CheckPoint Checkpoint Certifications 156-315.80 Questions & Answers

• Question 381:

  Which of the following is NOT an attribute of packet acceleration?

  A. Source address

  B. Protocol

  C. Destination port

  D. VLAN tag

  Correct Answer: D

  Connections are identified by the 5 tuple attributes: source address, destination address, source port, destination port, protocol. When the packets in a connection match all the 5 tuple attributes, the traffic flow can be processed on the accelerated path.

• Question 382:

  Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

  A. Run cprestart from clish

  B. After upgrading the hardware, increase the number of kernel instances using cpconfig

  C. Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores

  D. Hyperthreading must be enabled in the bios to use CoreXL

  Correct Answer: B

• Question 383:

  Installations and upgrades with CPUSE require that the CPUSE agent is up-to-date. Usually the latest build is downloaded automatically. How can you verify the CPUSE agent build?

  A. In WebUI Status and Actions page or by running the following command in CLISH: show installer status build

  B. In WebUI Status and Actions page or by running the following command in CLISH: show installer status version

  C. In the Management Server or Gateway object in SmartConsole or by running the following command in CLISH: show installer status build

  D. In the Management Server or Gateway object in SmartConsole or by running the following command in CLISH: show installer agent

  Correct Answer: A

• Question 384:

  When configuring SmartEvent Initial settings, you must specify a basic topology to SmartEvent to help it calculate traffic direction for events. What is this setting called, and what are you defining?

  A. Network; and defining your Class A space

  B. Topology; and you are defining the Internal network

  C. Internal addresses; you are defining the gateways

  D. Internal network(s); you are defining your networks

  Correct Answer: D

  Reference: https://dl3.checkpoint.com/paid/2f/2f4753f046ea4ee91155a7b7510d8e76/ CP_R77_SmartEvent_AdminGuide.pdf? HashKey=1582055588_10a30c668c8356dd47b6e6fa6305c6b4andxtn=.pdf

• Question 385:

  Steve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances. Steve's manager, Diana, asks him to provide firewall connection table details from one of the firewalls for which he is responsible. Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

  A. fw tab -t connections -s

  B. fw tab -t connections

  C. fw tab -t connections -c

  D. fw tab -t connections -f

  Correct Answer: D

  Reference: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/ CP_R80.30_CLI_ReferenceGuide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/ CP_R80.30_CLI_ReferenceGuide/208178

• Question 386:

  Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?

  A. fwm

  B. cpd

  C. cpwd

  D. cpm

  Correct Answer: C

  Reference: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/ CP_R80.30_CLI_ReferenceGuide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/ CP_R80.30_CLI_ReferenceGuide/204910

• Question 387:

  What is considered Hybrid Emulation Mode?

  A. Manual configuration of file types on emulation location.

  B. Load sharing of emulation between an on premise appliance and the cloud.

  C. Load sharing between OS behavior and CPU Level emulation.

  D. Load Sharing of Threat Emulation Server and Firewall blade

  Correct Answer: B

• Question 388:

  You have pushed policy to GW-3 and now cannot pass traffic through the gateway. As a last resort, to restore traffic flow, what command would you run to remove the latest policy from GW-3?

  A. fw unloadlocal

  B. fw unloadpolicy

  C. fwm unload local

  D. fwm unload policy

  Correct Answer: A

• Question 389:

  If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsive, which if these steps should NOT be performed:

  A. Rename the hostname of the Standby member to match exactly the hostname of the Active member.

  B. Change the Standby Security Management Server to Active.

  C. Change the Active Security Management Server to Standby.

  D. Manually synchronize the Active and Standby Security Management Servers.

  Correct Answer: A

• Question 390:

  The Log server sends what to the Correlation Unit?

  A. Authentication requests

  B. CPMI dbsync

  C. Logs

  D. Event Policy

  Correct Answer: C