/A" instead of the IP address. References: Remote Access VPN R81 Administration Guide, Check Point R81.10

  

• Question 28:

  From the Gaia web interface, which of the following operations CANNOT be performed on a Security Management Server?

  A. Verify a Security Policy
  B. Open a terminal shell
  C. Add a static route
  D. View Security Management GUI Clients
  A. Verify a Security Policy

  ---

  Explanation/Reference:

  From the Gaia web interface, the operation that CANNOT be performed on a Security Management Server is Verify a Security Policy. This operation can only be done from SmartConsole4. References: Check Point R81 SmartConsole Online Help

• Question 29:

  Which command shows detailed information about VPN tunnels?

  A. cat $FWDlR/conf/vpn.conf
  B. vpn tu tlist
  C. vpn tu
  D. cpview
  C. vpn tu

  ---

  Explanation/Reference:

  This answer is correct because the vpn tu command is used for VPN tunnel management and shows detailed information about VPN tunnels, such as the tunnel ID, peer IP, encryption domain, and status. This command will bring up a menu for you to choose from, such as list all IPsec SAs, delete all IPsec SAs, or delete IPsec SA for given peer. The other answers are not correct because they either show different information or do not exist as commands. The cat $FWDlR/conf/ vpn.conf command shows the VPN configuration file, which contains the VPN domains, communities, and encryption settings. The vpn tu tlist command does not exist, but it might be confused with the vpn tunnelutil tlist command, which shows the tunnel utilization statistics. The cpview command shows the Check Point real-time performance monitoring tool, which displays various system and network parameters, such as CPU, memory, disk, interfaces, and VPN.

  How to use the "vpn tu" command for VPN tunnel management New VPN daemons in R81.10 / R81.20 - Check Point CheckMates Remote Access VPN R81.20 Administration Guide - Check Point Software Remote Access VPN R81 Administration Guide - Check Point Software

• Question 30:

  Is it possible to have more than one administrator connected to a Security Management Server at once?

  A. Yes, but only if all connected administrators connect with read-only permissions.
  B. Yes, but objects edited by one administrator will be locked for editing by others until the session is published.
  C. No, only one administrator at a time can connect to a Security Management Server
  D. Yes, but only one of those administrators will have write-permissions. All others will have read-only permission.
  B. Yes, but objects edited by one administrator will be locked for editing by others until the session is published.

  ---

  Explanation/Reference:

  It is possible to have more than one administrator connected to a Security Management Server at once, but objects edited by one administrator will be locked for editing by others until the session is published. This feature is called concurrent administration and it allows multiple administrators to work on the same security policy at the same time. However, when one administrator edits an object, such as a gateway, a rule, or a network, that object is locked for other administrators until the change is published or discarded. The lock icon shows which objects are being edited by other administrators and prevents conflicts or overwrites.References: [Concurrent Administration], [SmartConsole Overview]