CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 331:

  How many interfaces can you configure to use the Multi-Queue feature?

  A. 10 interfaces
  B. 3 interfaces
  C. 4 interfaces
  D. 5 interfaces
  D. 5 interfaces

  ---

  Explanation

  How many interfaces can you configure to use the Multi-Queue feature? You can configure up to 5 interfaces to use the Multi-Queue feature. Multi-Queue is a performance enhancement feature that allows distributing the network traffic among multiple CPU cores, instead of using a single core for all traffic. Multi-Queue can be enabled on interfaces that have high traffic load and support multiple receive/transmit queues. Multi-Queue can be configured via SmartConsole or via CLI with the command sim affinity -m.

  References:

  R81 Performance Tuning Administration Guide, page 18.

• Question 332:

  Which Check Point software blade provides Application Security and identity control?

  A. Identity Awareness
  B. Data Loss Prevention
  C. URL Filtering
  D. Application Control
  D. Application Control

  ---

  Explanation

  Application Control is the software blade that provides Application Security and identity control. It allows administrators to define granular policies based on users or groups to identify, block or limit the usage of web applications and widgets.

  Application Control also integrates with Identity Awareness to provide user-level visibility and control.

  Training & Certification | Check Point Software, Check Point Resource Library

• Question 333:

  Fill in the blank: The IPS policy for pre-R81 gateways is installed during the _______.

  A. Firewall policy install
  B. Threat Prevention policy install
  C. Anti-bot policy install
  D. Access Control policy install
  C. Anti-bot policy install

  ---

  Explanation

  The IPS policy for pre-R81 gateways is installed during the Anti-bot policy install. The Anti-bot policy install includes both Anti-bot and IPS protections for pre-R81 gateways, since they share the same inspection engine. For R81 and above gateways, the IPS policy is installed separately as part of the Threat

  Prevention policy install, which also includes Anti-virus and Threat Emulation protections.

  References:

  R81 Threat Prevention Administration Guide, page 15.

• Question 334:

  Which of the following links will take you to the SmartView web application?

  A. https://<Security Management Server host name>/smartviewweb/
  B. https://<Security Management Server IP Address>/smartview/
  C. https://<Security Management Server host name>smartviewweb
  D. https://<Security Management Server IP Address>/smartview
  B. https://<Security Management Server IP Address>/smartview/

  ---

  Explanation

  The SmartView web application is a web-based interface that allows you to view and analyze logs and events from your Security Gateways and Management Servers. To access the SmartView web application, you need to use the following link:

  https://<Security

  Management Server IP Address>/smartview/. This linkwillpromptyoutoenteryourcredentialsandthentakeyoutotheSmartViewdashboard.Theotheroptionsarenotcorrectbecause:

  Option A: The link

  https://<Security

  Management Server host name>/smartviewweb/ is missing a slash (/)betweenthehostnameandsmartviewweb.

  Option C. The link

  https://<Security

  Management Server host name>smartviewweb is missing a slash (/)afterthehostnameandbeforesmartviewweb.

  Option D. The link

  https://<Security

  Management Server IP Address>/smartview is missing a slash (/) attheend.

  References:

  Views and Reports Tutorial R80

• Question 335:

  What state is the Management HA in when both members have different policies/databases?

  A. Lagging
  B. Never been synchronized
  C. Collision
  D. Synchronized
  C. Collision

• Question 336:

  What is the purpose of a SmartEvent Correlation Unit?

  A. The SmartEvent Correlation Unit is designed to check the connection reliability from SmartConsole to the SmartEvent Server.
  B. The SmartEvent Correlation Unit's task it to assign severity levels to the identified events.
  C. The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events.
  D. The SmartEvent Correlation Unit is designed to check the availability of the SmartReporter Server.
  C. The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events.

  ---

  Explanation

  The purpose of a SmartEvent Correlation Unit is to evaluate logs from the log server component to identify patterns/threats and convert them to events. The SmartEvent Correlation Unit is a software module that runs on the SmartEvent server or on a dedicated server. It applies correlation rules and logic to the logs received from various sources, such as security gateways, endpoints, or third-party devices. It then generates events that represent security incidents or trends that require attention or action.

  References:

  Check Point Security Expert R81 Course, SmartEvent Administration Guide

• Question 337:

  What is the order of NAT priorities?

  A. Static NAT, IP pool NAT, hide NAT
  B. IP pool NAT, static NAT, hide NAT
  C. Static NAT, automatic NAT, hide NAT
  D. Static NAT, hide NAT, IP pool NAT
  A. Static NAT, IP pool NAT, hide NAT

  ---

  Explanation

  The order of NAT priorities is determined by the type of NAT rule that is applied to the traffic. There are three types of NAT rules in Check Point: static NAT, IP pool NAT, and hide

  NAT. Static NAT: This type of NAT rule maps a single IP address to another single IP address. It is usually used to allow external hosts to access internal servers or devices. Static NAT has the highest priority among the NAT rules, and it is applied before the security policy is enforced. IP pool NAT: This type of NAT rule maps a range of IP addresses to another range of IP addresses. It is usually used to balance the load among multiple servers or devices. IP pool NAT has the second highest priority among the NAT rules, and it is applied after the security policy is enforced.

