CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 201:

  In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

  A. Mail, Block Source, Block Event Activity, External Script, SNMP Trap
  B. Mail, Block Source, Block Destination, Block Services, SNMP Trap
  C. Mail, Block Source, Block Destination, External Script, SNMP Trap
  D. Mail, Block Source, Block Event Activity, Packet Capture, SNMP Trap
  A. Mail, Block Source, Block Event Activity, External Script, SNMP Trap

  ---

  Explanation

  In SmartEvent, the administrator can configure different types of automatic reactions, which include: Mail notifications Blocking the source of the event Blocking the event activity Running an external script Sending an SNMP trap So, the correct answer is "Mail, Block Source, Block Event Activity, External Script,

  SNMP Trap." References:

  Check Point documentation or training materials related to SmartEvent configuration and automatic reactions.

• Question 202:

  Alice was asked by Bob to implement the Check Point Mobile Access VPN blade - therefore are some basic configuration steps required - which statement about the configuration steps is true?

  A. 1. Add a rule in the Access Control Policy and install policy2. Configure Mobile Access parameters in Security Gateway object3. Enable Mobile Access blade on the Security Gateway object and complete the wizard4. Connect to the Mobile Access Portal
  B. 1. Connect to the Mobile Access Portal2. Enable Mobile Access blade on the Security Gateway object and complete the wizard3. Configure Mobile Access parameters in Security Gateway object4. Add a rule in the Access Control Policy and install policy
  C. 1. Configure Mobile Access parameters in Security Gateway object2. Enable Mobile Access blade on the Security Gateway object and complete the wizard3. Add a rule in the Access Control Policy and install policy4. Connect to the Mobile Access Portal
  D. 1. Enable Mobile Access blade on the Security Gateway object and complete the wizard2. Configure Mobile Access parameters in Security Gateway object3. Add a rule in the Access Control Policy and install policy4. Connect to the Mobile Access Portal
  D. 1. Enable Mobile Access blade on the Security Gateway object and complete the wizard2. Configure Mobile Access parameters in Security Gateway object3. Add a rule in the Access Control Policy and install policy4. Connect to the Mobile Access Portal

• Question 203:

  After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?

  A. Security Gateway IP-address cannot be changed without re-establishing the trust.
  B. The Security Gateway name cannot be changed in command line without re-establishing trust.
  C. The Security Management Server name cannot be changed in SmartConsole without re-establishing trust.
  D. The Security Management Server IP-address cannot be changed without re-establishing the trust.
  A. Security Gateway IP-address cannot be changed without re-establishing the trust.

  ---

  Explanation

  After trust has been established between the Check Point components, the Security Gateway IP address cannot be changed without re-establishing the trust. This is because the trust is based on the Secure Internal Communication (SIC) mechanism, which uses certificates to authenticate and encrypt the communication. The certificates are issued by the Internal Certificate Authority (ICA) of the Security Management Server /Domain Management Server, and contain the name and IP address of the component. Therefore, if the IP address of a component is changed, the certificate will become invalid and the trust will be lost. To restore the trust, the certificate must be renewed or reissued by the ICA12.

  However, there are some exceptions to this rule. The Security Gateway name can be changed in command line without re-establishing trust, as long as the IP address remains the same. This is because the SIC mechanism does not rely on the hostname, but on the IP address and the SIC name (which is usually derived from the hostname, but can be manually changed). The Security Management Server name can be changed in SmartConsole without re-establishing trust, as long as the IP address remains the same. This is because SmartConsole uses a different mechanism to connect to the Security Management Server, which does not depend on the SIC certificate. The Security Management Server IP address can be changed without re-establishing trust, as long as some steps are followed to update the Check Point Registry file on the managed Security Gateways / Cluster Members / VSX Virtual Devices.

  This is because the Registry file contains the IP address of the ICA, which is used for certificate renewal. If the Registry file is not updated, then the certificate renewal will fail and the trust will be lost 3.

  References:

  1: Check Point R81 Security Administration Guide - Check Point Software, page 162

  2: Check Point R81 Security Engineering Guide - Check Point Software, page 162

  3: How to renew SIC after changing IP Address of Security Management Server - Check Point Software, Solution ID: sk103356

• Question 204:

  To help SmartEvent determine whether events originated internally or externally you must define using the Initial Settings under General Settings in the Policy Tab.

  How many options are available to calculate the traffic direction?

  A. 5 Network; Host; Objects; Services; API
  B. 3 Incoming; Outgoing; Network
  C. 2 Internal; External
  D. 4 Incoming; Outgoing; Internal; Other
  D. 4 Incoming; Outgoing; Internal; Other

  ---

  Explanation

  To help SmartEvent determine whether events originated internally or externally, you must define the traffic direction using the Initial Settings under General Settings in the Policy Tab. There are four options available to calculate the traffic direction: Incoming, Outgoing, Internal, and Other. Incoming means the source is external and the destination is internal. Outgoing means the source is internal and the destination

  is external. Internal means both the source and the destination are internal. Other means both the source and the destination are external.

