CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 91:

  Which of the following is NOT an attribute of packet acceleration?

  A. Source address
  B. Protocol
  C. Destination port
  D. VLAN Tag
  D. VLAN Tag

  ---

  Explanation

  VLAN Tag is not an attribute of packet acceleration. Packet acceleration is a feature of SecureXL that allows certain packets to bypass the Firewall kernel and be processed by a more efficient mechanism.

  Packet acceleration is based on templates that match packets based on four attributes: Source IP address, Destination IP address, Protocol, and Destination port. If a packet matches an existing template, it is accelerated; otherwise, it is sent to the Firewall path for inspection.

  References:

  [SecureXL Mechanism]

• Question 92:

  Which command is used to add users to or from existing roles?

  A. Add rba user <User Name> roles <List>
  B. Add rba user <User Name>
  C. Add user <User Name> roles <List>
  D. Add user <User Name>
  A. Add rba user <User Name> roles <List>

  ---

  Explanation

  The command to add users to or from existing roles is add rba user <User Name> roles <List>. This command allows you to assign one or more roles to a user in the Gaia database. Roles are collections of permissions that define what actions a user can perform on the system. You can use predefined roles or create your own custom roles. To remove a role from a user, you can use the command delete rba user

  <User Name> roles <List>.

• Question 93:

  From SecureXL perspective, what are the three paths of traffic flow:

  A. Initial Path; Medium Path; Accelerated Path
  B. Firewall Path; Accept Path; Drop Path
  C. Layer Path; Blade Path; Rule Path
  D. Firewall Path; Accelerated Path; Medium Path
  D. Firewall Path; Accelerated Path; Medium Path

• Question 94:

  Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port.

  Which CLISH commands are required to be able to change this TCP port?

  

  A. set web ssl-port <new port number>
  B. set Gaia-portal port <new port number>
  C. set Gaia-portal https-port <new port number>
  D. set web https-port <new port number>
  A. set web ssl-port <new port number>

  ---

  Explanation

  The CLISH command to change the default Gaia WebUI Portal port number is set web ssl-port <new port number>. This command will change the port that the WebUI listens on for HTTPS connections. After

  changing the port, you need to save the configuration with save config and verify that the change was applied with show web ssl-port. You also need to update the Main URL in the Platform Portal section of the gateway object in SmartConsole and install the policy.

• Question 95:

  How can you grant GAiAAPI Permissions for a newly created user?

  A. Assign the user a permission profile in SmartConsole
  B. Assign the user the admin RBAC role in dish
  C. No need to grant access since every user has access by default.
  D. In bash, use the following command: "gaia_api access --user Tom -enable true"
  A. Assign the user a permission profile in SmartConsole

  ---

  Explanation

  To grant GAiAAPI permissions for a newly created user, you need to assign the user a permission profile in SmartConsole. A permission profile defines the access level and scope of actions that a user can perform using the GAiAAPI. You can choose from predefined permission profiles or create your own custom profiles. You cannot grant GAiAAPI permissions using dish or bash commands.

  References:

  [Check Point Security Expert R81 API Reference Guide], page 9.

• Question 96:

  Which command displays interface status in a cluster?

  A. cphaprob stat
  B. cphaprob -a if
  C. cpstat net
  D. ifconfig
  B. cphaprob -a if

  ---

  Explanation

  The command cphaprob -a if shows interface status, including state and synchronization details.

• Question 97:

  Which statement is true regarding redundancy?

  A. System Administrators know when their cluster has failed over and can also see why it failed over by using the cphaprob -f if command.
  B. ClusterXL offers three different Load Sharing solutions: Unicast, Broadcast, and Multicast.
  C. Machines in a ClusterXL High Availability configuration must be synchronized.
  D. Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments.
  D. Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments.

  ---

  Explanation

  The statement that is true regarding redundancy is Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments. ClusterXL and VRRP are two technologies that provide high availability and load sharing for Security Gateways. They are both supported by Gaia OS and can be deployed on various platforms 5. The other statements are either false or incomplete regarding redundancy.

  References:

  Check Point R81 ClusterXL Administration Guide, Check Point R81 Gaia Administration Guide

• Question 98:

  Which of the following is an authentication method used for Identity Awareness?

  A. RSA
  B. SSL
  C. Captive Portal
  D. PKI
  C. Captive Portal

  ---

  Explanation

  Captive Portal is one of the authentication methods used for Identity Awareness, which is a feature of Check Point that enables you to identify users and apply security policy rules based on their identity.

  Captive Portal redirects users to a web page where they can enter their credentials and be authenticated by an external server, such as LDAP or RADIUS. After authentication, users can access the Internet and corporate resources according to the security policy rules that apply to their identity.

  References:

  Machine Authentication & Identity Awareness - Check Point CheckMates Check Point Certified Security Expert R81.20, slide 13 Check Point R81 Identity Awareness Administration Guide, page 9

• Question 99:

  In R81 spoofing is defined as a method of:

  A. Disguising an illegal IP address behind an authorized IP address through Port Address Translation.
  B. Hiding your firewall from unauthorized users.
  C. Detecting people using false or wrong authentication logins
  D. Making packets appear as if they come from an authorized IP address.
  D. Making packets appear as if they come from an authorized IP address.

  ---

  Explanation

  In R81, spoofing is defined as a method of making packets appear as if they come from an authorized IP address. Spoofing can be used by attackers to bypass security policies or hide their identity. Check Point firewalls use anti-spoofing mechanisms to prevent spoofed packets from entering or leaving the network.

  References:

  Security Gateway R81 Administration Guide

• Question 100:

  Which command displays SecureXL acceleration statistics?

  A. fw ctl stat
  B. fwaccel stat
  C. fw ctl multik stat
  D. cpstat fw
  B. fwaccel stat

  ---

  Explanation

  The fwaccel stat command shows the status and statistics of SecureXL acceleration, including whether acceleration is enabled and how traffic is being handled. This is essential for performance troubleshooting.