CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 221:

  What is the responsibility of SOLR process on the management server?

  A. Validating all data before it's written into the database
  B. It generates indexes of data written to the database
  C. Communication between SmartConsole applications and the Security Management Server
  D. Writing all information into the database
  B. It generates indexes of data written to the database

• Question 222:

  How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

  A. cphaprob set int fwha_vmac_global_param_enabled 1
  B. clusterXL set int fwha_vmac_global_param_enabled 1
  C. fw ctl set int fwha_vmac_global_param_enabled 1
  D. cphaconf set int fwha_vmac_global_param_enabled 1
  C. fw ctl set int fwha_vmac_global_param_enabled 1

  ---

  Explanation

  To enable VMAC mode on a cluster member, you need to set the value of the global kernel parameter fwha_vmac_global_param_enabled to 1. This can be done on-the-fly using the command fw ctl set int fwha_vmac_global_param_enabled 1 on all cluster members. This command does not require a reboot or a policy installation. VMAC mode allows the cluster to use a virtual MAC address for its virtual IP addresses, which reduces the number of gratuitous ARP packets sent upon failover and avoids ARP cache issues on some routers and switches.

  References:

  How to enable ClusterXL Virtual MAC (VMAC) mode

• Question 223:

  What is the difference between Updatable Objects and Dynamic Objects?

  A. Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally. In both cases there is no need to install policy for the changes to take effect.
  B. Dynamic Objects are maintained automatically by the Threat Cloud. For Dynamic Objects there is no need to install policy for the changes to take effect. Updatable Objects are created and maintained locally.
  C. Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally. For Dynamic Objects there is no need to install policy for the changes to take effect.
  D. Dynamic Objects are maintained automatically by the Threat Cloud. Updatable Objects are created and maintained locally. In both cases there is no need to install policy for the changes to take effect.
  A. Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally. In both cases there is no need to install policy for the changes to take effect.

• Question 224:

  When an encrypted packet is decrypted, where does this happen?

  A. Security policy
  B. Inbound chain
  C. Outbound chain
  D. Decryption is not supported
  A. Security policy

  ---

  Explanation

  When an encrypted packet is received by a Check Point Security Gateway, it is decrypted according to the security policy. The security policy defines the rules and settings for encryption and decryption of traffic, such as the encryption algorithm, the encryption domain, the pre-shared secret or certificate, etc. The security policy is enforced by the Firewall kernel, which is responsible for decrypting the packets before passing them to the inbound chain for further inspection. The inbound chain consists of various inspection modules that apply security checks and actions on the decrypted packets. The outbound chain is the reverse process, where the packets are inspected and then encrypted according to the security policy before being sent out.

  References:

  Check Point Firewall Security Solution, Check Point R81 Cyber Security Platform, Check Point VPN Administration Guide R81

• Question 225:

  Which of these is an implicit MEP option?

  A. Primary-backup
  B. Source address based
  C. Round robin
  D. Load Sharing
  A. Primary-backup

  ---

  Explanation

  Implicit MEP (Multicast Ethernet Point) options refer to the way multicast traffic is handled within a network.

  In this case, the question is asking about an implicit MEP option, and the correct answer is:

  Option A. Primary-backup: This is an implicit MEP option where one switch (primary) forwards multicast traffic while the other switch (backup) does not forward the traffic. It is used to ensure redundancy in case the primary switch fails.

  Option B ,

  Option C and Option D are not implicit MEP options; they are different methods of handling multicast traffic and do not describe the concept of primary-backup. Therefore, option

  A is the correct answer as it represents an implicit MEP option.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 226:

  Which statement is correct about the Sticky Decision Function?

  A. It is not supported with either the Performance pack of a hardware based accelerator card
  B. Does not support SPI's when configured for Load Sharing
  C. It is automatically disabled if the Mobile Access Software Blade is enabled on the cluster
  D. It is not required L2TP traffic
  A. It is not supported with either the Performance pack of a hardware based accelerator card

  ---

  Explanation

  The statement that is correct about the Sticky Decision Function is It is not supported with either the Performance pack of a hardware based accelerator card. The Sticky Decision Function (SDF) is a feature that ensures that packets from the same connection are handled by the same cluster member in a Load Sharing configuration. However, SDF is not compatible with SecureXL acceleration, which is enabled by default or by using a Performance pack or a hardware based accelerator card 4. The other statements are either incorrect or outdated about SDF.

  References:

  Check Point R81 ClusterXL Administration Guide, Sticky Decision Function - Check Point CheckMates

• Question 227:

  Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

  A. All Connections (Clear or Encrypted)
  B. Accept all encrypted traffic
  C. Specific VPN Communities
  D. All Site-to-Site VPN Communities
  C. Specific VPN Communities

  ---

  Explanation

  The option that allows traffic to VPN gateways in specific VPN communities is Specific VPN Communities.

  This option lets you specify which VPN communities are allowed or denied by the rule. A VPN community is a group of VPN gateways or hosts that share the same VPN policy and keys. You can create different types of VPN communities, such as star, meshed, or remote access, depending on your network topology and security requirements. You can also use tags to group VPN gateways or hosts into logical categories.

• Question 228:

  Alice & Bob are going to use Management Data Plane Separation and therefore the routing separation needs to be enabled.

  Which of the following command is true for enabling the Management Data Plane Separation (MDPS)?

  A. set mdps split brain on
  B. set mdps data plane off
  C. set mdps mgmt plane on
  D. set mdps split plane on
  C. set mdps mgmt plane on

• Question 229:

  The Firewall Administrator is required to create 100 new host objects with different IP addresses.

  What API command can he use in the script to achieve the requirement?

  A. add host name <New HostName> ip-address <ip address>
  B. add hostname <New HostName> ip-address <ip address>
  C. set host name <New HostName> ip-address <ip address>
  D. set hostname <New HostName> ip-address <ip address>
  A. add host name <New HostName> ip-address <ip address>

  ---

  Explanation

  The API command add host name <New HostName> ip-address <ip address> can be used in a script to create 100 new host objects with different IP addresses. This command adds a new host object with the specified name and IP address to the database. The other commands are either not valid or not suitable for creating new host objects.

  References:

  Check Point - Management API reference

• Question 230:

  What is the recommended way to have a redundant Sync connection between the cluster nodes?

  A. In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management and define two Sync interfaces per node. Connect both Sync interfaces without using a switch.
  B. Use a group of bonded interfaces. In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management and define a Virtual IP for the Sync interface.
  C. In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management and define two Sync interfaces per node. Use two different Switches to connect both Sync interfaces.
  D. Use a group of bonded interfaces connected to different switches. Define a dedicated sync interface, only one interface per node using the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management.
  D. Use a group of bonded interfaces connected to different switches. Define a dedicated sync interface, only one interface per node using the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management.

  ---

  Explanation

  The recommended way to have a redundant Sync connection between the cluster nodes is to use a group of bonded interfaces connected to different switches. In the SmartConsole / Gateways & Servers -> select

  Cluster Properties / Network Management, you should define a dedicated sync interface, only one interface per node.