CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 381:

  What is a reason for manual creation of a NAT rule?

  A. In R80 all Network Address Translation is done automatically and there is no need for manually defined NAT-rules.
  B. Network Address Translation of RFC1918-compliant networks is needed to access the Internet.
  C. Network Address Translation is desired for some services, but not for others.
  D. The public IP-address is different from the gateway's external IP
  D. The public IP-address is different from the gateway's external IP

  ---

  Explanation/Reference:

  A reason for manual creation of a NAT rule is when the public IP-address is different from the gateway's external IP. This can happen when the gateway is behind another NAT device or firewall . References: Check Point R81 Security Gateway Administration Guide,

• Question 382:

  When logging in for the first time to a Security management Server through SmartConsole, a fingerprint is saved to the:

  A. Security Management Server's /home/.fgpt file and is available for future SmartConsole authentications.
  B. Windows registry is available for future Security Management Server authentications.
  C. There is no memory used for saving a fingerprint anyway.
  D. SmartConsole cache is available for future Security Management Server authentications.
  D. SmartConsole cache is available for future Security Management Server authentications.

  ---

  Explanation/Reference:

  When logging in for the first time to a Security Management Server through SmartConsole, a fingerprint is saved to the SmartConsole cache and is available for future Security Management Server authentications. The fingerprint is a unique identifier of the Security Management Server that is used to verify its identity and prevent man-in-the- middle attacks. The SmartConsole cache is a local folder on the client machine that stores temporary files and settings. References: Check Point Security Management Administration Guide R81, p. 25-26

• Question 383:

  When an encrypted packet is decrypted, where does this happen?

  A. Security policy
  B. Inbound chain
  C. Outbound chain
  D. Decryption is not supported
  A. Security policy

  ---

  Explanation/Reference:

  When an encrypted packet is decrypted, this happens in the security policy. The security policy is a set of rules that defines how the Security Gateway inspects and secures traffic. The security policy includes VPN rules that specify which traffic should be encrypted or decrypted. The inbound and outbound chains are part of the inspection framework that processes packets according to the security policy. References: Check Point R81 VPN Administration Guide

• Question 384:

  Fill in the blank: SmartConsole, SmartEvent GUI client, and ___________ allow viewing of billions of consolidated logs and shows them as prioritized security events.

  A. SmartView Web Application
  B. SmartTracker
  C. SmartMonitor
  D. SmartReporter
  A. SmartView Web Application

  ---

  Explanation/Reference:

  SmartConsole, SmartEvent GUI client, and SmartView Web Application allow viewing of billions of consolidated logs and shows them as prioritized security events. SmartView Web Application is a web-based interface that provides access to SmartEvent reports and dashboards. References: Check Point R81 Security Management Administration Guide, Check Point R81 SmartEvent Administration Guide

• Question 385:

  The Network Operations Center administrator needs access to Check Point Security devices mostly for troubleshooting purposes. You do not want to give her access to the expert mode, but she still should be able to run tcpdump. How can you achieve this requirement?

  A. Add tcpdump to CLISH using add command.Create a new access role.Add tcpdump to the role.Create new user with any UID and assign role to the user.
  B. Add tcpdump to CLISH using add command.Create a new access role.Add tcpdump to the role.Create new user with UID 0 and assign role to the user.
  C. Create a new access role.Add expert-mode access to the role.Create new user with UID 0 and assign role to the user.
  D. Create a new access role.Add expert-mode access to the role.Create new user with any UID and assign role to the user.
  A. Add tcpdump to CLISH using add command.Create a new access role.Add tcpdump to the role.Create new user with any UID and assign role to the user.

