CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 121:

  What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

  A. VPN Routing Mode
  B. Stateless Mode
  C. Stateful Mode
  D. Wire Mode
  B. Stateless Mode

• Question 122:

  Name the file that is an electronically signed file used by Check Point to translate the features in the license into a code?

  A. Both License (.lic) and Contract (.xml) files
  B. cp.macro
  C. Contract file (.xml)
  D. license File (.lic)
  B. cp.macro

  ---

  Explanation

  cp.macro is an electronically signed file used by Check Point to translate the features in the license into a code. It is located in the $FWDIR/conf directory on the Security Management Server. The cp.macro file contains a list of features and their corresponding codes, which are used to generate the license file (.lic) based on the contract file (.xml). The license file (.lic) is then installed on the Security Gateway or Security Management Server to activate the licensed features.

  References:

  Check Point R81 Licensing and Contract Administration Guide, page 10

• Question 123:

  Which command is used to display the current status of ClusterXL members?

  A. cphaprob stat
  B. cphaprob -a if
  C. fw ctl pstat
  D. cpstat ha
  A. cphaprob stat

  ---

  Explanation

  The command cphaprob stat is used to display the overall status of ClusterXL members, including whether each member is Active or Standby. It provides a quick overview of cluster health and failover status. The other commands either show interface details or general statistics, but not the full cluster state.

• Question 124:

  Which process is responsible for logging traffic on the Security Gateway?

  A. cpd
  B. fwd
  C. cpm
  D. fwm
  B. fwd

  ---

  Explanation

  The fwd (FireWall Daemon) process handles logging, policy installation, and communication between gateways and management servers. It is responsible for forwarding logs to the management server.

• Question 125:

  Which component is responsible for compiling and installing the security policy on a Security Gateway?

  A. cpd
  B. fwd
  C. fwm
  D. cpm
  C. fwm

  ---

  Explanation

  The fwm (FireWall Management) process is responsible for compiling and installing the security policy on the Security Gateway. It translates the policy into an enforceable format. The cpm process handles database operations, while cpd manages communication.

• Question 126:

  Which is the lowest gateway version supported by R81.20 management server?

  A. R77.30
  B. R80.20
  C. R77
  D. R65
  A. R77.30

• Question 127:

  What component of Management is used for indexing?

  A. fwm
  B. SOLR
  C. API Server
  D. DBSync
  B. SOLR

• Question 128:

  In order for changes made to policy to be enforced by a Security Gateway, what action must an administrator perform?

  A. Publish changes
  B. Save changes
  C. Install policy
  D. Install database
  C. Install policy

  ---

  Explanation

  In order for changes made to policy to be enforced by a Security Gateway, an administrator must perform the action of installing policy. Installing policy is the process of transferring the policy package from the

  Security Management Server to the Security Gateway. Publishing changes is the process of saving changes to the database and making them available to other administrators. Saving changes is the process of saving changes to a session without publishing them.

  References:

  Check Point R81 Security Management Guide

• Question 129:

  In which formats can Threat Emulation forensics reports be viewed in?

  A. TXT, XML and CSV
  B. PDF and TXT
  C. PDF, HTML, and XML
  D. PDF and HTML
  C. PDF, HTML, and XML

  ---

  Explanation

  The formats in which Threat Emulation forensics reports can be viewed in are PDF, HTML, and XML.

  Threat Emulation is a feature that detects and prevents zero-day attacks by emulating files in a sandbox environment and analyzing their behavior. Threat Emulation generates forensics reports that provide detailed information about the emulated files, such as verdict, severity, activity summary, screenshots, network activity, registry activity, file activity, and process activity.

  These reports can be viewed in PDF, HTML, or XML formats from SmartConsole or SmartView.

• Question 130:

  Which two Cluster Solutions are available under R81.20?

  A. ClusterXL and NSRP
  B. VRRPandHSRP
  C. VRRP and IP Clustering
  D. ClusterXL and VRitP
  D. ClusterXL and VRitP

  ---

  Explanation

  ClusterXL and VRRP are the two cluster solutions that are available under R81.20. According to the ClusterXL R81.20 Administration Guide, ClusterXL is a Check Point software-based clustering solution that provides high availability and load sharing for Check Point Security Gateways and Cluster Members.

  ClusterXL supports two modes: High Availability and Load Sharing. In High Availability mode, all Cluster Members are connected to the same network segment and share a virtual IP address. One member is active and handles all traffic, while the others are in standby mode and ready to take over in case of a failure. In Load Sharing mode, all Cluster Members are active and share the traffic load according to a predefined algorithm. ClusterXL supports both unicast and multicast modes for Load Sharing. VRRP (Virtual Router Redundancy Protocol) is an industry standard protocol that provides high availability for routers or firewalls by creating a virtual router with a virtual IP address that is shared by a group of routers or firewalls. One router or firewall is elected as the master and handles all traffic directed to the virtual IP address, while the others are backups that monitor the master and take over if it fails. VRRP can be used with Check Point Security Gateways to provide redundancy and failover for external interfaces. NSRP (NetScreen Redundancy Protocol) is a proprietary protocol developed by Juniper Networks that provides high availability and load balancing for NetScreen firewalls. NSRP is not supported by Check Point products2. HSRP (Hot Standby Router Protocol) is a Cisco proprietary protocol that provides high availability for routers by creating a virtual router with a virtual IP address that is shared by a group of routers. One router is elected as the active router and handles all traffic directed to the virtual IP address,

  while another router is elected as the standby router and monitors the active router and takes over if it fails.

  HSRP is not supported by Check Point products. IP Clustering is a feature of Linux Virtual Server (LVS) that provides high availability and load balancing for IP-based services by creating a cluster of real servers that are accessed through a virtual IP address. The cluster is managed by a director that routes requests to the real servers according to a scheduling algorithm. IP Clustering is not supported by Check Point products.

  References:

  ClusterXL R81.20 Administration Guide: Check Point R81.20: Solved: R81.20 - Check Point CheckMates:

  [Hot Standby Router Protocol - Wikipedia]: [Linux Virtual Server - Wikipedia]