CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 241:

  When defining QoS global properties, which option below is not valid?

  A. Weight
  B. Authenticated timeout
  C. Schedule
  D. Rate
  D. Rate

  ---

  Explanation

  QoS global properties are the settings that apply to all QoS rules and QoS interfaces on the Security Gateway. They include the following options:

  Weight: This is the relative importance of a QoS rule compared to other QoS rules. A higher weight means a higher priority. The default weight is 1, and the maximum weight is 1000. Authenticated timeout: This is the time period in seconds that a connection remains in the QoS rule after the last packet is sent or received. The default timeout is 600 seconds, and the minimum timeout is 60 seconds.

  Schedule: This is the time period in which a QoS rule is active. You can define a schedule for each day of the week, or use the default schedule of always active.

  Rate: This is not a valid option for QoS global properties. Rate is an option for QoS rule action, which defines the maximum bandwidth allocated for a QoS rule.

  The rate can be specified in Kbps, Mbps, or percentage of interface speed.

  References:

  1. QoS R81.20 Administration Guide - Check Point Software

  2. QoS R81 Administration Guide -Check Point Software

• Question 242:

  The admin lost access to the Gaia Web Management Interface, but he was able to connect via SSH.

  How can you check if the web service is enabled, running, and which port is used?

  A. In expert mode, run # netstat -tulnp | grep httpd to see if httpd is up and to get the port number. In clish, run > show web daemon-enable to see if the web daemon is enabled.
  B. In clish, run > show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode, run # netstat -anp | grep httpd to see if httpd is up.
  C. In clish, run > show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode, run # netstat -anp | grep httpd2 to see if httpd2 is up.
  D. In expert mode, run # netstat -tulnp | grep httpd2 to see if httpd2 is up and to get the port number. In clish, run > show web daemon-enable to see if the web daemon is enabled.
  C. In clish, run > show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode, run # netstat -anp | grep httpd2 to see if httpd2 is up.

  ---

  Explanation

  The correct way to check if the web service is enabled, running, and which port is used is to use option C.

  In clish, run show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode, run netstat -anp | grep httpd2 to see if httpd2 is up. The httpd2 service is responsible for the Gaia Web Management Interface. If the web daemon is disabled, you can enable it by running set web daemon- enable on in clish. If the httpd2 service is down, you can start it by running service httpd2 start in expert mode.

  References:

  Gaia WebUI and CLI - Check Point CheckMates, Gaia R81.20 Administration Guide - Check Point Software, Gaia R81 Administration Guide - Check Point Software, How to restart Gaia Portal (WebUI) process - Check Point Software

• Question 243:

  Which feature is NOT provided by all Check Point Mobile Access solutions?

  A. Support for IPv6
  B. Granular access control
  C. Strong user authentication
  D. Secure connectivity
  A. Support for IPv6

  ---

  Explanation

  The feature that is not provided by all Check Point Mobile Access solutions is support for IPv6. Check Point Mobile Access is a comprehensive solution that provides secure remote access to corporate applications and resources using various methods, such as SSL VPN, IPsec VPN, clientless VPN, and mobile VPN. However, not all of these methods support IPv6, which is the latest version of the Internet Protocol that uses 128-bit addresses. According to the Check Point Mobile Access R81 Administration Guide1, only the following Mobile Access methods support IPv6: SSL Network Extender (SNX) - a thin client that enables remote users to connect securely to the corporate network using SSL/TLS VPN. Mobile VPN - a full VPN client that enables remote users to connect securely to the corporate network using IPsec VPN. Capsule Connect - a mobile VPN app for iOS and Android devices that enables remote users to connect securely to the corporate network using IPsec VPN. The following Mobile Access methods do not support

  IPv6: Clientless VPN - a web-based method that enables remote users to access web applications and services using a web browser without installing any software on their devices.

  Endpoint Security VPN - a full VPN client that enables remote users to connect securely to the corporate network using IPsec VPN and also provides endpoint security features such as firewall, anti-virus, anti-malware, etc.

  Capsule Workspace - a mobile app for iOS and Android devices that enables remote users to access email, calendar, contacts, and corporate applications securely without requiring a VPN connection.

• Question 244:

  Which command is used to disable SecureXL?

  A. fwaccel off
  B. fw ctl accel off
  C. fw ctl multik off
  D. cpconfig disable accel
  A. fwaccel off

  ---

  Explanation

  The command fwaccel off disables SecureXL, which is often required for troubleshooting.

• Question 245:

  According to out of the box SmartEvent policy, which blade will automatically be correlated into events?

