CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 101:

  As an administrator, you may be required to add the company logo to reports.

  To do this, you would save the logo as a PNG file with the name 'cover-company-logo.png' and then copy that image file to which directory on the SmartEvent server?

  A. SFWDIR/smartevent/conf
  B. $RTDIR/smartevent/conf
  C. $RTDIR/smartview/conf
  D. $FWDIR/smartview/conf
  C. $RTDIR/smartview/conf

  ---

  Explanation

  To add the company logo to reports, you would save the logo as a PNG file with the name 'cover- company-logo.png' and then copy that image file to the $RTDIR/smartview/conf directory on the SmartEvent server. The $RTDIR is an environment variable that points to the runtime directory of the SmartEvent server, which is usually /opt/CPrt-R81. The smartview/conf directory contains the configuration files for SmartView, which is a web-based interface for viewing reports and dashboards generated by

  SmartEvent.

  References:

  SmartEvent Administration Guide, SK120193 - How to add a company logo to SmartView reports

• Question 102:

  What is NOT a Cluster Mode?

  A. Load Sharing Unicast
  B. Load Sharing Multicast
  C. Active-Active
  D. High Availability Multicast
  C. Active-Active

  ---

  Explanation

  Active-Active is not a cluster mode. Active-Active is a cluster configuration where both members are active and handle traffic simultaneously. However, this configuration is only supported for VSX clusters, not for regular clusters. The cluster modes for regular clusters are High Availability (HA), Load Sharing Unicast, and Load Sharing Multicast.

  References:

  [Check Point Security Expert R81 ClusterXL Administration Guide], page 7.

• Question 103:

  Which SmartEvent component is responsible to collect the logs from different Log Servers?

  A. SmartEvent Database
  B. SmartEvent Collector
  C. SmartEvent Correlation Unit
  D. SmartEvent Server
  C. SmartEvent Correlation Unit

• Question 104:

  SandBlast appliances can be deployed in the following modes:

  A. using a SPAN port to receive a copy of the traffic only
  B. detect only
  C. inline/prevent or detect
  D. as a Mail Transfer Agent and as part of the traffic flow only
  C. inline/prevent or detect

  ---

  Explanation

  SandBlast appliances can be deployed in the following modes:

  Option C: Inline/prevent or detect SandBlast appliances can be deployed in an inline mode where they actively inspect and prevent or detect malicious traffic. In this mode, the appliance sits in the network traffic path and can take actions to block or detect threats in real-time.

  References:

  Check Point Certified Security Expert R81 Study Guide, Check Point documentation on SandBlast.

• Question 105:

  SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

  A. ping, traceroute, netstat, and route
  B. ping, nslookup, Telnet, and route
  C. ping, whois, nslookup, and Telnet
  D. ping, traceroute, netstat, and nslookup
  C. ping, whois, nslookup, and Telnet

  ---

  Explanation

  The default commands that appear when right-clicking the IP address, source or destination, in an event in SmartEvent are ping, whois, nslookup, and Telnet. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent has a feature that allows administrators to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event

  provides a list of default and customized commands that can be executed on the IP address of the active cell. The default commands are ping, whois, nslookup, and Telnet. Ping is a command that tests the connectivity and latency between two hosts by sending packets and measuring the response time. Whois is a command that queries a database for information about the owner and registrar of a domain name or an IP address. Nslookup is a command that queries a DNS server for information about a domain name or an IP address, such as its IP address, name server, mail server, etc. Telnet is a command that establishes a remote connection to another host using the Telnet protocol.

• Question 106:

  To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was dropped, what would be the query syntax?

  A. blada: application control AND action:drop
  B. blade."application control AND action;drop
  C. (blade: application control AND action;drop)
  D. blade;"application control AND action:drop
  D. blade;"application control AND action:drop

  ---

  Explanation

  The correct query syntax to find records in the logs that show log records from the Application & URL Filtering Software Blade where traffic was dropped is blade;"application control AND action:drop". This query uses quotation marks to enclose the values of the blade and action fields, and uses a colon to separate the field name from the value. The query also uses AND to combine two conditions that must be met for a log record to match.

  References:

  [Searching Logs]

• Question 107:

  You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _______ or _______ action for the file types.

  A. Inspect/Bypass
  B. Inspect/Prevent
  C. Prevent/Bypass
  D. Detect/Bypass
  A. Inspect/Bypass

  ---

  Explanation

  You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines an Inspect or Bypass action for the file types. The Inspect action means that the file will be sent to the Threat Emulation engine for analysis, and the Bypass action means that the file will not be sent and will be allowed or blocked based on other Threat Prevention blades. The other options are not valid actions for file types in Threat Prevention profiles.

  References:

  Check Point R81 Threat Prevention Administration Guide

• Question 108:

  What are the steps to configure the HTTPS Inspection Policy?

  A. Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard
  B. Go to Application&url filtering blade > Advanced > Https Inspection > Policy
  C. Go to Manage&Settings > Blades > HTTPS Inspection > Policy
  D. Go to Application&url filtering blade > Https Inspection > Policy
  A. Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard

  ---

  Explanation

  The correct steps to configure the HTTPS Inspection Policy in Check Point R81 are as follows:

  Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard. Enable HTTPS Inspection and select the Policy tab. Create a new HTTPS Inspection Layer or edit an existing one. Define the rules for inspecting HTTPS traffic based on the source, destination, service, and action. Install the policy on the relevant gateways. The other options are incorrect because they either use wrong blade names, wrong menu options, or wrong configuration steps.

  References:

  1: LAB:25 How to Configure HTTPS Inspection in Check Point Firewall R81 (https://www.youtube.com/watch?v=NCvV7-R9ZgU)

• Question 109:

  Bob needs to know if Alice was configuring the new virtual cluster interface correctly.

  Which of the following Check Point commands is true?

  A. cphaprob-aif
  B. cp hap rob state
  C. cphaprob list
  D. probcpha -a if
  A. cphaprob-aif

  ---

  Explanation

  You can use the cphaprob -a if command to check the status of the virtual cluster interface. This command displays the state, virtual IP address, and physical IP address of each cluster interface. It also shows the load balancing method, the load on each interface, and the active member for each interface. This command can help you verify that Alice configured the virtual cluster interface correctly and that it is

  working properly. To run this command, you need to access the cluster member in Clish and run cphaprob

  -a if.

  How to configure ClusterXL in Load Sharing Unicast mode - Check Point Software, cphaprob -a if - Check Point Software

• Question 110:

  If there are two administrators logged in at the same time to SmartConsole, and there are objects locked for editing, what must be done to make them available to other administrators?

  A. Publish or discard the session.
  B. Revert the session.
  C. Save and install the Policy.
  D. Delete older versions of database.
  A. Publish or discard the session.

  ---

  Explanation

  The only way to make objects locked for editing available for other administrators is to publish or discard the session that contains the changes. Publishing the session will save and share the changes with other administrators, while discarding the session will undo and discard the changes. Saving the session will only save the changes locally, but not share them with others or release the locks. Reverting the session will restore a previous version of the session, but not affect the locks. Saving and installing the policy will only install the policy on the gateways, but not share or discard the changes in SmartConsole. Deleting

  older versions of database will only free up disk space, but not affect the locks.