CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 261:

  The ____ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

  A. Next Generation Threat Prevention
  B. Next Generation Threat Emulation
  C. Next Generation Threat Extraction
  D. Next Generation Firewall
  B. Next Generation Threat Emulation

  ---

  Explanation

  The software blade package that uses CPU-level and OS-level sandboxing in order to detect and block malware is the Next Generation Threat Emulation. This package is part of the Check Point SandBlast Zero-Day Protection solution, which protects organizations against unknown malware, zero-day threats and targeted attacks, and prevents infections from undiscovered exploits. CPU-level and OS-level sandboxing are two techniques that Check Point uses to analyze files and objects for malicious behavior.

  CPU-level inspection is a unique technology that detects malware at the pre-infection stage by examining the CPU instructions that the file executes. This allows Check Point to identify and block malware that tries to evade detection by using obfuscation, encryption, or polymorphism. OS-level sandboxing is a complementary technology that runs files and objects in a virtualized environment and monitors their behavior for malicious indicators. This allows Check Point to detect and block malware that tries to exploit vulnerabilities in the operating system or applications, or that performs malicious actions such as downloading additional payloads, modifying system settings, or communicating with command and control servers. Therefore, the correct answer is B. The Next Generation Threat Emulation software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

  References:

  1. Understanding SandBlast - Check Point Software Technologies

  2. HOW TO CHOOSE YOUR NEXT SANDBOXING SOLUTION - Check Point Software

  3. CHECK POINT + SERVICENOW

  4. Check Point Quantum Edge Datasheet

• Question 262:

  Which is the command to identify the NIC driver before considering about the employment of the Multi-Queue feature?

  A. ip show int eth0
  B. show interface eth0 mq
  C. ifconfig-i eth0 verbose
  D. ethtool-i eth0
  D. ethtool-i eth0

• Question 263:

  Which utility allows you to configure the DHCP service on Gaia from the command line?

  A. ifconfig
  B. dhcp_ofg
  C. sysconfig
  D. cpconfig
  C. sysconfig

  ---

  Explanation

  The utility that allows you to configure the DHCP service on Gaia from the command line is sysconfig. This utility provides a menu-based interface for configuring various system settings, including network interfaces, routing, DNS, NTP, SNMP, SSH, etc. One of the options in sysconfig is DHCP Server Configuration, which allows you to enable or disable the DHCP service, define DHCP scopes, set lease time, etc.

  References:

  Gaia Administration Guide R81, page 29.

• Question 264:

  What is the valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration?

  A. 1-254
  B. 1-255
  C. 0-254
  D. 0 - 255
  B. 1-255

  ---

  Explanation

  The valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration is 1-255. The VRID is a unique number that identifies a virtual router in a VRRP group. It is used to associate routers and their virtual IP addresses. The VRID must be the same for all routers in the same VRRP group.

• Question 265:

  For Management High Availability, which of the following is NOT a valid synchronization status?

  A. Collision
  B. Lagging
  C. Never been synchronized
  D. Down
  D. Down

• Question 266:

  While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain.

  Why does it not detect the windows domain?

  A. Security Gateway is not part of the Domain
  B. SmartConsole machine is not part of the domain
  C. Identity Awareness is not enabled on Global properties
  D. Security Management Server is not part of the domain
  B. SmartConsole machine is not part of the domain

• Question 267:

  For best practices, what is the recommended time for automatic unlocking of locked admin accounts?

  A. 20 minutes
  B. 15 minutes
  C. Admin account cannot be unlocked automatically
  D. 30 minutes at least
  D. 30 minutes at least

  ---

  Explanation

  For best practices, the recommended time for automatic unlocking of locked admin accounts is 30 minutes at least. Admin accounts can be locked due to failed login attempts, password expiration, or manual locking by another admin. To prevent unauthorized access or brute force attacks, locked admin accounts should not be unlocked automatically too soon. The recommended minimum time for automatic unlocking is 30 minutes, which can be configured from the SmartConsole under Manage > Permissions and Administrators > Advanced > Unlock locked administrators after.

• Question 268:

  Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies?

  A. Application Control
  B. Firewall
  C. Identity Awareness
  D. URL Filtering
  C. Identity Awareness

  ---

  Explanation

  The verified answer is C. Identity Awareness. Identity Awareness is the Check Point software blade that provides detailed visibility of users, groups, and machines, while also providing application and access control through the creation of accurate, identity-based policies 1. Identity Awareness allows you to easily configure network access and auditing based on three items: network location, the identity of a user and the identity of a machine 1. Identity Awareness integrates with multiple identity sources, such as Microsoft Active Directory, Cisco Identity Services Engine, and RADIUS Accounting23. Application Control is the Check Point software blade that enables network administrators to identify and control thousands of applications and widgets, and millions of websites, based on categories, risk, and characteristics. Firewall is the Check Point software blade that provides stateful inspection and enforcement of network traffic, and protects against network and application-level attacks. URL Filtering is the Check Point software blade that enables secure web access by blocking access to malicious and inappropriate websites, and enforcing compliance with corporate policies.

  References:

  Identity Awareness - Check Point Software1 Check Point Integrated Security Architecture - Check Point

  Software2 Cisco Identity Services Engine and Check Point Integration3 Application Control - Check Point Software Firewall - Check Point Software URL Filtering - Check Point Software

• Question 269:

  What API command below creates a new host object with the name "My Host" and IP address of "192.168.0.10"?

  A. set host name "My Host" ip-address "192.168.0.10"
  B. create host name "My Host" ip-address "192.168.0.10"
  C. new host name "My Host" ip-address "192.168.0.10"
  D. mgmt_cli -m <mgmt ip> add host name "My Host" ip-address "192.168.0.10"
  D. mgmt_cli -m <mgmt ip> add host name "My Host" ip-address "192.168.0.10"

• Question 270:

  View the rule below.

  

  What does the lock-symbol in the left column mean? (Choose the BEST answer.)

  A. The current administrator has read-only permissions to Threat Prevention Policy.
  B. Another user has locked the rule for editing.
  C. Configuration lock is present. Click the lock symbol to gain read-write access.
  D. The current administrator is logged in as read-only because someone else is editing the policy.
  B. Another user has locked the rule for editing.

  ---

  Explanation

  The lock symbol in the left column of the rule means that another user has locked the rule for editing. This is to prevent multiple users from editing the same rule at the same time and causing conflicts.

  https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics-TP-Policy/TP-Policy-Edit-Rules.htm