CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 131:

  Which command is used to obtain the configuration lock in Gaia?

  A. Lock database override
  B. Unlock database override
  C. Unlock database lock
  D. Lock database user
  A. Lock database override

  ---

  Explanation

  Which command is used to obtain the configuration lock in Gaia? The command that is used to obtain the configuration lock in Gaia is lock database override. This command allows a user to take over the configuration lock from another user who is currently logged in with read/write access. The other user will be forced to logout and will lose any unsaved changes. This command should be used with caution and only when necessary.

  References:

  Gaia Administration Guide R81, page 15.

• Question 132:

  Which of the following is NOT a component of Check Point Capsule?

  A. Capsule Workspace
  B. Capsule Enterprise
  C. CapsuleDocs
  D. Capsule Cloud
  B. Capsule Enterprise

• Question 133:

  At what point is the Internal Certificate Authority (ICA) created?

  A. Upon creation of a certificate.
  B. During the primary Security Management Server installation process.
  C. When an administrator decides to create one.
  D. When an administrator initially logs into SmartConsole.
  B. During the primary Security Management Server installation process.

  ---

  Explanation

  The Internal Certificate Authority (ICA) is created during the primary Security Management Server installation process. The ICA is responsible for issuing and managing certificates for all Check Point components in the network. The ICA is automatically installed as an integral part of the Security Management Server and can be managed from SmartConsole.

  References:

  Security Management Administration Guide, page 113.

• Question 134:

  True or False: In R81, more than one administrator can login to the Security Management Server with write permission at the same time.

  A. False, this feature has to be enabled in the Global Properties.
  B. True, every administrator works in a session that is independent of the other administrators.
  C. True, every administrator works on a different database that is independent of the other administrators.
  D. False, only one administrator can login with write permission.
  B. True, every administrator works in a session that is independent of the other administrators.

  ---

  Explanation

  In R81, more than one administrator can login to the Security Management Server with write permission at the same time. This feature is enabled by default and allows concurrent administration of the security policy. Every administrator works in a session that is independent of the other administrators. Changes made by one administrator are not visible to others until they are published. Administrators can also lock objects to prevent others from editing them until they are unlocked.

  Security Management Administration Guide, page 43.

• Question 135:

  Which of the following will NOT affect acceleration?

  A. Connections destined to or originated from the Security gateway
  B. A 5-tuple match
  C. Multicast packets
  D. Connections that have a Handler (ICMP, FTP, H.323, etc.)
  B. A 5-tuple match

  ---

  Explanation

  Check Point's SecureXL technology, which is responsible for acceleration, has certain limitations and conditions under which acceleration may not occur. In this context, the question is asking about factors that will NOT affect acceleration. Option B, "A 5-tuple match," will not affect acceleration. A 5-tuple match refers to the matching of source IP, source port, destination IP, destination port, and protocol. SecureXL can

  accelerate traffic that matches these criteria, but it's not a factor that hinders acceleration. Options A, C, and D can all affect acceleration:

  Option A mentions "Connections destined to or originated from the Security gateway," which implies that SecureXL acceleration can apply to these connections.

  Option C mentions "Multicast packets," and SecureXL may have limitations in handling multicast traffic efficiently.

  Option D mentions "Connections that have a Handler (ICMP, FTP, H.323, etc.)," and certain protocols (such as FTP) may require special handling and might not be fully accelerated by SecureXL.

  References:

  Check Point Certified Security Expert R81 Study Guide

• Question 136:

  Alice wants to upgrade the current security management machine from R80.40 to R81.20 and she wants to check the Deployment Agent status over the GAIA CLISH.

  Which of the following GAIACLISH command is true?

  A. show agent status
  B. show uninstaller status
  C. show installer packages
  D. show installer status
  D. show installer status

  ---

  Explanation

  The correct command for checking the Deployment Agent status over the GAIA CLISH is "show installer status". This command displays information about the Deployment Agent such as its version, status, last update time, and last operation result. The other commands are either invalid or irrelevant for this purpose.

  References:

  [Check Point Security Expert R81 Installation and Upgrade Guide], page 23.

• Question 137:

  Fill in the blank. Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is ________.

  A. Sent to the Internal Certificate Authority.
  B. Sent to the Security Administrator.
  C. Stored on the Security Management Server.
  D. Stored on the Certificate Revocation List.
  D. Stored on the Certificate Revocation List.

  ---

  Explanation

  Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is stored on the Certificate Revocation List (CRL). The CRL is a list of certificates that have been revoked by the Internal Certificate Authority (ICA) and are no longer valid for Secure Internal Communication (SIC). The CRL is signed by the ICA and issued to all the managed Security Gateways the next time a SIC connection is made. The CRL helps to prevent unauthorized access to the Security Management Server by revoked Security Gateways.

  References:

  1: How to renew SIC after changing IP Address of Security Management Server - Check Point Software, Solution ID: sk43784

  2: Check Point R81 Security Engineering Guide - Check Point Software, page 162

• Question 138:

  Alice knows about the Check Point Management HA installation from Bob and needs to know which Check Point Security Management Server is currently capable of issuing and managing certificate. Alice uses the Check Point command "cpconfig" to run the Check Point Security Management Server configuration tool on both Check Point Management HA instances "Primary & Secondary".

  Which configuration option does she need to look for?

  A. Certificate's Fingerprint
  B. Random Pool
  C. Certificate Authority
  D. CA Authority
  C. Certificate Authority

• Question 139:

  You notice that your firewall is under a DDoS attack and would like to enable the Penalty Box feature, which command you use?

  A. sim erdos -e 1
  B. sim erdos - m 1
  C. sim erdos -v 1
  D. sim erdos -x 1
  A. sim erdos -e 1

  ---

  Explanation

  The command that would be used to enable the Penalty Box feature is sim erdos -e 1. Penalty Box is a feature that protects the Security Gateway from DDoS attacks by dropping packets from sources that send excessive traffic. Sim erdos is a command that allows administrators to configure and manage the Penalty

  Box feature. Sim erdos -e 1 enables the Penalty Box feature on the Security Gateway. The other options are either invalid or perform different functions.

• Question 140:

  The VPN Link Selection will perform the following if the primary VPN link goes down?

  A. The Firewall will drop the packets.
  B. The Firewall can update the Link Selection entries to start using a different link for the same tunnel.
  C. The Firewall will send out the packet on all interfaces.
  D. The Firewall will inform the client that the tunnel is down.
  B. The Firewall can update the Link Selection entries to start using a different link for the same tunnel.

  ---

  Explanation

  VPN Link Selection is a feature that allows the Security Gateway to select the best link for each VPN tunnel based on the network topology and the Link Selection configuration. When the primary VPN link goes down, the Firewall can update the Link Selection entries to start using a different link for the same tunnel, as long as the remote peer supports this feature and has multiple IP addresses configured. This way, the VPN tunnel can be maintained without interruption or renegotiation. The other options are not correct because:

  Option A. The Firewall will not drop the packets, but will try to send them over another link if possible.

  Option C. The Firewall will not send out the packet on all interfaces, but will use the routing table to determine the best interface for each destination.

  Option D. The Firewall will not inform the client that the tunnel is down, but will try to keep the tunnel up by switching to another link.

  References:

  IPSec VPN - Link Selection, Outgoing VPN Link Selection on a gateway with multiple external interfaces