CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 381:

  What is the best method to upgrade a Security Management Server to R81.

  x when it is not connected to the Internet?

  A. CPUSE offline upgrade only
  B. Advanced upgrade or CPUSE offline upgrade
  C. Advanced Upgrade only
  D. SmartUpdate offline upgrade
  B. Advanced upgrade or CPUSE offline upgrade

  ---

  Explanation

  The best method to upgrade a Security Management Server to R81.x when it is not connected to the Internet is either Advanced upgrade or CPUSE offline upgrade. Advanced upgrade is a manual procedure that involves backing up the current configuration, installing the new version from an ISO image, and restoring the configuration. CPUSE offline upgrade is an automated procedure that involves downloading the upgrade package from the Check Point User Center, transferring it to the Security Management Server, and installing it using CPUSE. SmartUpdate offline upgrade is not a valid option, as SmartUpdate is a tool for managing licenses and software packages on multiple gateways and servers.

  References:

  1: Check Point Software, Getting Started, Upgrading Security Management Servers.

• Question 382:

  Fill in the blank: An Endpoint identity agent uses a________for user authentication.

  A. Shared secret
  B. Username/password or Kerberos Ticket
  C. Token
  D. Certificate
  B. Username/password or Kerberos Ticket

  ---

  Explanation

  An Endpoint Identity Agent is a software component that runs on the user's device and communicates with the Check Point gateway to provide user identity information. An Endpoint Identity Agent can use different methods for user authentication, such as username/password, Kerberos ticket, or certificate. However, the most common and recommended method is username/password or Kerberos ticket, which allows the user to log in to the device with their domain credentials and automatically authenticate with the gateway without entering additional credentials. This method also supports Single Sign-On (SSO) and Multi-Factor Authentication (MFA) features.

  References:

  Check Point R81 Identity Awareness Administration Guide, page 15 Check Point Certified Security Expert

  R81.20 (CCSE) Core Training, slide 14 Endpoint Identity Agent - Check Point CheckMates

• Question 383:

  Which one of the following is true about Capsule Connect?

  A. It is a full layer 3 VPN client
  B. It is supported only on iOS phones and Windows PCs
  C. It offers full enterprise mobility management
  D. It does not support all VPN authentication methods
  A. It is a full layer 3 VPN client

• Question 384:

  What is the SOLR database for?

  A. Used for full text search and enables powerful matching capabilities
  B. Writes data to the database and full text search
  C. Serves GUI responsible to transfer request to the DLE server
  D. Enables powerful matching capabilities and writes data to the database
  A. Used for full text search and enables powerful matching capabilities

  ---

  Explanation

  The SOLR database is used for full text search and enables powerful matching capabilities. The SOLR database is part of the Log Server component, which is responsible for indexing and storing logs received from Security Gateways and other sources. The SOLR database allows users to perform complex queries on the logs using keywords, filters, operators, and expressions.

• Question 385:

  Tom has connected to the R81 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.

  What will happen to the changes already made?

  A. Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work.
  B. Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.
  C. Tom's changes will be lost since he lost connectivity and he will have to start again.
  D. Tom will have to reboot his SmartConsole computer, clear to cache, and restore changes.
  A. Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work.

  ---

  Explanation

  Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work. This is because SmartConsole has a feature called Concurrent Administration, which allows multiple administrators to work on the same Security Policy simultaneously, without blocking each other or creating conflicts. Concurrent Administration uses a locking mechanism to prevent multiple administrators from modifying the same rule or object at the same time. When an administrator clicks on a rule or an object, it becomes locked and a lock icon appears next to it. The lock icon shows the name of the administrator who is working on that rule or object, and prevents other administrators from editing it until it is unlocked. Concurrent Administration also has a feature called Session Persistence, which preserves the

  changes made by an administrator in case of a network failure or a SmartConsole crash. When an administrator reconnects to the Management Server after a network failure or a SmartConsole crash, they can resume their work from where they left off, without losing any changes. The changes are stored locally on the administrator's machine until they are published to the Management Server. Therefore, if Tom has connected to the R81 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity, his changes will not be lost. They will be stored locally on his machine and he can resume his work when he reconnects to the Management Server.

• Question 386:

  Ken wants to obtain a configuration lock from other administrator on R81 Security Management Server. He can do this via WebUI or via CLI.

  Which command should he use in CLI? (Choose the correct answer.)

  A. remove database lock
  B. The database feature has one command lock database override.
  C. override database lock
  D. The database feature has two commands lock database override and unlock database. Both will work.
  D. The database feature has two commands lock database override and unlock database. Both will work.

  ---

  Explanation

  Ken can use either of the two commands lock database override or unlock database to obtain a configuration lock from another administrator on R81 Security Management Server via CLI. These commands allow him to override the existing lock and gain exclusive access to the database. He can also use the WebUI to perform the same action.

  References:

  Training & Certification | Check Point Software, New Courses and Certificates for R81.20 - Check Point

  CheckMates

• Question 387:

  Bob wants to check if the security management server has been installed as a primary or a secondary security management server.

  Which Check Point command can he use?

  A. cpprod_util MgmtlsPrimary
  B. cpprod_util FwlsSecondary
  C. cpprod_util FwlsPrimary
  D. cpprod_util MgmtlsSecondary
  C. cpprod_util FwlsPrimary

• Question 388:

  Which command collects diagnostic data for analyzing a customer setup remotely?

  A. cpv
  B. cpinfo
  C. migrate export
  D. sysinfo
  B. cpinfo

• Question 389:

  The following command is used to verify the CPUSE version:

  A. HostName:0>show installer status build
  B. [Expert@HostName:0]#show installer status
  C. [Expert@HostName:0]#show installer status build
  D. HostName:0>show installer build
  A. HostName:0>show installer status build

  ---

  Explanation

  The correct command to verify the CPUSE (Check Point Update Service Engine) version is:

  HostName:0> show installer status build

  Option B is incorrect because it uses the "[Expert@HostName:0]#" prompt, which is typically used for expert mode commands, but the CPUSE version can be checked using the "show installer status build" command in standard mode.

  Option C is incorrect because it uses the "[Expert@HostName:0]#" prompt, and while it includes the "build" parameter, it's not the standard command to check the CPUSE version.

  Option D is incorrect because it uses the "HostName:0>" prompt, but it lacks the "show" command and uses "build" instead of "status build."

  References:

  Check Point Certified Security Expert R81 documentation

• Question 390:

  Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane.

  Which is NOT an option to adjust or configure?

  A. Severity
  B. Automatic reactions
  C. Policy
  D. Threshold
  C. Policy

  ---

  Explanation

  An event is a notification that something significant has occurred on a Check Point product or network.

  Events are generated by various sources, such as blades, gateways, servers, SmartEvent, etc. You can view and manage events in SmartConsole by using the Events tab in the Logs & Monitor view. Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. The configurable properties include:

  Severity:

  The level of importance or urgency of the event. You can change the severity of an event by selecting a different value from the drop-down list. Automatic reactions: The actions that are triggered when an event occurs. You can add, edit, or delete automatic reactions for an event by clicking on the icon or the pencil

  icon. + Threshold: The minimum number or frequency of occurrences of an event that triggers an automatic reaction. You can change the threshold of an event by entering a different value in the text box.

  The policy is not an option to adjust or configure for an event. The policy is a set of rules that define how to handle events based on their source, type, severity, etc. You can create and manage policies in SmartEvent by using the Policies tab in the Logs & Monitor view.

  References:

  R81 Logging and Monitoring Administration Guide Topic 2, Exam Pool B