CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 251:

  There are 4 ways to use the Management API for creating host object with the Management API.

  Which one is NOT correct?

  A. Using cpconfig
  B. Using CLISH
  C. Using SmartConsole GUI console
  D. Using Web Services
  A. Using cpconfig

• Question 252:

  Fill in the blank. With the User Directory Software Blade, you can create user definitions on a(n) ________ Server.

  A. SecurID
  B. NT domain
  C. LDAP
  D. SMTP
  C. LDAP

• Question 253:

  Which Mobile Access Solution is clientless?

  A. Mobile Access Portal
  B. Checkpoint Mobile
  C. Endpoint Security Suite
  D. SecuRemote
  A. Mobile Access Portal

• Question 254:

  By default, what information is NOT collected from a Security Gateway in a CPINFO?

  A. OS and Network Statistics
  B. Configuration and database files
  C. Firewall logs Most Voted
  D. System message logs
  C. Firewall logs Most Voted

• Question 255:

  How many users can have read/write access in Gaia at one time?

  A. Infinite
  B. One
  C. Three
  D. Two
  B. One

  ---

  Explanation

  How many users can have read/write access in Gaia at one time? Only one user can have read/write access in Gaia at one time. This is to prevent conflicts and inconsistencies in the configuration changes made by different users. If another user tries to login with read/write access while a user is already logged in, they will receive a warning message and will be given the option to either login with read-only access or force the other user to logout.

• Question 256:

  Which command displays routing table entries?

  A. netstat -rn
  B. route print
  C. ip route
  D. show route
  A. netstat -rn

  ---

  Explanation

  The netstat -rn command displays the routing table on Gaia systems.

• Question 257:

  Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ____ all traffic.

  However, in the Application Control policy layer, the default action is ______ all traffic.

  A. Accept; redirect
  B. Accept; drop
  C. Redirect; drop
  D. Drop; accept
  D. Drop; accept

  ---

  Explanation

  In the Network policy layer, the default action for the Implied last rule is drop all traffic. However, in the Application Control policy layer, the default action is accept all traffic. The Implied last rule is a rule that is automatically added at the end of each policy layer and defines what to do with traffic that does not match any of the user-defined rules. The default actions for each policy layer can be changed in the Global Properties or in the layer properties.

  References:

  R81 Security Management Administration Guide, page 30.

• Question 258:

  SandBlast agent extends Zero-day prevention to what part of the network?

  A. Web Browsers and user devices
  B. DMZ server
  C. Cloud
  D. Email servers
  A. Web Browsers and user devices

  ---

  Explanation

  SandBlast agent extends zero-day prevention to web browsers and user devices. Zero-day prevention is a capability that protects devices from unknown and emerging threats that exploit vulnerabilities that have not been patched or disclosed. SandBlast Agent provides zero-day prevention by using various technologies such as threat emulation, threat extraction, anti-exploitation, anti-ransomware, and behavioral analysis. SandBlast Agent protects web browsers and user devices from malicious downloads, phishing links, drive-by downloads, browser exploits, malicious scripts, and more.

• Question 259:

  The Correlation Unit performs all but the following actions:

  A. Marks logs that individually are not events, but may be part of a larger pattern to be identified later.
  B. Generates an event based on the Event policy.
  C. Assigns a severity level to the event.
  D. Takes a new log entry that is part of a group of items that together make up an event, and adds it to an ongoing event.
  C. Assigns a severity level to the event.

  ---

  Explanation

  The Correlation Unit in Check Point Security Management performs several actions, but it does not assign a severity level to the event. The Correlation Unit is responsible for identifying patterns in logs, marking logs that are part of larger patterns, generating events based on the Event policy, and adding new log entries to ongoing events. However, assigning a severity level to an event is typically done through the Event policy configuration, not by the Correlation Unit.

  References:

  Check Point Certified Security Expert R81 Study Guide

• Question 260:

  What is the benefit of "tw monitor" over "tcpdump"?

  A. "fw monitor" reveals Layer 2 information, while "tcpdump" acts at Layer 3.
  B. "fw monitor" is also available for 64-Bit operating systems.
  C. With "fw monitor", you can see the inspection points, which cannot be seen in "tcpdump"
  D. "fw monitor" can be used from the CLI of the Management Server to collect information from multiple gateways.
  C. With "fw monitor", you can see the inspection points, which cannot be seen in "tcpdump"

  ---

  Explanation

  The benefit of fw monitor over tcpdump is that with fw monitor, you can see the inspection points, which cannot be seen in tcpdump. Inspection points are the locations in the firewall kernel where packets are inspected by the security policy and other software blades. Fw monitor allows you to capture packets at different inspection points and see how they are processed by the firewall. Tcpdump, on the other hand, is a generic packet capture tool that only shows the packets as they enter or leave the network interface.

  References:

  Check Point Security Expert R81 Course, fw monitor, tcpdump