CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 361:

  Identity Awareness allows easy configuration for network access and auditing based on what three items?

  A. Client machine IP address.
  B. Network location, the identity of a user and the identity of a machine.
  C. Log server IP address.
  D. Gateway proxy IP address.
  B. Network location, the identity of a user and the identity of a machine.

  ---

  Explanation/Reference:

  Identity Awareness is a blade that enables administrators to define access rules based on the identity of users and machines, rather than just IP addresses. Identity Awareness allows easy configuration for network access and auditing based on three items: network location, the identity of a user, and the identity of a machine. Network location refers to the source or destination network segment of the traffic. The identity of a user refers to the username or group membership of the user who initiates or receives the traffic. The identity of a machine refers to the hostname or certificate of the machine that initiates or receives the traffic. References: [Check Point R81 Identity Awareness Administration Guide]

• Question 362:

  Which of the following technologies extracts detailed information from packets and stores that information in state tables?

  A. INSPECT Engine
  B. Next-Generation Firewall
  C. Packet Filtering
  D. Application Layer Firewall
  B. Next-Generation Firewall

  ---

  Explanation/Reference:

  The INSPECT Engine is a technology that extracts detailed information from packets and stores that information in state tables. It enables stateful inspection and application layer filtering References: INSPECT Engine, Stateful Inspection

• Question 363:

  Which part of SmartConsole allows administrators to add, edit delete, and clone objects?

  A. Object Browser
  B. Object Editor
  C. Object Navigator
  D. Object Explorer
  D. Object Explorer

  ---

  Explanation/Reference:

  The Object Explorer is the part of SmartConsole that allows administrators to add, edit, delete, and clone objects. Objects are entities that represent network elements, such as hosts, networks, gateways, services, users, etc. The Object Explorer provides a tree view of all the objects in the database and allows searching, filtering, and grouping them.

  References: Check Point R81 SmartConsole R81 User Guide

• Question 364:

  What are the three deployment options available for a security gateway?

  A. Standalone, Distributed, and Bridge Mode
  B. Bridge Mode, Remote, and Standalone
  C. Remote, Standalone, and Distributed
  D. Distributed, Bridge Mode, and Remote
  A. Standalone, Distributed, and Bridge Mode

  ---

  Explanation/Reference:

  A security gateway is a device that enforces the security policy on the traffic that passes through it. There are three deployment options available for a security gateway: Standalone, Distributed, and Bridge Mode. Standalone means that the security gateway and the security management server are installed on the same machine. Distributed means that the security gateway and the security management server are installed on separate machines. Bridge Mode means that the security gateway acts as a transparent bridge between two network segments, without changing the IP addressing scheme. References: Check Point R81 Security Gateway Technical Administration Guide

• Question 365:

  Which path below is available only when CoreXL is enabled?

  A. Slow path
  B. Firewall path
  C. Medium path
  D. Accelerated path
  C. Medium path

  ---

  Explanation/Reference:

  The path that is available only when CoreXL is enabled is the medium path. The medium path is used to handle packets that require deeper inspection by the Firewall and IPS blades, but do not need to go through the slow path . The slow path is used to handle packets that require stateful or out-of-state inspection by other blades, such as Application Control or VPN . The firewall path and the accelerated path are available regardless of CoreXL status . References: [CoreXL R81 Administration Guide], [], [Check Point Security Gateway Architecture and Packet Flow], [Free Check Point CCSA Sample Questions and Study Guide]

• Question 366:

  When configuring Anti-Spoofing, which tracking options can an Administrator select?

  A. Log, Alert, None
  B. Log, Allow Packets, Email
  C. Drop Packet, Alert, None
  D. Log, Send SNMP Trap, Email
  A. Log, Alert, None

  ---

  Explanation/Reference:

  Log, Alert, and None are the tracking options that an Administrator can select when configuring Anti-Spoofing. Log means that the packet will be logged in SmartView Tracker. Alert means that the packet will trigger an alert in SmartView Monitor. None means that no action will be taken. The other options are not valid tracking options.

• Question 367:

  Which of the following is used to initially create trust between a Gateway and Security Management Server?

  A. Internal Certificate Authority
  B. Token
  C. One-time Password
  D. Certificate
  C. One-time Password

  ---

  Explanation/Reference:

  A one-time password is used to initially create trust between a Gateway and Security Management Server. The administrator generates a one-time password from SmartConsole and enters it on the gateway command line interface using the cpconfig command. This establishes a Secure Internal Communication (SIC) between the gateway and the server . The other options are not used for this purpose. References: [Configuring Secure Internal Communication (SIC)], []

• Question 368:

  Which Threat Prevention Profile is not included by default in R80 Management?

  A. Basic - Provides reliable protection on a range of non-HTTP protocols for servers, with minimal impact on network performance
  B. Optimized - Provides excellent protection for common network products and protocols against recent or popular attacks
  C. Strict - Provides a wide coverage for all products and protocols, with impact on network performance
  D. Recommended - Provides all protection for all common network products and servers, with impact on network performance
  D. Recommended - Provides all protection for all common network products and servers, with impact on network performance

  ---

  Explanation/Reference:

  The default Threat Prevention Profiles in R80 Management are Basic, Optimized, and Strict. There is no Recommended profile by default. You can create a custom profile and name it Recommended, but it is not included by default. References: Check Point R81 Threat Prevention Administration Guide

• Question 369:

  Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.

  A. On all satellite gateway to satellite gateway tunnels
  B. On specific tunnels for specific gateways
  C. On specific tunnels in the community
  D. On specific satellite gateway to central gateway tunnels
  C. On specific tunnels in the community

  ---

  Explanation/Reference:

  Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or on specific tunnels in the community. This option allows the administrator to select which tunnels should be permanent and which

  should be established on demand. The other options are not valid, as they do not match the available choices in the VPN community settings.

  References: [VPN Administration Guide], [Check Point R81.10]

• Question 370:

  What are the types of Software Containers?

  A. Smart Console, Security Management, and Security Gateway
  B. Security Management, Security Gateway, and Endpoint Security
  C. Security Management, Log and Monitoring, and Security Policy
  D. Security Management, Standalone, and Security Gateway
  B. Security Management, Security Gateway, and Endpoint Security

  ---

  Explanation/Reference:

  The types of Software Containers are Security Management, Security Gateway, and Endpoint Security. Software Containers are virtual environments that run on top of Gaia OS and allow multiple instances of Check Point products to coexist on the same physical machine. The other options are not valid types of Software Containers.