CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 321:

  After verifying that API Server is not running, how can you start the API Server?

  A. Run command "set api start" in CLISH mode
  B. Run command "mgmt__cli set api start" in Expert mode
  C. Run command "mgmt api start" in CLISH mode
  D. Run command "api start" in Expert mode
  D. Run command "api start" in Expert mode

  ---

  Explanation

  After verifying that API Server is not running, you can start the API Server by running the command "api start" in Expert mode. This command will start the API Server process (cpm_api) and enable it to run automatically after reboot. You can also use the command "api enable" to enable the API Server without starting it immediately. The other commands are either incorrect or not related to the API Server. The set api command is used in CLISH mode to configure API settings, such as port, domain, or certificate. The mgmt_cli command is used in Expert mode to execute API commands, such as login, logout, show, set, etc.

  References:

  [API Server]

• Question 322:

  Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. CPM allows the GUI client and management server to communicate via web services using _______.

  A. TCP Port 18190
  B. TCP Port 18191
  C. TCP Port 18209
  D. TCP port 19009
  D. TCP port 19009

• Question 323:

  Fill in the blank: __________ information is included in "Full Log" tracking option, but is not included in "Log" tracking option?

  A. Destination port
  B. Data type
  C. File attributes
  D. Application
  B. Data type

  ---

  Explanation

  The Full Log tracking option includes more information than the Log tracking option, such as the data type of the traffic. The data type indicates the type of content that was transferred, such as text, image, video, or audio. The data type can be used for filtering and reporting purposes. The Log tracking option only includes basic information, such as source, destination, service, action, and time.

• Question 324:

  How many images are included with Check Point TE appliance in Recommended Mode?

  A. 2(OS) images
  B. images are chosen by administrator during installation
  C. as many as licensed for
  D. the newest image
  A. 2(OS) images

  ---

  Explanation

  The Check Point TE appliance in Recommended Mode includes 2(OS) images. One image is used for running the appliance, and the other image is used for backup and recovery purposes. The images are not chosen by the administrator during installation, nor based on the license or the latest version.

  References:

  [Check Point R81 Threat Emulation Administration Guide]

• Question 325:

  Which command is used to enable multicast mode for Cluster Control Protocol (CCP)?

  A. cphaprob set_ccp multicast
  B. cphaconf set_ccp multicast
  C. cphaprob multicast
  D. cphaconf multicast
  B. cphaconf set_ccp multicast

  ---

  Explanation

  The command cphaconf set_ccp multicast configures CCP to use multicast communication between cluster members.

• Question 326:

  SecureXL is able to accelerate the Connection Rate using templates.

  Which attributes are used in the template to identify the connection?

  A. Source address. Destination address. Source Port, Destination port
  B. Source address. Destination address. Destination port
  C. Source address. Destination address. Destination port. Pro^col
  D. Source address. Destination address. Source Port, Destination port. Protocol
  D. Source address. Destination address. Source Port, Destination port. Protocol

  ---

  Explanation

  SecureXL uses templates to accelerate the connection rate by creating a connection entry in the SecureXL Connections Table without notifying the Firewall kernel for a predefined period of time. This reduces the load on the Firewall kernel and improves the performance of new connections. SecureXL uses five attributes to identify a connection and create a template: source address, destination address, source port, destination port, and protocol. These attributes form a unique 5-tuple that defines a connection.

  References:

  ATRG: SecureXL for R80.20 and higher: Performance Tuning Administration Guide R80

• Question 327:

  What is the correct command to observe the Sync traffic in a VRRP environment?

  A. fw monitor -e "accept[12:4,b]=224.0.0.18;"
  B. fw monitor -e "accept port(6118;"
  C. fw monitor -e "accept proto=mcVRRP;"
  D. fw monitor -e "accept dst=224.0.0.18;"
  D. fw monitor -e "accept dst=224.0.0.18;"

  ---

  Explanation

  The correct command to observe the Sync traffic in a VRRP environment is fw monitor -e "accept dst=224.

  0.0.18;". This command captures the packets that have the destination IP address of 224.0.0.18, which is the multicast address used by VRRP for synchronization. The other commands are either not valid or not specific to VRRP Sync traffic.

  References:

  [Check Point R81 ClusterXL Administration Guide], Check Point R81 Performance Tuning Administration Guide

• Question 328:

  Installations and upgrades with CPUSE require that the CPUSE agent is up-to-date. Usually the latest build is downloaded automatically.

  How can you verify the CPUSE agent build?

  A. In WebUI Status and Actions page or by running the following command in CLISH: show installer status build
  B. In WebUI Status and Actions page or by running the following command in CLISH: show installer status version
  C. In the Management Server or Gateway object in SmartConsole or by running the following command in CLISH: show installer status build
  D. In the Management Server or Gateway object in SmartConsole or by running the following command in CLISH: show installer agent
  A. In WebUI Status and Actions page or by running the following command in CLISH: show installer status build

  ---

  Explanation

  To verify the CPUSE agent build, you can use either of these methods: In WebUI Status and Actions page By running the following command in CLISH: show installer status build.

  The CPUSE agent build indicates the version of the CPUSE agent that is installed on the machine. The CPUSE agent is responsible for downloading, verifying, installing, and removing packages on Gaia OS. It is recommended to keep the CPUSE agent up-to-date to ensure a smooth installation and upgrade process.

• Question 329:

  Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.

  After installation, is the administrator required to perform any additional tasks?

  A. Run cprestart from clish
  B. After upgrading the hardware, increase the number of kernel instances using cpconfig
  C. Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores
  D. Hyperthreading must be enabled in the bios to use CoreXL.
  B. After upgrading the hardware, increase the number of kernel instances using cpconfig

• Question 330:

  Name the authentication method that require stoken authenticator.

  A. SecureID
  B. DynamicID
  C. Radius
  D. TACACS
  A. SecureID