CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 181:

  What will SmartEvent automatically define as events?

  A. Firewall
  B. VPN
  C. IPS
  D. HTTPS
  C. IPS

  ---

  Explanation

  SmartEvent automatically defines events based on IPS (Intrusion Prevention System) alerts. IPS is a feature that detects and prevents malicious network traffic based on predefined or custom signatures. IPS alerts are generated when IPS detects an attack or an anomaly that matches a signature. SmartEvent collects and correlates IPS alerts from different gateways and displays them as events in SmartEventWeb.

  The other options are not automatically defined as events by SmartEvent.

• Question 182:

  There are 4 ways to use the Management API for creating host object with R81 Management API.

  Which one is NOT correct?

  A. Using Web Services
  B. Using Mgmt_cli tool
  C. Using CLISH
  D. Using SmartConsole GUI console
  E. Events are collected with SmartWorkflow from Trouble Ticket systems
  E. Events are collected with SmartWorkflow from Trouble Ticket systems

  ---

  Explanation

  There are four ways to use the Management API for creating host object with R81 Management API: Using Web Services, Using mgmt_cli tool, Using CLISH, and Using SmartConsole GUI console. Events are collected with SmartWorkflow from Trouble Ticket systems is not a correct option.

  References:

  Check Point Management APIs

• Question 183:

  Why would an administrator see the message below?

  

  A. A new Policy Package created on both the Management and Gateway will be deleted and must be backed up first before proceeding.
  B. A new Policy Package created on the Management is going to be installed to the existing Gateway.
  C. A new Policy Package created on the Gateway is going to be installed on the existing Management.
  D. A new Policy Package created on the Gateway and transferred to the Management will be overwritten by the Policy Package currently on the Gateway but can be restored from a periodic backup on the Gateway.
  B. A new Policy Package created on the Management is going to be installed to the existing Gateway.

  ---

  Explanation

  A Policy Package is a set of rules and settings that define how a Security Gateway enforces security on traffic that passes through it. A Policy Package can be created on either the Management Server or the Security Gateway, but it must be installed on both to take effect. When a new Policy Package is created on the Management Server, it must be installed on an existing Security Gateway that has a different Policy Package installed. The message below warns the administrator that installing a new Policy Package will overwrite the existing one on the Security Gateway.

  https://www.bing.com/images/blob?bcid=qMoRhR0dzSkGmg.Themessagealsoadvisestheadministratortobackuptheirexistingconfigurationbeforeproceedingwiththeinstallation.

• Question 184:

  What does Backward Compatibility mean upgrading the Management Server and how can you check it?

  A. The Management Server is able to manage older Gateways. The lowest supported version in the Installation and Upgrade Guide
  B. The Management Server is able to manage older Gateways. The lowest supported version is documented in the Release Notes
  C. You will be able to connect to older Management Server with the SmartConsole. The lowest supported version is documented in the Release Notes
  D. You will be able to connect to older Management Server with the SmartConsole. The lowest supported version is documented in the Installation and Upgrade Guide
  B. The Management Server is able to manage older Gateways. The lowest supported version is documented in the Release Notes

• Question 185:

  Matt wants to upgrade his old Security Management Server to R81.x using the Advanced Upgrade with Database Migration.

  What is one of the requirements for a successful upgrade?

  A. Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine
  B. Size of the $FWDIR/log folder of the target machine must be a least 25% of the size of the $FWDIR/log directory on the source machine
  C. Size of the /var/log folder of the target machine must be 25GB or more
  D. Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine
  D. Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine

• Question 186:

  Which of the following is a task of the CPD process?

  A. Transfers messages between Firewall processes
  B. Invoke and monitor critical processes and attempts to restart them if they fail
  C. Responsible for processing most traffic on a security gateway
  D. Logforwarding
  A. Transfers messages between Firewall processes

• Question 187:

  Which command shows only the table names of all kernel tables?

  A. fw tab -t
  B. fw tab -n
  C. fw tab -s
  D. fw tab -k
  A. fw tab -t

• Question 188:

  What does the "unknown" SIC status shown on SmartConsole mean?

  A. SIC activation key requires a reset
  B. Administrator input the wrong SIC key
  C. The management can contact the Security Gateway but cannot establish Secure Internal Communication
  D. There is no connection between the Security Gateway and Security Management Server
  D. There is no connection between the Security Gateway and Security Management Server

  ---

  Explanation

  The "unknown" SIC status shown on SmartConsole means that there is no connection between the Security Gateway and Security Management Server. SIC stands for Secure Internal Communication, which is a mechanism that ensures secure communication between Check Point components using certificates and encryption. SIC status can be one of the following: Trust established, Trust expired, Uninitialized, or Unknown. Trust established means that SIC is working properly and the components can communicate securely. Trust expired means that the SIC certificate has expired and needs to be renewed. Uninitialized means that SIC has not been configured yet and needs to be initialized with an activation key. Unknown means that the Security Management Server cannot reach the Security Gateway or vice versa, and therefore cannot verify the SIC status. This could be due to network issues, firewall rules, routing problems, or other causes that prevent connectivity between the components.

  References:

  Check Point R81 Security Management Administration Guide, page 32-33

• Question 189:

  Advanced Security Checkups can be easily conducted within:

  A. Reports
  B. Advanced
  C. Checkups
  D. Views
  E. Summary
  A. Reports

  ---

  Explanation

  Advanced Security Checkups can be easily conducted within the Reports tab in the Logs & Monitor view in SmartConsole. The Reports tab allows you to generate and view various reports that provide insights into the security status and performance of your network. You can use predefined reports or create custom reports based on your needs. You can also schedule reports to run automatically and send them by email.

  Some of the predefined reports that can help you conduct advanced security checkups are:

  Security Overview: This report provides a summary of the security posture of your network, including the number and severity of incidents, the top attacked hosts and services, the top attackers and attack methods, the top detected threats and vulnerabilities, etc. Security Best Practices: This report evaluates your security configuration and policy against the Check Point best practices and provides recommendations for improvement. It covers areas such as firewall policy, NAT policy, VPN policy, identity

  awareness, threat prevention, etc.

  Compliance Status: This report assesses your compliance level with various regulations and standards, such as PCI DSS, ISO 27001, NIST 800-53, etc. It shows the compliance score, the compliance status of each requirement, the compliance status of each gateway and blade, etc.

  Network Activity: This report shows the network activity and traffic patterns on your network, including the top sources and destinations of traffic, the top protocols and applications used, the top bandwidth consumers, etc.

  System Health: This report monitors the health and performance of your management server and gateways, including the CPU utilization, memory usage, disk space, network interfaces, etc.

  References:

  R81 Logging and Monitoring Administration Guide

• Question 190:

  How is communication between different Check Point components secured in R81? As with all questions, select the BEST answer.

  A. By using IPSEC
  B. By using SIC
  C. By using ICA
  D. By using 3DES
  B. By using SIC

  ---

  Explanation

  Communication between different Check Point components is secured by using SIC, which stands for secure internal communication. SIC is a certificate-based channel that uses standards-based TLS 1.2 for creating secure connections and AES128 for encryption. SIC ensures that only authorized components can communicate with each other and that the communication is protected from eavesdropping and tampering. SIC is established by using a one-time password (OTP) that is generated when a Check Point component is created or installed. The OTP is used to initialize the trust relationship between the component and the Security Management Server, which acts as an internal certificate authority (ICA) that issues and revokes certificates for the components.