CheckPoint 156-315.80 Online Practice Questions and Exam Preparation

CheckPoint 156-315.80 Online Questions & Answers

• Question 461:

  CoreXL is supported when one of the following features is enabled:

  A. Route-based VPN
  B. IPS
  C. IPv6
  D. Overlapping NAT
  B. IPS

  ---

  CoreXL does not support Check Point Suite with these features:

  1.

  Check Point QoS (Quality of Service)

  2.

  Route-based VPN

  3.

  IPv6 on IPSO

  4.

  Overlapping NAT Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_PerformanceTuning_WebAdmin/6731.htm

• Question 462:

  Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

  A. ffffffff
  B. 00000001
  C. 00000002
  D. 00000003
  B. 00000001

• Question 463:

  Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

  A. All Connections (Clear or Encrypted)
  B. Accept all encrypted traffic
  C. Specific VPN Communities
  D. All Site-to-Site VPN Communities
  B. Accept all encrypted traffic

• Question 464:

  Which one of the following is true about Threat Emulation?

  A. Takes less than a second to complete
  B. Works on MS Office and PDF files only
  C. Always delivers a file
  D. Takes minutes to complete (less than 3 minutes)
  D. Takes minutes to complete (less than 3 minutes)

• Question 465:

  To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?

  A. Accept Template
  B. Deny Template
  C. Drop Template
  D. NAT Template
  B. Deny Template

  ---

  Reference: https://community.checkpoint.com/thread/7894-nat-templates-securexl

• Question 466:

  SmartEvent uses it's event policy to identify events. How can this be customized?

  A. By modifying the firewall rulebase
  B. By creating event candidates
  C. By matching logs against exclusions
  D. By matching logs against event rules
  D. By matching logs against event rules

• Question 467:

  What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

  A. Stateful Mode
  B. VPN Routing Mode
  C. Wire Mode
  D. Stateless Mode
  C. Wire Mode

  ---

  Wire Mode is a VPN-1 NGX feature that enables VPN connections to successfully fail over, bypassing Security Gateway enforcement. This improves performance and reduces downtime. Based on a trusted source and destination, Wire Mode uses internal interfaces and VPN Communities to maintain a private and secure VPN session, without employing Stateful Inspection. Since Stateful Inspection no longer takes place, dynamic-routing protocols that do not survive state verification in non-Wire Mode configurations can now be deployed. The VPN connection is no different from any other connections along a dedicated wire, thus the meaning of "Wire Mode".

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk30974

• Question 468:

  In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

  A. Security Policies
  B. Logs and Monitor
  C. Manage and Settings
  D. Gateways and Servers
  C. Manage and Settings

• Question 469:

  Which component is NOT required to communicate with the Web Services API?

  A. API key
  B. session ID token
  C. content-type
  D. Request payload
  A. API key

• Question 470:

  You need to change the MAC-address on eth2 interface of the gateway. What is the correct way to change MAC-address in Check Point Gaia?

  A. In CLISH run: set interface eth2 mac-addr 11:11:11:11:11:11
  B. In expert-mode run ifconfig eth1 hw 11:11:11:11 11 11
  C. In CLISH run set interface eth2 hw-addr 11 11 11:11:11 11
  D. In expert-mode run: ethtool -4 eth2 mac 11 11:11:11:11:11
  A. In CLISH run: set interface eth2 mac-addr 11:11:11:11:11:11