CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 331:

  Stateful Inspection compiles and registers connections where?

  A. Connection Cache
  B. State Cache
  C. State Table
  D. Network Table
  C. State Table

  ---

  Explanation/Reference:

  Stateful Inspection compiles and registers connections in the State Table. The State Table is a database that stores information about active connections and sessions on the Security Gateway. The other options are not valid names for the

  database that stores connection information.

  References:

  1: Policy Types

  2: CPUSE

  3: SIC : [Software Containers] : [Stateful Inspection]

• Question 332:

  In SmartConsole, on which tab are Permissions and Administrators defined?

  A. Manage and Settings
  B. Logs and Monitor
  C. Security Policies
  D. Gateways and Servers
  A. Manage and Settings

  ---

  Explanation/Reference:

  Permissions and Administrators are defined on the Manage and Settings tab in SmartConsole. This tab allows you to create and manage administrator accounts, roles, permissions, and authentication methods for accessing SmartConsole and other Check Point management interfaces. References: Check Point R81 Security Management Administration Guide

• Question 333:

  An administrator wishes to enable Identity Awareness on the Check Point firewalls. However they allow users to use company issued or personal laptops. Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?

  A. AD Query
  B. Browser-Based Authentication
  C. Identity Agents
  D. Terminal Servers Agent
  B. Browser-Based Authentication

  ---

  Explanation/Reference:

  Browser-Based Authentication is the best method for enabling Identity Awareness on the Check Point firewalls for users who use company issued or personal laptops. Browser-Based Authentication redirects users to a web page where they enter their credentials to access the network resources. This method does not require any installation or configuration on the user's device and supports any operating system and browser. AD Query is a method that queries Active Directory servers for user login events and maps them to IP addresses. This method does not work for personal laptops that are not joined to the domain. Identity Agents are software agents that run on Windows or macOS devices and provide user and machine identity information to the firewall. This method requires installation and management of the agents on each device, which may not be feasible for personal laptops. Terminal Servers Agent is a method that identifies users who connect to Windows Terminal Servers or Citrix servers via RDP or ICA protocols. This method does not apply to laptops that connect directly to the network910 References: Identity Awareness Reference Architecture and Best Practices, Part 10 - Identity

• Question 334:

  What is the purpose of Captive Portal?

  A. It manages user permission in SmartConsole
  B. It provides remote access to SmartConsole
  C. It authenticates users, allowing them access to the Internet and corporate resources
  D. It authenticates users, allowing them access to the Gaia OS
  C. It authenticates users, allowing them access to the Internet and corporate resources

  ---

  Explanation/Reference:

  Captive Portal is a feature of Identity Awareness that allows you to authenticate users through a web browser before they access the Internet or corporate resources. Captive Portal can be used for various authentication methods, such as user name and password, one-time password (OTP), or certificate3. Captive Portal does not manage user permission in SmartConsole, provide remote access to SmartConsole, or authenticate users to the Gaia OS. Those are different functions that are not related to Captive Portal. References: Check Point R81 Identity Awareness Administration Guide

• Question 335:

  Which of the following statements about Site-to-Site VPN Domain-based is NOT true?

  A. Route-based- The Security Gateways will have a Virtual Tunnel Interface (VTI) for each VPN Tunnel with a peer VPN Gateway. The Routing Table can have routes to forward traffic to these VTIs. Any traffic routed through a VTI is automatically identified as VPN Traffic and is passed through the VPN Tunnel associated with the VTI.
  B. Domain-based-- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway.
  C. Domain-based-- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a host or network that can send or receive VPN traffic through a VPN Gateway.
  D. Domain-based-- VPN domains are pre-defined for all VPN Gateways. When the Security Gateway encounters traffic originating from one VPN Domain with the destination to a VPN Domain of another VPN Gateway, that traffic is identified as VPN traffic and is sent through the VPN Tunnel between the two Gateways.
  B. Domain-based-- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway.

