CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 361:

  When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?

  A. Toni? AND 10.0.4.210 NOT 10.0.4.76
  B. To** AND 10.0.4.210 NOT 10.0.4.76
  C. Ton* AND 10.0.4.210 NOT 10.0.4.75
  D. "Toni" AND 10.0.4.210 NOT 10.0.4.76
  D. "Toni" AND 10.0.4.210 NOT 10.0.4.76

  ---

  Explanation

  When running a query on your logs to find records for user Toni with a machine IP of 10.0.4.210, but excluding her tablet IP of 10.0.4.76, you would use the following query syntax: "Toni" AND 10.0.4.210 NOT 10.0.4.76. This query will match logs that contain the exact phrase "Toni" and the IP address 10.0.4.210, but not the IP address 10.0.4.76. The quotation marks around "Toni" ensure that only logs with that exact word are matched, not variations like Toni? or To**. The AND operator combines two conditions that must both be true, while the NOT operator excludes logs that match a certain condition.

  References:

  [SmartLog User Guide]

• Question 362:

  Access roles allow the firewall administrator to configure network access according to:

  A. a combination of computer or computer groups and networks.
  B. users and user groups.
  C. remote access clients.
  D. All of the above.
  D. All of the above.

• Question 363:

  In SmartConsole, where do you manage your Mobile Access Policy?

  A. Through the Mobile Console
  B. Shared Gateways Policy
  C. Fromthe Dedicated Mobility Tab
  D. Smart Dashboard
  D. Smart Dashboard

• Question 364:

  Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

  A. Symmetric routing
  B. Failovers
  C. Asymmetric routing
  D. Anti-Spoofing
  C. Asymmetric routing

  ---

  Explanation

  Sticky Decision Function (SDF) is required to prevent asymmetric routing in an Active-Active cluster.

  Asymmetric routing occurs when packets from a source to a destination follow a different path than packets from the destination to the source. This can cause problems with stateful inspection and NAT.

  SDF ensures that packets from the same connection are handled by the same cluster member.

  References:

  Check Point R81 ClusterXL Administration Guide

• Question 365:

  Which blades and or features are not supported in R81?

  A. SmartEvent Maps
  B. SmartEvent
  C. Identity Awareness
  D. SmartConsole Toolbars
  A. SmartEvent Maps

  ---

  Explanation

  According to the Check Point website, SmartEvent Maps is a feature that was supported in previous versions of SmartEvent, but is not supported in R81. SmartEvent Maps displayed a graphical representation of security events on a world map. The other options are either supported or not valid features in R81.

  References:

  SmartEvent Maps

• Question 366:

  What is the correct description for the Dynamic Balancing / Split feature?

  A. Dynamic Balancing / Split dynamically changes the number of SNDs and firewall instances based on the current load. It is only available on Quantum Appliances (not on Quantum Spark or Open Server)
  B. Dynamic Balancing / Split dynamically distributes traffic from one network interface to multiple SNDs. The interface must support Multi-Queue. It is only available on Quantum Appliances (not on Quantum Spark or Open Server)
  C. Dynamic Balancing / Split dynamically changes the number of SNDs and firewall instances based on the current load. It is only available on Quantum Appliances and Open Server (not on Quantum Spark)
  D. Dynamic Balancing / Split dynamically distributes traffic from one network interface to multiple SNDs. The interface must support Multi-Queue. It is only available on Quantum Appliances and Open Server (not on Quantum Spark)
  A. Dynamic Balancing / Split dynamically changes the number of SNDs and firewall instances based on the current load. It is only available on Quantum Appliances (not on Quantum Spark or Open Server)

  ---

  Explanation

  Dynamic Balancing (also known as Dynamic Split) is a performance optimization feature in Check Point that distributes incoming traffic from a single network interface across multiple SND (Secure Network Dispatcher) instances.

  This feature relies on Multi-Queue NIC support, allowing different receive queues to be processed by different CPU cores, improving scalability and throughput.

  Dynamic Balancing does not change the number of SNDs or firewall instances dynamically; instead, it optimizes how traffic is distributed among existing resources.

  It is supported on Quantum Appliances and Open Servers (R80.40 and later), but not on Quantum Spark platforms.

• Question 367:

  The "MAC magic" value must be modified under the following condition:

  A. There is more than one cluster connected to the same VLAN
  B. A firewall cluster is configured to use Multicast for CCP traffic
  C. There are more than two members in a firewall cluster
  D. A firewall cluster is configured to use Broadcast for CCP traffic
  A. There is more than one cluster connected to the same VLAN

  ---

  Explanation

  Comprehensive and Detailed Explanation: The "MAC magic" value, also known as the "Cluster Global ID", is a mechanism that identifies different clusters on the same network segment. It is used to prevent MAC address conflicts and ensure proper load balancing among cluster members. The "MAC magic" value is a hexadecimal number that is appended to the virtual MAC address of the cluster interface. By default, the "MAC magic" value is set to 1 for all clusters, but it must be changed manually if there is more than one cluster connected to the same VLAN. Otherwise, the clusters will not be able to communicate with each other or with external hosts. The "MAC magic" value does not need to be modified under the other conditions listed in the question. The firewall cluster can use either Broadcast or Multicast for CCP traffic without affecting the "MAC magic" value. The number of members in a firewall cluster also does not affect the "MAC magic" value, as long as they belong to the same cluster and have the same Cluster Global ID.

  References:

  Verifying Magic Mac - R81.20 - Check Point CheckMates.

  What is Magic MAC? - Check Point CheckMates Check Point R81 CLI Reference Guide, page 17 R81 ClusterXL Administration Guide, page 9-10

• Question 368:

  The "fw monitor" tool can be best used to troubleshoot________ .

  A. FWD issues
  B. Authentication issues
  C. Logging issues
  D. Network traffc issues
  D. Network traffc issues

• Question 369:

  Which command is used to restart Check Point services?

  A. cpstart
  B. cpstop
  C. service restart
  D. fw restart
  A. cpstart

  ---

  Explanation

  The cpstart command starts or restarts Check Point services.

• Question 370:

  Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using__________.

  A. UserCheck
  B. User Directory
  C. Captive Portal and Transparent Kerberos Authentication
  D. Captive Portal
  D. Captive Portal