  ---

  Explanation/Reference:

  To achieve the requirement of giving the Network Operations Center administrator access to Check Point Security devices mostly for troubleshooting purposes, but not to the expert mode, and still allowing her to run tcpdump, you need to: Add tcpdump to CLISH using add command. This command adds a new command to the Command Line Interface Shell (CLISH) that allows running tcpdump without entering the expert mode . Create a new access role. This option defines a set of permissions and commands that can be assigned to a user or a group of users. Add tcpdump to the role. This option grants the permission to run tcpdump to the role. Create new user with any UID and assign role to the user. This option creates a new user account with any User ID (UID) and assigns the role that has tcpdump permission to the user. References: [How to add a new command to CLISH], [Check Point R81 Gaia Administration Guide], [Check Point R81 Identity Awareness Administration Guide]

• Question 386:

  Which one of the following is a way that the objects can be manipulated using the new API integration in R80 Management?

  A. Microsoft Publisher
  B. JSON
  C. Microsoft Word
  D. RC4 Encryption
  B. JSON

  ---

  Explanation/Reference:

  The way that the objects can be manipulated using the new API integration in R80 Management is JSON. JSON (JavaScript Object Notation) is a lightweight data-interchange format that is easy for humans and machines to read and write. The R80 Management API uses JSON as the primary data format for requests and responses. Therefore, the correct answer is B. JSON.

• Question 387:

  What are the three components for Check Point Capsule?

  A. Capsule Docs, Capsule Cloud, Capsule Connect
  B. Capsule Workspace, Capsule Cloud, Capsule Connect
  C. Capsule Workspace, Capsule Docs, Capsule Connect
  D. Capsule Workspace, Capsule Docs, Capsule Cloud
  D. Capsule Workspace, Capsule Docs, Capsule Cloud

  ---

  Explanation/Reference:

  The three components for Check Point Capsule are Capsule Workspace, Capsule Docs, and Capsule Cloud. Capsule Workspace provides a secure container on the mobile device that isolates business data and applications from personal data and applications2. Capsule Docs protects business documents everywhere they go with encryption and access control. Capsule Cloud provides cloud-based security services to protect mobile users from threats. References: Check Point Capsule, Check Point Capsule Workspace, Mobile Secure Workspace with Capsule

• Question 388:

  What is the main objective when using Application Control?

  A. To filter out specific content.
  B. To assist the firewall blade with handling traffic.
  C. To see what users are doing.
  D. Ensure security and privacy of information.
  D. Ensure security and privacy of information.

  ---

  Explanation/Reference:

  The main objective when using Application Control is to ensure security and privacy of information. Application Control enables administrators to control access to web applications and web sites based on risk level, user identity, and other criteria. It also provides visibility into web usage and application activity. References: Check Point R81 Application Control Administration Guide

• Question 389:

  When URL Filtering is set, what identifying data gets sent to the Check Point Online Web Service?

  A. The URL and server certificate are sent to the Check Point Online Web Service
  B. The full URL, including page data, is sent to the Check Point Online Web Service
  C. The host part of the URL is sent to the Check Point Online Web Service
  D. The URL and IP address are sent to the Check Point Online Web Service
  C. The host part of the URL is sent to the Check Point Online Web Service

  ---

  Explanation/Reference:

  When URL Filtering is set, only the host part of the URL is sent to the Check Point Online Web Service for analysis. The host part is the part of the URL that identifies the web server, such as www.example.com. The Check Point Online Web

  Service uses this information to categorize the URL and return the appropriate action to the Security Gateway. The other options are not sent to the Check Point Online Web Service for analysis, as they may contain sensitive or irrelevant

  data.

  References:

  1: Policy Layers

  2: Adding a New Log Server

  3: Suspicious Activity Monitoring : [URL Filtering]

• Question 390:

  Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use which operating system?

  A. Centos Linux
  B. Gaia embedded
  C. Gaia
  D. Red Hat Enterprise Linux version 5
  B. Gaia embedded

  ---

  Explanation/Reference:

  Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use Gaia embedded as the operating system. Gaia embedded is a lightweight version of Gaia that is designed for small and medium businesses. Centos Linux, Gaia, and Red Hat Enterprise Linux version 5 are not the operating systems used by Rugged appliances.