CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 371:

  How many layers make up the TCP/IP model?

  A. 2
  B. 7
  C. 6
  D. 4
  D. 4

  ---

  Explanation/Reference:

  The TCP/IP model is made up of four layers: Application, Transport, Internet, and Network Interface, p. 10. The TCP/IP model is a simplified version of the OSI model, which has seven layers: Application, Presentation, Session, Transport, Network, Data Link, and Physical. , [TCP/IP Model Explained]

• Question 372:

  After a new Log Server is added to the environment and the SIC trust has been established with the SMS what will the gateways do?

  A. The gateways can only send logs to an SMS and cannot send logs to a Log Server. Log Servers are proprietary log archive servers.
  B. Gateways will send new firewall logs to the new Log Server as soon as the SIC trust is set up between the SMS and the new Log Server.
  C. The firewalls will detect the new Log Server after the next policy install and redirect the new logs to the new Log Server.
  D. Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.
  D. Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.

  ---

  Explanation/Reference:

  Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server. After adding a new Log Server and establishing the SIC trust with the SMS, the administrator must use SmartConsole to assign the Log Server to each gateway in the Logs and Masters section of the gateway properties. The other options are not correct, as gateways can send logs to both SMS and Log Server, Log Servers are not proprietary log archive servers, and gateways will not detect the new Log Server after the next policy install.

• Question 373:

  SmartEvent does NOT use which of the following procedures to identity events:

  A. Matching a log against each event definition
  B. Create an event candidate
  C. Matching a log against local exclusions
  D. Matching a log against global exclusions
  C. Matching a log against local exclusions

  ---

  Explanation/Reference:

  The procedure that SmartEvent does not use to identify events is matching a log against local exclusions. Local exclusions are used to filter out logs that are not relevant for SmartLog, not SmartEvent. SmartEvent uses the other procedures to identify events based on event definitions, event candidates, and global exclusions . References: SmartLog R81 Administration Guide, , SmartEvent R81 Administration Guide, [Free Check Point CCSA Sample Questions and Study Guide]

• Question 374:

  Fill in the blank: When tunnel test packets no longer invoke a response, SmartView Monitor displays _____________ for the given VPN tunnel.

  A. Down
  B. No Response
  C. Inactive
  D. Failed
  A. Down

  ---

  Explanation/Reference:

  When tunnel test packets no longer invoke a response, SmartView Monitor displays Down for the given VPN tunnel. This means that the VPN tunnel is not operational and there is no IKE or IPsec traffic passing through it. No Response, Inactive, and Failed are not valid statuses for VPN tunnels in SmartView Monitor. References: Smart View Monitor displays status for all S2S VPN tunnels - Phase UP

• Question 375:

  What is the RFC number that act as a best practice guide for NAT?

  A. RFC 1939
  B. RFC 1950
  C. RFC 1918
  D. RFC 793
  C. RFC 1918

  ---

  Explanation/Reference:

  The RFC number that acts as a best practice guide for NAT is RFC 1918. RFC 1918 defines a range of private IP addresses that are not globally routable and can be used for internal networks. NAT is a technique that maps these private IP

  addresses to public IP addresses that can communicate with the Internet. RFC 1918 provides guidelines and recommendations for using NAT in different scenarios and environments.

  References: [RFC 1918], [Network Address Translation (NAT)]

• Question 376:

  In ____________ NAT, the ____________ is translated.

  A. Hide; source
  B. Static; source
  C. Simple; source
  D. Hide; destination
  A. Hide; source

  ---

  Explanation/Reference:

  In hide NAT, the source IP address is translated. Hide NAT is also known as many-to-one NAT or PAT (Port Address Translation). It maps multiple private IP addresses to one public IP address by using different port numbers. Hide NAT allows outbound connections from the private network to the public network, but not inbound connections from the public network to the private network. In static NAT, the source or destination IP address is translated depending on the direction of the traffic. Static NAT is also known as one-to-one NAT or bi-directional NAT. It maps one private IP address to one public IP address and allows both outbound and inbound connections. In simple NAT, there is no translation of IP addresses. Simple NAT is also known as routing mode or transparent mode. It allows traffic to pass through the NAT device without any modification. There is no hide NAT for destination IP address translation References: What Is Network Address Translation (NAT)?, Network address translation, Network Address Translation Definition, Network Address Translation (NAT)

• Question 377:

  Choose what BEST describes the reason why querying logs now is very fast.

  A. New Smart-1 appliances double the physical memory install
  B. Indexing Engine indexes logs for faster search results
  C. SmartConsole now queries results directly from the Security Gateway
  D. The amount of logs been store is less than the usual in older versions
  B. Indexing Engine indexes logs for faster search results

  ---

  Explanation/Reference:

  The answer is B because querying logs now is very fast because the Indexing Engine indexes logs for faster search results. The Indexing Engine is a component of the Smart-1 appliance that creates indexes for log fields and values, such as source, destination, action, and time. The indexes enable quick and efficient searches of large amounts of log data.References: [Check Point R81 Logging and Monitoring Administration Guide], [Check Point R81 Indexing Engine]

• Question 378:

  Phase 1 of the two-phase negotiation process conducted by IKE operates in ______ mode.

  A. Main
  B. Authentication
  C. Quick
  D. High Alert
  A. Main

• Question 379:

  Which repositories are installed on the Security Management Server by SmartUpdate?

  A. License and Update
  B. Package Repository and Licenses
  C. Update and License and Contract
  D. License and Contract and Package Repository
  D. License and Contract and Package Repository

  ---

  Explanation/Reference:

  According to the Managing and Installing license via SmartUpdate, there are two repositories installed on the Security Management Server by SmartUpdate: License and Contract and Package Repository. The License and Contract repository stores all licenses available and all of the assigned licenses. The Package Repository stores all packages downloaded from the Check Point Cloud or uploaded from a local device. References: Managing and Installing license via SmartUpdate

• Question 380:

  In which scenario is it a valid option to transfer a license from one hardware device to another?

  A. From a 4400 Appliance to a 2200 Appliance
  B. From a 4400 Appliance to an HP Open Server
  C. From an IBM Open Server to an HP Open Server
  D. From an IBM Open Server to a 2200 Appliance
  A. From a 4400 Appliance to a 2200 Appliance

  ---

  Explanation/Reference:

  The scenario where it is a valid option to transfer a license from one hardware device to another is from a 4400 Appliance to a 2200 Appliance. This is because both appliances are Check Point products and have the same license type (Central License). You can transfer a license from one hardware device to another if they have the same license type and vendor. Therefore, the correct answer is A. From a 4400 Appliance to a 2200 Appliance.