CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 161:

  You have successfully backed up Check Point configurations without the OS information.

  What command would you use to restore this backup?

  A. restore_backup
  B. import backup
  C. cp_merge
  D. migrate import
  D. migrate import

  ---

  Explanation

  The command migrate import can be used to restore a backup of Check Point configurations without the OS information. This command imports the configuration from a file that was created using the migrate export command, which backs up only the Check Point configuration and not the OS settings. The other commands are either not valid or not suitable for restoring a backup without the OS information.

  References:

  Check Point R81 Installation and Upgrade Guide

• Question 162:

  When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

  A. RADIUS
  B. Remote Access and RADIUS
  C. AD Query
  D. AD Query and Browser-based Authentication
  D. AD Query and Browser-based Authentication

  ---

  Explanation

  When Identity Awareness is enabled, AD Query and Browser-based Authentication are used as identity sources for Application Control. AD Query allows the Security Gateway to query Active Directory servers for identity information based on IP addresses. Browser-based Authentication allows the Security Gateway to redirect unidentified users to a captive portal where they can authenticate with their credentials. These identity sources provide accurate and up-to-date identity information for Application Control, which can enforce granular policies based on user, group, machine, and domain objects.

  References:

  R81 Identity Awareness Administration Guide, page 9.

• Question 163:

  GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

  A. Check Point Update Service Engine
  B. Check Point Software Update Agent
  C. Check Point Remote Installation Daemon (CPRID)
  D. Check Point Software Update Daemon
  A. Check Point Update Service Engine

  ---

  Explanation

  GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the Check Point Update Service Engine. This agent allows you to download and install software updates, hotfixes, upgrade packages, etc., from Check Point servers or from a local repository. The Check Point Update Service Engine can be accessed via SmartConsole or via WebUI or

  CLI on GAIA.

  References:

  [Gaia Administration Guide R81], page 77.

• Question 164:

  In the Firewall chain mode FFF refers to:

  A. Stateful Packets
  B. No Match
  C. All Packets
  D. Stateless Packets
  C. All Packets

  ---

  Explanation

  In the Firewall chain mode FFF refers to all packets. Firewall chain mode is a feature that allows administrators to define how packets are processed by different firewall kernel modules in inbound and outbound directions. FFF is one of the predefined chain modes that applies all firewall kernel modules (Firewall, VPN, IPS, etc.) to all packets, regardless of their state or connection. This mode provides maximum security, but also consumes more CPU resources.

• Question 165:

  The WebUI offers several methods for downloading hotfixes via CPUSE except:

  A. Automatic
  B. Force override
  C. Manually
  D. Scheduled
  B. Force override

  ---

  Explanation

  The WebUI offers three methods for downloading hotfixes via CPUSE: Automatic, Manually, and Scheduled. Force override is not a valid method for downloading hotfixes. Force override is an option that can be used when installing a hotfix to override the compatibility check and force the installation of the hotfix.

  References:

  CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)

• Question 166:

  John detected high load on sync interface.

  Which is most recommended solution?

  A. For short connections like http service - delay sync for 2 seconds
  B. Add a second interface to handle sync traffic
  C. For short connections like http service - do not sync
  D. For short connections like icmp service - delay sync for 2 seconds
  C. For short connections like http service - do not sync

• Question 167:

  What is the difference between SSL VPN and IPSec VPN?

  A. SSL VPN requires installation of a resilient VPN client
  B. SSL VPN and IPSec VPN are the same
  C. IPSec VPN does not require installation of a resident VPN client
  D. IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser
  D. IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser

• Question 168:

  In R81.20 a new feature dynamic log distribution was added.

  What is this for?

  A. Configure the Security Gateway to distribute logs between multiple active Log Servers to support a better rate of Logs and Log Servers redundancy
  B. In case of a Management High Availability the management server stores the logs dynamically on the member with the most available disk space in /var/log
  C. Synchronize the log between the primary and secondary management server in case of a Management High Availability
  D. To save disk space in case of a firewall cluster local logs are distributed between the cluster members.
  A. Configure the Security Gateway to distribute logs between multiple active Log Servers to support a better rate of Logs and Log Servers redundancy

  ---

  Explanation

  Dynamic log distribution is a feature that allows you to configure the Security Gateway to distribute logs between multiple active Log Servers to support a better rate of Logs and Log Servers redundancy. This means that each log is sent to only one Log Server and the load is balanced between the primary Log Servers. If all the primary Log Servers are disconnected, the logs are distributed between the backup Log Servers. If no Log Servers are connected, the gateway writes the logs locally. This feature improves the performance and reliability of logging and reduces the network traffic and disk space consumption. You can enable this feature on the SmartConsole -> Gateways & Servers -> Logs -> Dynamic Log Distribution.

  The other options are incorrect because they do not describe the dynamic log distribution feature.

  Option B is wrong because the Management High Availability does not store the logs dynamically on the member with the most available disk space, but rather synchronizes the logs between the members using the cpd process.

  Option C is wrong because the dynamic log distribution feature does not synchronize the logs between the primary and secondary management server, but rather distributes the logs between the Log Servers.

  Option D is wrong because the dynamic log distribution feature does not save disk space in case of a firewall cluster, but rather distributes the logs between the Log Servers.

  The firewall cluster members do not store local logs, but rather send them to the Log Servers.

• Question 169:

  What is not a component of Check Point SandBlast?

  A. Threat Emulation
  B. Threat Simulator
  C. Threat Extraction
  D. Threat Cloud
  B. Threat Simulator

  ---

  Explanation

  Threat Simulator is not a component of Check Point SandBlast. Check Point SandBlast is a solution that provides advanced protection against zero-day threats using four components: Threat Emulation, Threat Extraction, Threat Cloud, and Threat Prevention.

  References:

  Check Point SandBlast Network

• Question 170:

  To fully enable Dynamic Dispatcher on a Security Gateway:

  A. run fw ctl multik set_mode 9 in Expert mode and then Reboot.
  B. Using cpconfig, update the Dynamic Dispatcher value to "full" under the CoreXL menu.
  C. Edit/proc/interrupts to include multik set_mode 1 at the bottom of the file, save, and reboot.
  D. run fw multik set_mode 1 in Expert mode and then reboot.
  A. run fw ctl multik set_mode 9 in Expert mode and then Reboot.

  ---

  Explanation

  To fully enable Dynamic Dispatcher on a Security Gateway, you need to run the following command in Expert mode then reboot:

  This command sets the multi-core mode to 9, which means that Dynamic Dispatcher is enabled without Firewall Priority Queues. Dynamic Dispatcher is a feature that optimizes the performance of Security Gateways with multiple CPU cores by dynamically allocating traffic to different cores based on their load and priority. Dynamic Dispatcher can improve the throughput and scalability of the Security Gateway, especially for traffic that is not accelerated by SecureXL. The other commands are not valid or do not enable Dynamic Dispatcher.

  References:

  R81 Performance Tuning Administration Guide