CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 191:

  Which 3 types of tracking are available for Threat Prevention Policy?

  A. None, Log, Syslog
  B. Alert, SNMP trap, Mail
  C. SMS Alert, Log, SNMP alert
  D. Syslog, None, User-defined scripts
  B. Alert, SNMP trap, Mail

• Question 192:

  CoreXL is NOT supported when one of the following features is enabled:

  A. Overlapping NAT
  B. Route-based VPN
  C. IPv6
  D. IPS
  A. Overlapping NAT

• Question 193:

  Where do you create and modify the Mobile Access policy in R81?

  A. SmartConsole
  B. SmartMonitor
  C. SmartEndpoint
  D. SmartDashboard
  A. SmartConsole

  ---

  Explanation

  In R81, the Mobile Access policy is created and modified in SmartConsole. SmartConsole is the management interface for configuring and managing various security policies, including Mobile Access policies.

  References:

  Check Point Certified Security Expert R81 documentation and learning resources.

• Question 194:

  Packet acceleration (SecureXL) identities connections by several attributes.

  Which of the attributes is NOT used for identifying connection?

  A. Source Port
  B. TCP Acknowledgment Number
  C. Source Address
  D. Destination Address
  B. TCP Acknowledgment Number

  ---

  Explanation

  SecureXL does not use the TCP acknowledgment number as an attribute for identifying connections.

  SecureXL is a technology that accelerates the performance of the firewall by offloading some of the traffic processing from the firewall kernel to a more efficient path. SecureXL identifies connections by five attributes: source address, destination address, source port, destination port, and protocol. These

  attributes are also known as the 5-tuple or the connection key. SecureXL uses these attributes to match packets to existing connections and apply the appropriate security policy and actions. SecureXL does not need to inspect the TCP sequence or acknowledgment numbers, as they are irrelevant for the connection identification and security enforcement. The TCP sequence and acknowledgment numbers are used by the TCP protocol to ensure reliable and ordered delivery of data between endpoints

• Question 195:

  By default how often updates are checked when the CPUSE Software Updates Policy is set to Automatic?

  A. Six times per day
  B. Seven times per day
  C. Every two hours
  D. Every three hours
  D. Every three hours

  ---

  Explanation

  By default, when the CPUSE Software Updates Policy is set to Automatic, updates are checked every three hours. This means that the CPUSE agent will automatically download and install updates that match the policy settings every three hours. The other options are not the default values for the CPUSE Software Updates Policy.

• Question 196:

  Bob is going to prepare the import of the exported R81.10 management database. Now he wants to verify that the installed tools on the new target security management machine are able to handle the R81.10 release.

  Which of the following Check Point command is true?

  A. $FWDIR/scripts/migrate_server print_installed_tools -v R77.30
  B. $CPDIR/scripts/migrate_server print_installed_tools -v R81.10
  C. $FWDIR/scripts/migrate_server print_uninstalled_tools -v R81.10
  D. $FWDIR/scripts/migrate_server print_installed_tools -v R81.10
  D. $FWDIR/scripts/migrate_server print_installed_tools -v R81.10

• Question 197:

  What is the command to see cluster status in cli expert mode?

  A. fw ctl stat
  B. clusterXL stat
  C. clusterXL status
  D. cphaprob stat
  D. cphaprob stat

  ---

  Explanation

  To see the cluster status in CLI expert mode, you can use the command cphaprob stat. This command displays the status of the Check Point High Availability cluster. It provides information about the state of the cluster members, such as "Active," "Standby," or "Collision."

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 198:

  Which two Identity Awareness daemons are used to support identity sharing?

  A. Policy Activation Point (PAP) and Policy Decision Point (PDP)
  B. Policy Manipulation Point (PMP) and Policy Activation Point (PAP)
  C. Policy Enforcement Point (PEP) and Policy Manipulation Point (PMP)
  D. Policy Decision Point (PDP) and Policy Enforcement Point (PEP)
  D. Policy Decision Point (PDP) and Policy Enforcement Point (PEP)

  ---

  Explanation

  The two Identity Awareness daemons that are used to support identity sharing are Policy Decision Point (PDP) and Policy Enforcement Point (PEP). PDP is a daemon that runs on Security Gateways that acquire identities from various sources, such as AD Query, Identity Agent, Captive Portal, etc. PEP is a daemon that runs on Security Gateways that enforce the security policy based on identities received from PDPs.

  Identity sharing is a feature that allows PDPs to share identities with other PDPs or PEPs in different gateways or domains.

  [Check Point R81 Identity Awareness Administration Guide]

• Question 199:

  Which port is used by Secure Internal Communication (SIC) by default?

  A. 18184
  B. 18210
  C. 18191
  D. 257
  C. 18191

  ---

  Explanation

  SIC communication uses TCP port 18191 by default. This port is used to establish trust between management and gateways.

• Question 200:

  What command would show the API server status?

  A. api status
  B. show api status
  C. cpm status
  D. api restart
  A. api status