CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 41:

  Choose what BEST describes users on Gaia Platform.

  A. There are two default users and neither can be deleted.
  B. There are two default users and one cannot be deleted.
  C. There is one default user that can be deleted.
  D. There is one default user that cannot be deleted.
  A. There are two default users and neither can be deleted.

  ---

  Explanation/Reference:

  There are two default users on Gaia Platform and neither can be deleted. The two default users are admin and monitor. The admin user has full access to the Gaia configuration and management tools, such as CLI and WebUI. The monitor user has read- only access to the Gaia configuration and management tools, and can only view the system status and settings. These two users cannot be deleted, but their passwords can be changed.References: [Gaia Administration Guide], [Gaia Overview]

• Question 42:

  Why is a Central License the preferred and recommended method of licensing?

  A. Central Licensing is actually not supported with Gaia.
  B. Central Licensing is the only option when deploying Gaia
  C. Central Licensing ties to the IP address of a gateway and can be changed to any gateway if needed.
  D. Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.
  D. Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.

  ---

  Explanation/Reference:

  Central License is the preferred and recommended method of licensing because it ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. Central License allows administrators to manage licenses for all Security Gateways from one central location. If the IP address of a gateway changes, the license remains valid as long as it is connected to the same management server. Central Licensing is supported with Gaia and is not the only option when deploying Gaia. Central Licensing does not tie to the IP address of a gateway and can not be changed to any gateway if needed.

  References:

  1: Rugged Appliances

  2: SmartUpdate

  3: Check Point Software Deployment Options : [Anti-Virus] : [Check Point Software Blades] : [Central License]

• Question 43:

  Which SmartConsole application shows correlated logs and aggregated data to provide an overview of potential threats and attack patterns?

  A. SmartEvent
  B. SmartView Tracker
  C. SmartLog
  D. SmartView Monitor
  A. SmartEvent

  ---

  Explanation/Reference:

  SmartEvent is a unified security management solution that provides real-time visibility into security events across the network. SmartEvent shows correlated logs and aggregated data to provide an overview of potential threats and attack patterns, as well as generate reports and alerts based on predefined or customized indicators. SmartView Tracker, SmartLog, and SmartView Monitor are other SmartConsole applications that can show logs, search queries, and network statistics respectively, but they do not provide the same level of correlation and analysis as SmartEvent. References: [Check Point R81 SmartEvent Administration Guide]

• Question 44:

  You have enabled "Extended Log" as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason?

  A. Identity Awareness is not enabled.
  B. Log Trimming is enabled.
  C. Logging has disk space issues
  D. Content Awareness is not enabled.
  D. Content Awareness is not enabled.

  ---

  Explanation/Reference:

  Extended Log is a tracking option that enables administrators to see additional information about the traffic that matches a security rule, such as data type, file name, file size, etc. However, to see any data type information, Content Awareness must be enabled on the Security Gateway. Content Awareness is a blade that inspects files based on their type, size, name, and data. Content Awareness is required for Extended Log to work properly. References: Check Point R81 Content Awareness Administration Guide

• Question 45:

  Identity Awareness allows the Security Administrator to configure network access based on which of the following?

  A. Name of the application, identity of the user, and identity of the machine
  B. Identity of the machine, username, and certificate
  C. Network location, identity of a user, and identity of a machine
  D. Browser-Based Authentication, identity of a user, and network location
  C. Network location, identity of a user, and identity of a machine

  ---

  Explanation/Reference:

  Identity Awareness allows the Security Administrator to configure network access based on network location, identity of a user, and identity of a machine. These are the three main identity sources that Identity Awareness supports. References: Identity Awareness R80.40 Administration Guide

• Question 46:

  A SAM rule Is implemented to provide what function or benefit?

  A. Allow security audits.
  B. Handle traffic as defined in the policy.
  C. Monitor sequence activity.
  D. Block suspicious activity.
  D. Block suspicious activity.

  ---

  Explanation/Reference:

  A SAM (Suspicious Activity Monitoring) rule is implemented to provide the function or benefit of blocking suspicious activity. A SAM rule is a rule that defines an action to be taken by the firewall when it detects a suspicious activity, such as an

  attack, a scan, or a policy violation. The action can be blocking, dropping, rejecting, or logging the traffic that triggered the suspicious activity. A SAM rule can be created manually or automatically by other security features, such as IPS, Anti-

  Bot, or SmartEvent.

  References: [SAM Rules], [Suspicious Activity Rules]

• Question 47:

  When using Monitored circuit VRRP, what is a priority delta?

  A. When an interface fails the priority changes to the priority delta
  B. When an interface fails the delta claims the priority
  C. When an interface fails the priority delta is subtracted from the priority
  D. When an interface fails the priority delta decides if the other interfaces takes over
  C. When an interface fails the priority delta is subtracted from the priority

  ---

  Explanation/Reference:

  When using Monitored circuit VRRP, the priority delta is the value that is subtracted from the priority of a cluster member when one of its monitored interfaces fails. For example, if the priority of a cluster member is 100 and the priority delta is 10, then when one of its monitored interfaces fails, its priority becomes 90. References: Check Point R81 ClusterXL Administration Guide

• Question 48:

  Fill in the blank: By default, the SIC certificates issued by R80 Management Server are based on the ____________ algorithm.

  A. SHA-256
  B. SHA-200
  C. MD5
  D. SHA-128
  A. SHA-256

  ---

  Explanation/Reference:

  By default, the SIC certificates issued by R80 Management Server are based on the SHA- 256 algorithm. SHA-256 is a secure hash algorithm that produces a 256-bit digest. SHA-200, MD5, and SHA-128 are not valid algorithms for SIC certificates. References: SHA-1 and SHA-256 certificates in Check Point Internal CA (ICA)

• Question 49:

  Fill in the blank: The_____is used to obtain identification and security information about network users.

  A. User index
  B. UserCheck
  C. User Directory
  D. User server
  C. User Directory

  ---

  Explanation/Reference:

  The User Directory is used to obtain identification and security information about network users. It can be integrated with external user databases such as LDAP, RADIUS, or TACACS+. References: Certified Security Administrator (CCSA) R81.20 Course Overview, page 9.

• Question 50:

  AdminA and AdminB are both logged in on SmartConsole What does it mean if AdmmB sees a lock icon on a rule? Choose the BEST answer.

  A. Rule is locked by AdminA and will be made available if the session is published
  B. Rule is locked by AdminA because the rule is currently being edited
  C. Rule is locked by AdminA and if the session is saved, the rule will be made available
  D. Rule is locked by AdminA because the save button has not been pressed
  A. Rule is locked by AdminA and will be made available if the session is published

  ---

  Explanation/Reference:

  If AdminB sees a lock icon on a rule, it means that the rule is locked by AdminA and will be made available if the session is published. A session is a set of changes made by an administrator in SmartConsole. A session can be published to

  save and share the changes with other administrators, or discarded to cancel the changes and unlock the objects.

  References:

  Check Point R81 Security Management Administration Guide, page 18.