CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 61:

  Which of the following log queries would show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1?

  A. src:192.168.1.1 OR dst:172.26.1.1 AND action:Drop
  B. src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop
  C. 192.168.1.1 AND 172.26.1.1 AND drop
  D. 192.168.1.1 OR 172.26.1.1 AND action:Drop
  B. src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop

  ---

  Explanation/Reference:

  src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop is the correct log query to show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1. The AND operator means that all conditions must be true for the query to match. The OR operator means that any condition can be true for the query to match. The other queries will either show packets that are not dropped or packets that have different source or destination addresses.

• Question 62:

  When connected to the Check Point R80 Management Server using the SmartConsole the first administrator to connect has a lock on:

  A. Only the objects being modified in the Management Database and other administrators can connect to make changes using a special session as long as they all connect from the same LAN network.
  B. The entire Management Database and other administrators can connect to make changes only if the first administrator switches to Read-only.
  C. The entire Management Database and all sessions and other administrators can connect only as Read-only.
  D. Only the objects being modified in his session of the Management Database and other administrators can connect to make changes using different sessions.
  D. Only the objects being modified in his session of the Management Database and other administrators can connect to make changes using different sessions.

  ---

  Explanation/Reference:

  The answer is D because in R80 and above, the first administrator to connect to the Management Server using SmartConsole gets a lock on only the objects being modified in his session of the Management Database. Other administrators can connect to make changes using different sessions, but they cannot modify the same objects as the first administrator until he publishes his changes. This is called concurrent administration and it allows multiple administrators to work on the same policy package simultaneously References: Check Point R80.10 Concurrent Administration, Check Point R80.40 Security Management Administration Guide

• Question 63:

  What are valid authentication methods for mutual authenticating the VPN gateways?

  A. Pre-shared Secret and PKI Certificates
  B. PKI Certificates and Kerberos Tickets
  C. Pre-Shared Secrets and Kerberos Ticket
  D. PKI Certificates and DynamiciD OTP
  A. Pre-shared Secret and PKI Certificates

  ---

  Explanation/Reference:

  This answer is correct because these are two valid methods for mutually authenticating the VPN gateways, which means that both sides of the communication verify each other's identity using a shared secret or a public key certificate. A preshared secret is a password or a passphrase that both gateways know and use to encrypt and decrypt the VPN traffic. A PKI certificate is a digital document that contains the public key and other information that helps identify the gateway, such as the issuer, the subject, and the expiration date. The certificate is signed by a trusted certificate authority (CA) that vouches for the authenticity of the gateway. The other answers are not correct because they either include invalid or irrelevant methods for mutual authentication. PKI certificates and Kerberos tickets are not compatible methods for mutual authentication, because Kerberos tickets are issued by a Kerberos server and not by a CA. Pre-shared secrets and Kerberos tickets are also not compatible methods for mutual authentication, because they use different protocols and encryption algorithms. PKI certificates and DynamiciD OTP are not valid methods for mutual authentication, because DynamiciD OTP is a one-time password that is used for user authentication, not for gateway authentication.

  What is mutual authentication? | Two-way authentication Mutual authentication - AWS Client VPN VPN authentication options - Windows Security Mutual Authentication | Top 3 Methods of Mutual Authentication Authentication methods and features - Microsoft Entra

• Question 64:

  A stateful inspection firewall works by registering connection data and compiling this information. Where is the information stored?

  A. In the system SMEM memory pool.
  B. In State tables.
  C. In the Sessions table.
  D. In a CSV file on the firewall hard drive located in $FWDIR/conf/.
  B. In State tables.

  ---

  Explanation/Reference:

  A stateful inspection firewall works by registering connection data and compiling this information in state tables. State tables are data structures that store information about the state and context of each connection, such as source, destination, service, protocol, sequence number, flags, etc. State tables enable the firewall to inspect both the header and the payload of each packet and apply security policies accordingly.References: [Stateful Inspection], [State Tables]

• Question 65:

  DLP and Geo Policy are examples of what type of Policy?

