CheckPoint 156-215.81 Online Practice Questions and Exam Preparation

CheckPoint 156-215.81 Online Questions & Answers

• Question 81:

  Check Point ClusterXL Active/Active deployment is used when:

  A. Only when there is Multicast solution set up
  B. There is Load Sharing solution set up
  C. Only when there is Unicast solution set up
  D. There is High Availability solution set up
  B. There is Load Sharing solution set up

  ---

  Explanation/Reference:

  Check Point ClusterXL Active/Active deployment is used when there is Load Sharing solution set up. Load Sharing enables multiple Security Gateways to share traffic and provide high availability. References: Check Point R81, Check Point R81 ClusterXL Administration Guide

• Question 82:

  An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server (SMS). While configuring the VPN community to specify the pre-shared secret, the administrator did not find a box to input the pre-shared secret. Why does it not allow him to specify the pre-shared secret?

  A. The Gateway is an SMB device
  B. The checkbox "Use only Shared Secret for all external members" is not checked
  C. Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS
  D. Pre-shared secret is already configured in Global Properties
  C. Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS

  ---

  Explanation/Reference:

  Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS. This is because certificate based authentication provides stronger security and easier management than pre-shared secret authentication. The other options are either incorrect or irrelevant for this scenario. References: [Check Point R80.10 - Part 6 - Certificate Based Authentication]

• Question 83:

  With URL Filtering, what portion of the traffic is sent to the Check Point Online Web Service for analysis?

  A. The complete communication is sent for inspection.
  B. The IP address of the source machine.
  C. The end user credentials.
  D. The host portion of the URL.
  D. The host portion of the URL.

  ---

  Explanation/Reference:

  With URL Filtering, only the host portion of the URL is sent to the Check Point Online Web Service for analysis. The host portion is the part of the URL that identifies the web server, such as www.example.com. The Check Point Online Web Service uses this information to categorize the URL and return the appropriate action to the Security Gateway. The other options are not sent to the Check Point Online Web Service for analysis, as they may contain sensitive or irrelevant data.

• Question 84:

  The competition between stateful inspection and proxies was based on performance, protocol support, and security. Considering stateful Inspections and Proxies, which statement is correct?

  A. Stateful Inspection is limited to Layer 3 visibility, with no Layer 4 to Layer 7 visibility capabilities.
  B. When it comes to performance, proxies were significantly faster than stateful inspection firewalls.
  C. Proxies offer far more security because of being able to give visibility of the payload (the data).
  D. When it comes to performance, stateful inspection was significantly faster than proxies.
  D. When it comes to performance, stateful inspection was significantly faster than proxies.

  ---

  Explanation/Reference:

  Stateful Inspection and Proxies are two different technologies for implementing firewall security. Stateful Inspection is a technique that inspects packets at the network layer and maintains a state table that tracks the status of each connection. Proxies are applications that act as intermediaries between clients and servers, and inspect packets at the application layer. The competition between stateful inspection and proxies was based on performance, protocol support, and security. When it comes to performance, stateful inspection was significantly faster than proxies, because it did not have to process the payload of each packet and could handle more concurrent connections1. References: Check Point R81 Security Gateway Technical Administration Guide

• Question 85:

  What is the default tracking option of a rule?

  A. Tracking
  B. Log
  C. None
  D. Alert
  B. Log

  ---

  Explanation/Reference:

  The default tracking option of a rule is Log. This means that the Security Gateway will generate a log entry for every connection that matches the rule. The log entry will contain information such as source, destination, service, action, and time. Other tracking options include None, Alert, Mail, SNMP Trap, User Alert, and Accounting. References: Check Point R81 Firewall Administration Guide

• Question 86:

  When changes are made to a Rule base, it is important to _______________ to enforce changes.

  A. Publish database
  B. Activate policy
  C. Install policy
  D. Save changes
  A. Publish database

  ---

  Explanation/Reference:

  When changes are made to a Rule base, it is important to Publish database to enforce changes. Publishing database saves the changes to the database and makes them available to other administrators. Installing policy applies the changes to the Security Gateways. References: Check Point R81 Security Management Administration Guide, [Check Point R81 SmartConsole R81 Resolved Issues], [Check Point R81 Firewall Administration Guide]

• Question 87:

  What are the advantages of a "shared policy" in R80?

  A. Allows the administrator to share a policy between all the users identified by the Security Gateway
  B. Allows the administrator to share a policy between all the administrators managing the Security Management Server
  C. Allows the administrator to share a policy so that it is available to use in another Policy Package
  D. Allows the administrator to install a policy on one Security Gateway and it gets installed on another managed Security Gateway
  C. Allows the administrator to share a policy so that it is available to use in another Policy Package

  ---

  Explanation/Reference:

  A shared policy is a set of rules that can be used in multiple policy packages. It allows the administrator to create a common security policy for different gateways or domains, and avoid duplication and inconsistency. The other options are not advantages of a shared policy. References: [Shared Policies Overview], [Shared Policies Best Practices]

• Question 88:

  To increase security, the administrator has modified the Core protection `Host Port Scan' from `Medium' to `High' Predefined Sensitivity. Which Policy should the administrator install after Publishing the changes?

  A. The Access Control and Threat Prevention Policies.
  B. The Access Control Policy.
  C. The Access Control and HTTPS Inspection Policy.
  D. The Threat Prevention Policy.
  D. The Threat Prevention Policy.

  ---

  Explanation/Reference:

  To increase security, the administrator has modified the Core protection `Host Port Scan' from `Medium' to `High' Predefined Sensitivity. The administrator should install the Threat Prevention Policy after Publishing the changes. The Threat Prevention Policy defines how the Security Gateway inspects and protects against threats such as port scans, bot attacks, and zero-day exploits. References: Check Point R81 Firewall Administration Guide, Check Point R81 Threat Prevention Administration Guide

• Question 89:

  To view the policy installation history for each gateway, which tool would an administrator use?

  A. Revisions
  B. Gateway installations
  C. Installation history
  D. Gateway history
  C. Installation history

  ---

  Explanation/Reference:

  To view the policy installation history for each gateway, an administrator would use the Installation history tool, p. 22. The Installation history tool shows the date and time of each policy installation, the name of the administrator who installed it, and the status of the installation. Revisions, Gateway installations, and Gateway history are not valid tools in SmartConsole. , Check Point SmartConsole R81 Help

• Question 90:

  What data MUST be supplied to the SmartConsole System Restore window to restore a backup?

  A. Server, Username, Password, Path, Version
  B. Username, Password, Path, Version
  C. Server, Protocol, Username, Password, Destination Path
  D. Server, Protocol, Username, Password, Path
  D. Server, Protocol, Username, Password, Path

  ---

  Explanation/Reference:

  According to the Check Point R81.10 SmartConsole for Windows, to restore a backup, you need to supply the following data: Server, Protocol, Username, Password, and Path. The Server is the IP address or hostname of the Security Management Server. The Protocol is either SCP or SFTP. The Username and Password are the credentials for the Security Management Server. The Path is the location of the backup file on the Security Management Server. References: Check Point R81.10 SmartConsole for Windows