CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 321:

  Fill in the blank: An Endpoint identity agent uses a ___________ for user authentication.

  A. Shared secret
  B. Token
  C. Username/password or Kerberos Ticket
  D. Certificate
  C. Username/password or Kerberos Ticket

  ---

  Explanation/Reference:

  An Endpoint identity agent uses a username/password or Kerberos ticket for user authentication, p. 28. An Endpoint identity agent is a lightweight client installed on endpoint computers that communicates with Identity Awareness gateways

  and provides reliable identity information. An Endpoint identity agent does not use a shared secret, a token, or a certificate for user authentication.

  References: Check Point CCSA - R81:Practice Test and Explanation, [Check Point Identity Awareness Administration Guide R81]

• Question 322:

  If there is an Accept Implied Policy set to "First", what is the reason Jorge cannot see any logs?

  A. Log Implied Rule was not set correctly on the track column on the rules base.
  B. Track log column is set to Log instead of Full Log.
  C. Track log column is set to none.
  D. Log Implied Rule was not selected on Global Properties.
  D. Log Implied Rule was not selected on Global Properties.

  ---

  Explanation/Reference:

  If there is an Accept Implied Policy set to "First", Jorge cannot see any logs because Log Implied Rule was not selected on Global Properties. The Log Implied Rule option enables logging for all implied rules, such as DHCP, anti-spoofing,

  and cleanup rules.

  References: : Check Point R81 Security Management Administration Guide, page 103.

• Question 323:

  Which application is used for the central management and deployment of licenses and packages?

  A. SmartProvisioning
  B. SmartLicense
  C. SmartUpdate
  D. Deployment Agent
  C. SmartUpdate

  ---

  Explanation/Reference:

  SmartUpdate is the application that is used for the central management and deployment of licenses and packages. SmartUpdate allows administrators to manage licenses, software updates, and hotfixes for multiple Security Gateways and cluster members from one central location. SmartProvisioning is an application that enables centralized management of network devices. SmartLicense is a feature that simplifies license management by using a cloud-based portal. Deployment Agent is a component that enables automatic deployment of software packages.

• Question 324:

  What is the order of NAT priorities?

  A. IP pool NAT static NAT. hide NAT
  B. Static NAT hide NAT, IP pool NAT
  C. Static NAT, IP pool NAT hide NAT
  D. Static NAT automatic NAT hide NAT
  C. Static NAT, IP pool NAT hide NAT

  ---

  Explanation/Reference:

  The order of NAT priorities is Static NAT, IP pool NAT, and hide NAT. Static NAT has the highest priority because it is a one-to-one mapping of a private IP address to a public IP address. IP pool NAT has the second highest priority because

  it is a one-to-many mapping of a private IP address to a pool of public IP addresses. Hide NAT has the lowest priority because it is a many-to-one mapping of multiple private IP addresses to a single public IP address.

  References: Check Point R81 Security Gateway Administration Guide, page 23.

• Question 325:

  Which of the following is NOT a type of Endpoint Identity Agent?

  A. Custom
  B. Terminal
  C. Full
  D. Light
  A. Custom

  ---

  Explanation/Reference:

  There are three types of Endpoint Identity Agents: Full, Light, and Terminal. Custom is not a valid type. References: Check Point R81 Endpoint Security Administration Guide, page 18.

• Question 326:

  Secure Internal Communication (SIC) is handled by what process?

  A. CPM
  B. HTTPS
  C. FWD
  D. CPD
  D. CPD

  ---

  Explanation/Reference:

  Secure Internal Communication (SIC) is handled by the CPD process. CPD is the Check Point Daemon that runs on all Check Point modules and handles internal licensing and SIC operations. SIC is a mechanism that ensures secure communication between Check Point components using certificates and encryption. References: Check Point R81 Security Management Administration Guide

• Question 327:

  Fill in the blank: An LDAP server holds one or more ______________.

  A. Server Units
  B. Administrator Units
  C. Account Units
  D. Account Servers
  C. Account Units

  ---

  Explanation/Reference:

  An LDAP server holds one or more Account Units. An Account Unit is a logical representation of an LDAP server in the Check Point database. It defines the connection parameters, authentication methods, and user and group information that are retrieved from the LDAP server. An Account Unit allows the Security Gateway to use the LDAP server for user authentication and identity awareness. The other options are incorrect. A Server Unit is a logical representation of a Check Point server in the Check Point database. An Administrator Unit is a logical representation of an administrator or an administrator group in the Check Point database. An Account Server is not a valid term in Check Point terminology.

  References: [Check Point R81 Identity Awareness Administration Guide], [Check Point R81 Security Management Administration Guide], [Check Point R81 SmartConsole R81 Resolved Issues]

• Question 328:

  Most Check Point deployments use Gaia but which product deployment utilizes special Check Point code (with unification in R81.10)?

  A. Enterprise Network Security Appliances
  B. Rugged Appliances
  C. Scalable Platforms
  D. Small Business and Branch Office Appliances
  C. Scalable Platforms

  ---

  Explanation/Reference:

  Most Check Point deployments use Gaia, which is a unified operating system for all Check Point appliances, open servers, and virtualized gateways. However, some product deployments utilize special Check Point code, such as Scalable Platforms (formerly known as Maestro), which are high-performance security gateways that can scale up to 1.5 Tbps of firewall throughput. Scalable Platforms use a special version of Gaia OS called Gaia Embedded, which is planned to be unified with Gaia OS in R81.102. References: Check Point R81 Release Notes

• Question 329:

  In Unified SmartConsole Gateways and Servers tab you can perform the following functions EXCEPT ________.

  A. Upgrade the software version
  B. Open WebUI
  C. Open SSH
  D. Open service request with Check Point Technical Support
  C. Open SSH

  ---

  Explanation/Reference:

  The function that can NOT be performed in the Unified SmartConsole Gateways and Servers tab is Open SSH. SSH is a secure shell protocol that allows remote access to a device via command line interface. The Unified SmartConsole does

  not provide an option to open SSH from the Gateways and Servers tab, as it is not a graphical user interface. The other functions can be performed in the Unified SmartConsole Gateways and Servers tab, such as upgrading the software

  version, opening WebUI, or opening service request with Check Point Technical Support.

  References: [SSH (Secure Shell)], [QUANTUM SECURITY MANAGEMENT R81]

• Question 330:

  Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

  A. ThreatWiki
  B. Whitelist Files
  C. AppWiki
  D. IPS Protections
  A. ThreatWiki

  ---

  Explanation/Reference:

  ThreatWiki is a tool that provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed. ThreatWiki is a web-based service that collects information about files from various sources, such as Check Point customers, partners, and researchers. Administrators can use ThreatWiki to view file reputation, upload files for analysis, and download indicators of compromise. Whitelist Files, AppWiki, and IPS Protections are not tools that provide a list of trusted files. References: Threat Prevention R80.40 Administration Guide