  ---

  Explanation/Reference:

  Domain-based-- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway. This statement is not true because a VPN domain is not a service or user, but a host or network that can send or receive VPN traffic through a VPN Gateway. This is the definition given in the Site to Site VPN R81 Administration Guide. The other statements are true according to the same guide. Remote Access VPN R81.20 Administration Guide Site to Site VPN R81 Administration Guide DeepDive Webinar - R81.20 Seamless VPN Connection to Public Cloud

• Question 336:

  Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

  A. All Connections (Clear or Encrypted)
  B. Accept all encrypted traffic
  C. Specific VPN Communities
  D. All Site-to-Site VPN Communities
  C. Specific VPN Communities

  ---

  Explanation/Reference:

  The option that allows traffic to VPN gateways in specific VPN communities is Specific VPN Communities. This option enables you to define which VPN communities are allowed in the rule. All Connections (Clear or Encrypted) allows traffic to any destination, regardless of whether it is encrypted or not. Accept all encrypted traffic allows traffic to any encrypted destination, regardless of the VPN community. All Site-to-Site VPN Communities allows traffic to any site-to-site VPN gateway, regardless of the VPN community. Therefore, the correct answer is C. Specific VPN Communities.

• Question 337:

  Which encryption algorithm is the least secured?

  A. 3DES
  B. AES-128
  C. DES
  D. AES-256
  C. DES

  ---

  Explanation/Reference:

  This answer is correct because DES (Data Encryption Standard) is the least secured encryption algorithm among the options given. DES uses a 56-bit key, which is too short and can be easily cracked by brute force attacks. DES also suffers

  from other weaknesses, such as weak keys, complementation property, and linear cryptanalysis. The other answers are not correct because they are more secured encryption algorithms than DES. 3DES (Triple DES) is an improvement over

  DES that applies DES three times with different keys, resulting in a 168-bit key. AES-128 and AES-256 are variants of AES (Advanced Encryption Standard) that use 128-bit and 256-bit keys respectively. AES is considered to be the most

  secure symmetric encryption algorithm and is widely used for data protection.

  What is DES encryption, and why was it replaced?

  Data Encryption Standard - Wikipedia

  What is 3DES encryption?

  [What is AES encryption and how does it work?]

• Question 338:

  What are the three types of UserCheck messages?

  A. inform, ask, and block
  B. block, action, and warn
  C. action, inform, and ask
  D. ask, block, and notify
  A. inform, ask, and block

  ---

  Explanation/Reference:

  The three types of UserCheck messages are inform, ask, and block. Inform messages notify users about security events and do not require any user action. Ask messages prompt users to choose whether to allow or block an action. Block messages prevent users from performing an action and display a reason. References: Check Point R81 Logging and Monitoring Administration Guide

• Question 339:

  When comparing Stateful Inspection and Packet Filtering, what is a benefit that Stateful Inspection offers over Packer Filtering?

  A. Stateful Inspection offers unlimited connections because of virtual memory usage.
  B. Stateful Inspection offers no benefits over Packet Filtering.
  C. Stateful Inspection does not use memory to record the protocol used by the connection.
  D. Only one rule is required for each connection.
  D. Only one rule is required for each connection.

  ---

  Explanation/Reference:

  Stateful Inspection is a firewall technology that inspects both the header and the payload of each packet and keeps track of the state and context of each connection. Packet Filtering is a firewall technology that inspects only the header of each packet and does not keep track of the state or context of each connection. A benefit that Stateful Inspection offers over Packet Filtering is that only one rule is required for each connection, whereas Packet Filtering requires two rules for each connection (one for each direction). Stateful Inspection also offers other benefits over Packet Filtering, such as enhanced security, performance, and flexibility. Stateful Inspection does not offer unlimited connections because of virtual memory usage, nor does it avoid using memory to record the protocol used by the connection.References: [Stateful Inspection], [Packet Filtering], [Firewall Technologies]

• Question 340:

  When a Security Gateway sends its logs to an IP address other than its own, which deployment option is installed?

  A. Distributed
  B. Standalone
  C. Bridge Mode
  D. Targeted
  A. Distributed

  ---

  Explanation/Reference:

  When a Security Gateway sends its logs to an IP address other than its own, it means that the deployment option is distributed. In a distributed deployment, the Security Management Server and the Security Gateway are installed on separate machines. The Security Management Server collects logs from one or more Security Gateways and manages them centrally. In a standalone deployment, the Security Management Server and the Security Gateway are installed on the same machine. The Security Gateway sends logs to its own IP address. In a bridge mode deployment, the Security Gateway acts as a transparent bridge between two network segments and does not have an IP address of its own. In a targeted deployment, the Security Gateway sends logs to a specific log server that is configured in the gateway object properties34 References: Part 4 - Installing Security Gateway, Deployment Options