CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 171:

  What is not a purpose of the deployment of Check Point API?

  A. Execute an automated script to perform common tasks
  B. Create a customized GUI Client for manipulating the objects database
  C. Create products that use and enhance the Check Point solution
  D. Integrate Check Point products with 3rd party solution
  B. Create a customized GUI Client for manipulating the objects database

  ---

  Explanation

  The deployment of Check Point API does not have the purpose of creating a customized GUI Client for manipulating the objects database. The Check Point API is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. The Check Point API can be used to execute an automated script to perform common tasks, create products that use and enhance the Check Point solution, and integrate Check Point products with 3rd party solutions. However, creating a customized GUI Client for manipulating the objects database is not a supported or intended use case of the Check Point API.

• Question 172:

  Which command will allow you to see the interface status?

  A. cphaprob interface
  B. cphaprob -I interface
  C. cphaprob -a if
  D. cphaprob stat
  C. cphaprob -a if

  ---

  Explanation

  The cphaprob -a if command displays the interface status of all cluster members, including the interface name, IP address, state, monitor mode, and sync status.

  References:

  cphaprob - Check Point Support Center

• Question 173:

  Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

  A. UserCheck
  B. User Directory Query
  C. AccountUnitQuery
  D. Active Directory Query
  D. Active Directory Query

• Question 174:

  What are the two high availability modes?

  A. Load Sharing and Legacy
  B. Traditional and New
  C. Active and Standby
  D. New and Legacy
  D. New and Legacy

  ---

  Explanation

  The two high availability modes are New and Legacy. High availability (HA) is a feature that allows you to create a cluster of two or more Security Gateways that act as a single entity to provide redundancy and reliability for your network traffic. HA ensures that if one Security Gateway fails or becomes unavailable, another Security Gateway in the cluster takes over its role seamlessly and continues to process the traffic.

  HA also provides load balancing and synchronization of the cluster members. The New mode is the recommended mode for HA clusters, as it provides better performance, scalability, and stability than the Legacy mode. The New mode uses the ClusterXL mechanism to manage the cluster members and the state synchronization. The Legacy mode uses the High Availability Security Extension (HASE) mechanism to manage the cluster members and the state synchronization. The Legacy mode is supported for backward compatibility with older versions of Check Point products, but it has some limitations and disadvantages compared to the New mode.

• Question 175:

  What is mandatory for ClusterXL to work properly?

  A. The number of cores must be the same on every participating cluster node
  B. The Magic MAC number must be unique per cluster node
  C. The Sync interface must not have an IP address configured
  D. If you have "Non-monitored Private" interfaces, the number of those interfaces must be the same on all cluster members
  B. The Magic MAC number must be unique per cluster node

  ---

  Explanation

  For ClusterXL to work properly, one of the mandatory requirements is that the Magic MAC number must be unique per cluster node. The Magic MAC number is a MAC address that is used by ClusterXL to hide the physical MAC addresses of the cluster members from the network. This way, the cluster can present a single virtual MAC address to the network, and avoid ARP issues when a failover occurs. The Magic MAC number is derived from the Cluster Virtual IP address, which must also be unique per cluster.

• Question 176:

  Alice and Bob are concurrently logged in via SSH on the same Check Point Security Gateway as user "admin"; however, Bob logged in first and acquired the lock. Alice is not aware that Bob is also logged in to the same Security Management Server as she is, but she needs to perform very urgent configuration changes.

  Which of the following Gaia clish commands is correct for overriding Bob's configuration database lock?

  A. lock database override
  B. unlock override database
  C. unlock database override
  D. database unlock override
  A. lock database override

  ---

  Explanation

  To override Bob's configuration database lock, Alice can use the command lock database override in the clish shell. This command will transfer the lock from Bob to Alice and allow her to make the urgent configuration changes. However, this command should be used with caution, as it may cause conflicts or inconsistencies if Bob and Alice are working on the same objects or policies. It is recommended to communicate with other administrators before using this command and to release the lock as soon as possible after finishing the changes. The other commands are not valid in clish and will result in an error message.

• Question 177:

  One of major features in R81 SmartConsole is concurrent administration.

  Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?

  A. A lock icon shows that a rule or an object is locked and will be available.
  B. AdminA and AdminB are editing the same rule at the same time.
  C. A lock icon next to a rule informs that any Administrator is working on this particular rule.
  D. AdminA, AdminB and AdminC are editing three different rules at the same time.
  B. AdminA and AdminB are editing the same rule at the same time.

  ---

  Explanation

  One of the major features in R81 SmartConsole is concurrent administration. This feature allows multiple administrators to work on the same Security Policy simultaneously, without blocking each other or creating conflicts. Concurrent administration improves the efficiency and productivity of security management operations 1. However, not all of the options given are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. The correct answer is B. AdminA and AdminB are editing the same rule at the same time. This is not possible because concurrent administration uses a locking mechanism to prevent multiple administrators from modifying the same rule or object at the same time.

  When an administrator clicks on a rule or an object, it becomes locked and a lock icon appears next to it.

  The lock icon shows the name of the administrator who is working on that rule or object, and prevents other administrators from editing it until it is unlocked. Therefore, the other options are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. Option A is possible because a lock icon shows that a rule or an object is locked and will be available when the administrator who locked it finishes working on it or logs out of SmartConsole.

  Option C is possible because a lock icon next to a rule informs that any administrator is working on this particular rule, and hovering over the lock icon will show the name of that administrator.

  Option D is possible because AdminA, AdminB and AdminC are editing three different rules at the same time, which does not create any conflicts or blockages.

• Question 178:

  Which Check Point daemon monitors the other daemons?

  A. fwm
  B. cpd
  C. cpwd
  D. fwssd
  C. cpwd

  ---

  Explanation

  The Check Point daemon that monitors the other daemons is cpwd (Check Point Watchdog). It is responsible for monitoring the health and status of various Check Point daemons and processes running on the Security Gateway. If any daemon or process stops responding or encounters an issue, cpwd can restart it to ensure the continued operation of the Security Gateway.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 179:

  Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic. The cpm process

  A. Performs database tasks such as creating, deleting, and modifying objects and compiling policy.
  B. Allows SmartConsole to communicate over TCP Port 19001
  C. Performs database tasks such as creating, deleting, and modifying objects and indexing logs
  D. Allows SmartConsole to communicate over TCP Port 18190
  A. Performs database tasks such as creating, deleting, and modifying objects and compiling policy.

• Question 180:

  What command can you use to have cpinfo display all installed hotfixes?

  A. cpinfo-hf
  B. cpinfo installed_jumbo
  C. cpinfo-get hf
  D. cpinfo-y all
  D. cpinfo-y all