  Hide NAT: This type of NAT rule hides a group of IP addresses behind a single IP address or an interface. It is usually used to allow internal hosts to access external resources. Hide NAT has the lowest priority among the NAT rules, and it is applied after the security policy is enforced.

  Therefore, the order of NAT priorities is: static NAT, IP pool NAT, hide NAT.

  References:

  1: Check Point R81 Security Administration Guide - Check Point Software, page 209

  2: Check Point R81 Security Engineering Guide - Check Point Software, page 163

• Question 338:

  Which type of Endpoint Identity Agent includes packet tagging and computer authentication?

  A. Full
  B. Custom
  C. Light
  D. Complete
  A. Full

  ---

  Explanation

  The type of Endpoint Identity Agent that includes packet tagging and computer authentication is Full.

  Packet tagging is a feature that allows the Endpoint Identity Agent to add a tag to the packets sent by the user's device, which contains the user's identity information. This way, the Security Gateway can identify the user without requiring additional authentication methods. Computer authentication is a feature that allows the Endpoint Identity Agent to authenticate the user's device using a certificate, which ensures that only authorized devices can access the network resources. The Full Endpoint Identity Agent supports both packet tagging and computer authentication, as well as other features such as Single Sign-On (SSO), Multi-Factor Authentication (MFA), and VPN.

  References:

  Check Point R81 Identity Awareness Administration Guide, page 15 Endpoint Identity Agent - Check Point

  CheckMates Check Point Identity Agent - All flavors for Windows OS in a single package (Full, Light, v1 and v2 for Terminal Server)

• Question 339:

  

  What can we infer about the recent changes made to the Rule Base?

  A. Rule 7 was created by the 'admin' administrator in the current session
  B. 8 changes have been made by administrators since the last policy installation
  C. The rules 1, 5 and 6 cannot be edited by the 'admin' administrator
  D. Rule 1 and object webserver are locked by another administrator
  D. Rule 1 and object webserver are locked by another administrator

  ---

  Explanation

  Based on the image provided by the user, we can infer that rule 1 and object webserver are locked by another administrator. This is because they have red lock icons next to them, which indicate that they are being edited by another administrator in another session. The lock icons prevent other administrators from modifying these objects until the changes are published or discarded by the original administrator. The lock icons also show the name of the administrator who locked the objects when hovered over with the mouse cursor.

  The other options are incorrect because: Rule 7 was not created by the 'admin' administrator in the current session, but by another administrator in another session. This is because it has a blue lock icon next to it, which indicates that it was added by another administrator in another session. The blue lock icon prevents other administrators from deleting this rule until the changes are published or discarded by the original administrator.

  8 changes have not been made by administrators since the last policy installation, but in the current session by the 'admin' administrator. This is because there is a yellow number 8 next to the Install Policy button, which indicates that there are 8 unpublished changes in the current session by the 'admin' administrator. These changes will be published or discarded when the 'admin' administrator clicks on Publish or Discard buttons.

  The rules 1, 5 and 6 can be edited by the 'admin' administrator, but only after unlocking them from another administrator who locked them in another session. This is because they have red lock icons next to them, which indicate that they are being edited by another administrator in another session. The 'admin' administrator can unlock these rules by right-clicking on them and selecting Unlock from the menu.

  However, this will discard the changes made by the original administrator who locked them.

• Question 340:

  When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

  A. ThreatCloud is a database-related application which is located on-premise to preserve privacy of company-related data
  B. ThreatCloud is a collaboration platform for all the CheckPoint customers to form a virtual cloud consisting of a combination of all on-premise private cloud environments
  C. ThreatCloud is a collaboration platform for Check Point customers to benefit from VMWare ESXi infrastructure which supports the Threat Emulation Appliances as virtual machines in the EMC Cloud
  D. ThreatCloud is a collaboration platform for all the Check Point customers to share information about malicious and benign files that all of the customers can benefit from as it makes emulation of known files unnecessary
  D. ThreatCloud is a collaboration platform for all the Check Point customers to share information about malicious and benign files that all of the customers can benefit from as it makes emulation of known files unnecessary

  ---

  Explanation

  ThreatCloud is a collaboration platform for all the Check Point customers to share information about malicious and benign files that all of the customers can benefit from as it makes emulation of known files unnecessary. ThreatCloud is a cloud-based service that collects and analyzes threat intelligence from multiple sources, such as Check Point products, third-party vendors, open sources, and customers.

  ThreatCloud provides real-time updates and feeds to Check Point products, such as SandBlast, which is a solution that detects and prevents zero-day attacks by emulating files in a sandbox environment. By integrating with ThreatCloud, a Threat Emulation appliance can benefit from the shared information about malicious and benign files, and avoid emulating files that are already known to be safe or harmful. This can improve the performance and efficiency of the Threat Emulation appliance. The other options are either incorrect or not relevant to ThreatCloud or Threat Emulation.