  A. Firewall
  B. VPN
  C. IPS
  D. HTTPS
  C. IPS

  ---

  Explanation

  According to out of the box SmartEvent policy, the blade that will automatically be correlated into events is IPS. IPS (Intrusion Prevention System) is a blade that detects and prevents network attacks by inspecting traffic and applying signatures and protections. SmartEvent correlates IPS logs into events based on predefined event definitions, such as IPS Attack, IPS Attack High Confidence, IPS Attack Critical Confidence, etc. The other blades are not automatically correlated into events by default, but they can be added to the SmartEvent policy manually.

  References:

  [SmartEvent Policy]

• Question 246:

  Tom has been tasked to install Check Point R81 in a distributed deployment.

  Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

  A. One machine, but it needs to be installed using SecurePlatform for compatibility purposes.
  B. One machine
  C. Two machines
  D. Three machines
  C. Two machines

  ---

  Explanation

  Tom will need two machines to install Check Point R81 in a distributed deployment, if he does not include a SmartConsole machine in his calculations. A distributed deployment consists of a Security Management Server that manages one or more Security Gateways. Therefore, Tom will need one machine for the Security Management Server and another machine for the Security Gateway. The other options are either too few or too many machines for a distributed deployment.

  References:

  Check Point R81 Installation and Upgrade Guide

• Question 247:

  What a valid SecureXL paths in R81.20?

  A. F2F (Slow path). Templated Path. PQX and F2V
  B. F2F (Slow path). PXL, QXL and F2V
  C. F2F (Slow path), Accelerated Path, PQX and F2V
  D. F2F (Slow path), Accelerated Path, Medium Path and F2V
  D. F2F (Slow path), Accelerated Path, Medium Path and F2V

  ---

  Explanation

  The valid SecureXL paths in R81.20 are F2F (Slow path), Accelerated Path, Medium Path and F2V.

  SecureXL is a technology that accelerates the performance of the Security Gateway by offloading CPU-intensive operations to the SecureXL device 2. SecureXL uses different paths to process packets, depending on the type and state of the connection. The SecureXL paths are:

  F2F (Slow path): This path handles packets that require a full inspection by the Firewall kernel. It is the slowest path, but it supports all features and blades. Examples of packets that use this path are packets that belong to a new connection, packets that match a rule with UTM blades, or packets that require address translation.

  Accelerated Path: This path handles packets that belong to an established connection that does not require any further inspection by the Firewall kernel. It is the fastest path, but it supports only a limited set of features and blades. Examples of packets that use this path are packets that match an accept rule with no UTM blades, or packets that match a rule with SecureXL acceleration enabled.

  Medium Path: This path handles packets that belong to an established connection that requires some inspection by the Firewall kernel, but not a full inspection. It is faster than the F2F path, but slower than the Accelerated path. It supports more features and blades than the Accelerated path, but less than the F2F path. Examples of packets that use this path are packets that match a rule with IPS or Anti-Bot blades, or packets that require NAT templates.

  F2V: This path handles packets that are encapsulated or decapsulated by the VPN kernel. It is faster than the F2F path, but slower than the Accelerated path. It supports VPN features such as encryption, decryption, encapsulation, and decapsulation.

  References:

  R81.x Security Gateway Architecture (Logical Packet Flow) - Check Point CheckMates, SecureXL

  Mechanism in R80.10 and above - Check Point Software, SecureXL - Check Point Software

• Question 248:

  Fill in the blanks. Default port numbers for an LDAP server is________for standard connections and

  ________ SSL connections.

  A. 443; 389
  B. 636; 8080
  C. 290; 3389
  D. 389; 636
  D. 389; 636

• Question 249:

  Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

  A. Yes, but they need to have a mutually trusted certificate authority
  B. Yes, but they have to have a pre-shared secret key
  C. No, they cannot share certificate authorities
  D. No, Certificate based VPNs are only possible between Check Point devices
  A. Yes, but they need to have a mutually trusted certificate authority

  ---

  Explanation

  Check Point and Third-party Gateways can establish a certificate-based Site-to-Site VPN tunnel if they have a mutually trusted certificate authority. This means that both gateways trust the same root CA or intermediate CA that issued their certificates. This way, they can authenticate each other using their certificates and establish a secure VPN tunnel.

  References:

  Check Point Resource Library, page 5

• Question 250:

  Which file contains the host address to be published, the MAC address that needs to be associated with the API address, and the unique IP of the interface that responds to ARP request?

  A. /opt/CP-shrd-R80/conf/local.arp
  B. $FWDIR/conf/local.arp
  C. $CPDIR/conf/local.arp
  D. /var/opt/CPshrd-R80/conf/local.arp
  B. $FWDIR/conf/local.arp