  A. Inspection Policies
  B. Shared Policies
  C. Unified Policies
  D. Standard Policies
  B. Shared Policies

  ---

  Explanation/Reference:

  DLP and Geo Policy are examples of Shared Policies. Shared Policies are policies that can be shared with other policy packages to save time and effort when managing multiple gateways with similar security requirements. Shared Policies

  can be applied to Access Control, Threat Prevention, and HTTPS Inspection layers. Other types of policies include Inspection Policies, Unified Policies, and Standard Policies. References:

  [Check Point R81 Security Management Administration Guide], [Check Point R81 SmartConsole R81 Resolved Issues]

• Question 66:

  What is the purpose of a Stealth Rule?

  A. A rule used to hide a server's IP address from the outside world.
  B. A rule that allows administrators to access SmartDashboard from any device.
  C. To drop any traffic destined for the firewall that is not otherwise explicitly allowed.
  D. A rule at the end of your policy to drop any traffic that is not explicitly allowed.
  C. To drop any traffic destined for the firewall that is not otherwise explicitly allowed.

  ---

  Explanation/Reference:

  The purpose of a Stealth Rule is to drop any traffic destined for the firewall that is not otherwise explicitly allowed p. 32. A Stealth Rule is usually placed at the top of the rule base, before any other rule that allows traffic to the Security Gateway, p. 13. A Stealth Rule is not used to hide a server's IP address, to allow administrators to access SmartDashboard, or to drop any traffic that is not explicitly allowed. 156-315.81 Checkpoint Exam Info and Free Practice Test

• Question 67:

  Of all the Check Point components in your network, which one changes most often and should be backed up most frequently?

  A. SmartManager
  B. SmartConsole
  C. Security Gateway
  D. Security Management Server
  D. Security Management Server

  ---

  Explanation/Reference:

  The Security Management Server is the component that changes most often and should be backed up most frequently, because it stores all the security policies and configurations for the Check Point components in your network. The other components are either clients or gateways that do not change as frequently. References: Check Point Security Management Administration Guide R81, p. 9

• Question 68:

  Which of the following is NOT a valid configuration screen of an Access Role Object?

  A. Users
  B. Networks
  C. Time
  D. Machines
  C. Time

  ---

  Explanation/Reference:

  An Access Role Object has four configuration screens: Users, Machines, Networks, and Identity Tags, p. 27. Time is not a valid configuration screen of an Access Role Object.

• Question 69:

  What technologies are used to deny or permit network traffic?

  A. Stateful Inspection. Firewall Blade, and URL'Application Blade
  B. Packet Filtenng. Stateful Inspection, and Application Layer Firewall
  C. Firewall Blade. URL/Application Blade and IPS
  D. Stateful Inspection. URL/Application Blade, and Threat Prevention
  A. Stateful Inspection. Firewall Blade, and URL'Application Blade

  ---

  Explanation/Reference:

  The technologies that are used to deny or permit network traffic are Stateful Inspection, Firewall Blade, and URL/Application Blade. Stateful Inspection is a technology that inspects network traffic at the packet level and maintains the state and

  context of each connection. Firewall Blade is a software blade that enforces security policy and prevents unauthorized access to protected resources. URL/Application Blade is a software blade that enables administrators to control access to

  millions of websites and applications based on users, groups, and machines.

  References: Check Point R81 Security Gateway Administration Guide, page 9. : Check Point R81 Security Gateway Administration Guide, page 10. : Check Point R81 Security Gateway Administration Guide, page 12.

• Question 70:

  Which statement is NOT TRUE about Delta synchronization?

  A. Using UDP Multicast or Broadcast on port 8161
  B. Using UDP Multicast or Broadcast on port 8116
  C. Quicker than Full sync
  D. Transfers changes in the Kernel tables between cluster members
  A. Using UDP Multicast or Broadcast on port 8161

  ---

  Explanation/Reference:

  The statement that is not true about Delta synchronization is that it uses UDP Multicast or Broadcast on port 8161. The correct port number for Delta synchronization is 811612. The other statements are true about Delta synchronization. References: ClusterXL Administration Guide R81,