  References:

  SmartEvent R81 Administration Guide

• Question 205:

  Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

  A. ffffffff
  B. 00000001
  C. 00000002
  D. 00000003
  B. 00000001

  ---

  Explanation

  For Wire mode configuration, chain modules marked with 00000001 will not apply. Wire mode is a special configuration that allows a Security Gateway to pass traffic without inspection, acting as a bridge between two network segments. In Wire mode, only chain modules that are essential for basic functionality are applied, such as VPN, QoS, ClusterXL, and SecureXL. Chain modules that are related to inspection-based Software Blades, such as Firewall, IPS, Application Control, and so on, are skipped. The chain modules that are skipped are marked with 00000001 in the output of fw ctl chain command.

  References:

  Wire Mode

• Question 206:

  What is the minimum amount of RAM needed for a Threat Prevention Appliance?

  A. 6 GB
  B. 8GB with Gaia in 64-bit mode
  C. 4 GB
  D. It depends on the number of software blades enabled
  C. 4 GB

  ---

  Explanation

  According to the Check Point Resource Library, the minimum amount of RAM needed for a Threat Prevention Appliance is 4 GB. This applies to both physical and virtual appliances. The other options are either incorrect or irrelevant.

  References:

  Check Point Resource Library

• Question 207:

  Both ClusterXL and VRRP are fully supported by Gaia R81.20 and available to all Check Point appliances.

  Which the following command is NOT related to redundancy and functions?

  A. cphaprob stat
  B. cphaprob -a if
  C. cphaprob -l list
  D. cphaprob all show stat
  D. cphaprob all show stat

  ---

  Explanation

  The command cphaprob all show stat is not related to redundancy and functions. This command does not exist in ClusterXL or VRRP. The other commands are valid commands for checking the status of cluster members, interfaces, and synchronization. ClusterXL and VRRP are both high availability solutions that provide redundancy and load balancing for Check Point gateways.

  References:

  Check Point Security Expert R81 Course, ClusterXL Administration Guide, VRRP Administration Guide

• Question 208:

  Which command shows actual allowed connections in state table?

  A. fw tab -t StateTable
  B. fw tab -t connections
  C. fw tab -t connection
  D. fw tab connections
  B. fw tab -t connections

  ---

  Explanation

  The correct command to show actual allowed connections in the state table is option B: fw tab -t connections. This command displays the contents of the "connections" table, which contains information about the active connections being tracked by the firewall. Option A (fw tab -t StateTable) is incorrect as there is no "StateTable" table; it should be "connections."

  Option C (fw tab -t connection) is also incorrect, as it should be "connections."

  Option D (fw tab connections) is not the correct syntax for the command.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 209:

  There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational.

  When it re-joins the cluster, will it become active automatically?

  A. No, since 'maintain' current active cluster member' option on the cluster object properties is enabled by default.
  B. No, since 'maintain' current active cluster member' option is enabled by default on the Global Properties.
  C. Yes, since 'Switch to higher priority cluster member' option on the cluster object properties is enabled by default.
  D. Yes, since 'Switch to higher priority cluster member' option is enabled by default on the Global Properties.
  A. No, since 'maintain' current active cluster member' option on the cluster object properties is enabled by default.

  ---

  Explanation

  There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational. When it re-joins the cluster, it will not become active automatically, since 'maintain current active cluster member' option on the cluster object properties is enabled by default. This option prevents a failback to the original active member after a failover, unless the current active member fails or is manually switched over. This option provides stability and avoids unnecessary failovers.

  References:

  R77 ClusterXL Administration Guide, page 23.

• Question 210:

  SandBlast offers flexibility in implementation based on their individual business needs.

  What is an option for deployment of Check Point SandBlast Zero-Day Protection?

  A. Smart Cloud Services
  B. Load Sharing Mode Services
  C. Threat Agent Solution
  D. Public Cloud Services
  A. Smart Cloud Services

  ---

  Explanation

  Check Point SandBlast Zero-Day Protection offers flexibility in implementation to meet individual business needs. One of the deployment options for Check Point SandBlast Zero-Day Protection is:

  Smart Cloud Services (Option A): Smart Cloud Services allow organizations to leverage cloud-based threat intelligence and protection services provided by Check Point. The other options, Load Sharing Mode Services ( Option B), Threat Agent Solution (Option C), and Public Cloud Services (Option D), may also be components of a security strategy, but they are not specific deployment options for Check Point SandBlast Zero-Day Protection.

  References:

  Check Point Certified Security Expert (CCSE) R81 training materials and documentation.