CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 211:

  What is true of the API server on R81.20?

  A. By default the API-server is activated and does not have hardware requirements.
  B. By default the API-server is not active and should be activated from the WebUI.
  C. By default the API server is active on management and stand-alone servers with 16GB of RAM (or more).
  D. By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8GB of RAM (or more).
  D. By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8GB of RAM (or more).

  ---

  Explanation

  The true statement about the API server on R81.20 is: By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8GB of RAM (or more). The API server is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. The API server is enabled by default on R81.20 management servers that have at least 4 GB of RAM, and on stand-alone servers that have at least 8 GB of RAM. The API server can also be manually enabled or disabled from the WebUI or the CLI.

• Question 212:

  Which of the following Central Deployment is NOT a limitation in R81.20 SmartConsole?

  A. Security Gateways/Clusters is ClusterXL HA new mode
  B. Dedicated Log Server
  C. Security Gateway Clusters in Load Sharing mode
  D. Dedicated SmartEvent Server
  C. Security Gateway Clusters in Load Sharing mode

• Question 213:

  Which of these statements describesthe Check Point ThreatCloud?

  A. Blocks or limits usage of web applications
  B. Prevents or controls access to web sites based on category
  C. A worldwide collaborative security network
  D. Prevents Cloud vulnerability exploits
  C. A worldwide collaborative security network

• Question 214:

  Which process is available on any management product and on products that require direct GUI access, such as SmartEvent and provides GUI client communications, database manipulation, policy compilation and Management HA synchronization?

  A. cpwd
  B. fwd
  C. cpd
  D. fwm
  D. fwm

  ---

  Explanation

  Firewall Management (fwm) is available on any management product, including Multi-Domain and on products that requite direct GUI access, such as SmartEvent, It provides the following:

  1. GUI Client communication

  2. Database manipulation

  3. Policy Compilation

  4. Management HA sync

• Question 215:

  What must you do first if "fwm sic_reset" could not be completed?

  A. Cpstop then find keyword "certificate" in objects_5_0.C and delete the section
  B. Reinitialize SIC on the security gateway then run "fw unloadlocal"
  C. Reset SIC from Smart Dashboard
  D. Change internal CA via cpconfig
  D. Change internal CA via cpconfig

  ---

  Explanation

  The first thing that must be done if "fwm sic_reset" could not be completed is to change internal CA via cpconfig. Fwm sic_reset is a command that allows administrators to reset Secure Internal Communication (SIC) between Security Management Server and Security Gateways or other Check Point modules. SIC is a mechanism that ensures secure and authenticated communication between Check Point components by using certificates issued by an internal Certificate Authority (ICA). If fwm sic_reset fails, it means that there is a problem with the ICA or the certificates that prevents SIC from being reset. To resolve this problem, administrators need to change internal CA via cpconfig, which is a command that allows administrators to configure various settings on Security Gateways or Management Servers, including the ICA. Changing internal CA via cpconfig will create a new ICA with a new certificate, and allow SIC to be reset with the new certificate.

• Question 216:

  When simulating a problem on ClusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?

  A. cphaprob -d STOP unregister
  B. cphaprob STOP unregister
  C. cphaprob unregister STOP
  D. cphaprob -d unregister STOP
  A. cphaprob -d STOP unregister

  ---

  Explanation

  When simulating a problem on a ClusterXL cluster with the command "cphaprob -d STOP -s problem -t 0 register" to initiate a failover on an active cluster member, you can use the command "cphaprob -d STOP unregister" to remove the problematic state and return the cluster to normal operation. Option A correctly identifies the command that allows you to remove the problematic state, making it the verified answer.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 217:

  You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.

  What must you do to get SIC to work?

  A. Remove Geo-Protection, as the IP-to-country database is updated externally, and you have no control of this.
  B. Create a rule at the top in the Sydney firewall to allow control traffic from your network
  C. Nothing - Check Point control connections function regardless of Geo-Protection policy
  D. Create a rule at the top in your Check Point firewall to bypass the Geo-Protection
  C. Nothing - Check Point control connections function regardless of Geo-Protection policy

  ---

  Explanation

  Nothing needs to be done to get SIC to work if there is a Geo-Protection policy blocking Australia and a network requires a Check Point Firewall to be installed in Sydney, Australia. SIC stands for Secure Internal Communication, and it is a mechanism that ensures secure and authenticated communication between Check Point components by using certificates issued by an internal Certificate Authority (ICA). SIC is not affected by Geo-Protection policy, which is a feature that allows administrators to block or allow traffic based on the geographic location of the source or destination IP address. Geo-Protection policy only applies to data traffic, not control traffic, and SIC uses control traffic to establish trust between Check Point components.

• Question 218:

  Which command lists all tables in Gaia?

  A. fw tab -s
  B. fw tab -list
  C. fw tab -t
  D. fw tab -l
  A. fw tab -s

• Question 219:

  Which statement is true about ClusterXL?

  A. Supports Dynamic Routing (Unicast and Multicast)
  B. Supports Dynamic Routing (Unicast Only)
  C. Supports Dynamic Routing (Multicast Only)
  D. Does not support Dynamic Routing
  A. Supports Dynamic Routing (Unicast and Multicast)

  ---

  Explanation

  ClusterXL supports Dynamic Routing for both Unicast and Multicast traffic. Dynamic Routing protocols, such as OSPF, BGP, or PIM, can be configured on cluster members to exchange routing information with other routers. ClusterXL supports two modes of operation for Dynamic Routing: New Mode and Legacy Mode.

  References:

  ClusterXL Administration Guide, SK98226 - ClusterXL New Mode Overview

• Question 220:

  You have a Gateway that is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.

  How many cores can be used in a Cluster for Firewall-kernel on the new device?

  A. 2
  B. 1
  C. 3
  D. 4
  C. 3