CheckPoint Checkpoint Certifications 156-315.80 Questions & Answers

• Question 141:

  Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _____________ .

  A. TCP Port 18190

  B. TCP Port 18209

  C. TCP Port 19009

  D. TCP Port 18191

  Correct Answer: D

• Question 142:

  The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

  A. Secure Internal Communication (SIC)

  B. Restart Daemons if they fail

  C. Transfers messages between Firewall processes

  D. Pulls application monitoring status

  Correct Answer: D

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal? eventSubmit_doGoviewsolutiondetails=andsolutionid=sk97638

• Question 143:

  What is not a component of Check Point SandBlast?

  A. Threat Emulation

  B. Threat Simulator

  C. Threat Extraction

  D. Threat Cloud

  Correct Answer: B

• Question 144:

  Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

  A. UDP port 265

  B. TCP port 265

  C. UDP port 256 D. TCP port 256

  Correct Answer: D

  Synchronization works in two modes: Full Sync transfers all Security Gateway kernel table information from one cluster member to another. It is handled by the fwd daemon using an encrypted TCP connection on port 256. Delta Sync transfers changes in the kernel tables between cluster members. Delta sync is handled by the Security Gateway kernel using UDP connections on port 8116.

  Reference: https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/ CP_R80.10_ClusterXL_AdminGuide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/ CP_R80.10_ClusterXL_AdminGuide/7288

• Question 145:

  What Factor preclude Secure XL Templating?

  A. Source Port Ranges/Encrypted Connections

  B. IPS

  C. ClusterXL in load sharing Mode

  D. CoreXL

  Correct Answer: A

• Question 146:

  During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

  A. Host having a Critical event found by Threat Emulation

  B. Host having a Critical event found by IPS

  C. Host having a Critical event found by Antivirus

  D. Host having a Critical event found by Anti-Bot

  Correct Answer: D

• Question 147:

  In R80 spoofing is defined as a method of:

  A. Disguising an illegal IP address behind an authorized IP address through Port Address Translation.

  B. Hiding your firewall from unauthorized users.

  C. Detecting people using false or wrong authentication logins

  D. Making packets appear as if they come from an authorized IP address.

  Correct Answer: D

  IP spoofing replaces the untrusted source IP address with a fake, trusted one, to hijack connections to your network. Attackers use IP spoofing to send malware and bots to your protected network, to execute DoS attacks, or to gain unauthorized access.

  Reference: http://dl3.checkpoint.com/paid/74/74d596decb6071a4ee642fbdaae7238f/ CP_R80_SecurityManagement_AdminGuide.pdf? HashKey=1479584563_6f823c8ea1514609148aa4fec5425db2andxtn=.pdf

• Question 148:

  Connections to the Check Point R80 Web API use what protocol?

  A. HTTPS

  B. RPC

  C. VPN

  D. SIC

  Correct Answer: A

• Question 149:

  Which command lists all tables in Gaia?

  A. fw tab -t

  B. fw tab -list

  C. fw-tab -s

  D. fw tab -1

  Correct Answer: C

  Reference: http://dl3.checkpoint.com/paid/c7/c76b823d81bab77e1e40ac086fa81411/ CP_R77_versions_CLI_ReferenceGuide.pdf? HashKey=1538418170_96def40f213f24a8b273cc77b408dd3fandxtn=.pdf

• Question 150:

  What is true about the IPS-Blade?

  A. In R80, IPS is managed by the Threat Prevention Policy

  B. In R80, in the IPS Layer, the only three possible actions are Basic, Optimized and Strict

  C. In R80, IPS Exceptions cannot be attached to "all rules" D. In R80, the GeoPolicy Exceptions and the Threat Prevention Exceptions are the same

  Correct Answer: A