CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 401:

  How many policy layers do Access Control policy support?

  A. 2
  B. 4
  C. 1
  D. 3
  A. 2

  ---

  Explanation

  The Access Control policy supports two policy layers. These are the Network layer and the Application & URL Filtering layer. The Network layer contains rules that control the network traffic based on the source, destination, service, and action. The Application & URL Filtering layer contains rules that control the application and web access based on the application, site category, and user identity. The Access Control policy can also use inline layers, which are sub-policies that are embedded within a rule. Inline layers allow more granular control over specific traffic or scenarios, such as VPN, Mobile Access, or different user groups. However, inline layers are not considered as separate policy layers, but rather as extensions of the parent rule 4. Therefore, the correct answer is A. The Access Control policy supports two policy layers.

  References:

  1. Policy Layers in R80.x - Check Point CheckMates

  2. Access Control policies, layers, and rules | Check Point Firewall...

  3. Chapter 8: Introduction to Policies, Layers, and Rules - Check Point...

  4. Creating an Access Control Policy - Check Point Software

• Question 402:

  What is the most ideal Synchronization Status for Security Management Server High Availability deployment?

  A. Never been synchronized
  B. Collision
  C. Synchronized
  D. Lagging
  C. Synchronized

• Question 403:

  You need to change the MAC-address on eth2 interface of the gateway.

  What command and what mode will you use to achieve this goal?

  A. set interface eth2 mac-addr 11:11:11:11:11:11; CLISH
  B. ifconfig eth1 hw 11:11:11:11:11:11; expert
  C. set interface eth2 hw-addr 11:11:11:11:11:11; CLISH
  D. ethtool -i eth2 mac 11:11:11:11:11:11; expert
  A. set interface eth2 mac-addr 11:11:11:11:11:11; CLISH

  ---

  Explanation

  You need to change the MAC-address on eth2 interface of the gateway. The command and the mode that you will use to achieve this goal are set interface eth2 mac-addr 11:11:11:11:11:11; CLISH. This command

  allows you to change the MAC address of an interface in GAIA, which can be useful for replacing a faulty network card or cloning another device. The command is executed in CLISH mode, which is a shell that provides a menu-based interface for configuring various system settings. To apply the changes, you need to save the configuration and restart the interface.

  References:

  Gaia Administration Guide R81, page 31.

• Question 404:

  What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

  

  A. SmartCenter Server cannot reach this Security Gateway.
  B. There is a blade reporting a problem.
  C. VPN software blade is reporting a malfunction.
  D. Security Gateway's MGNT NIC card is disconnected.
  B. There is a blade reporting a problem.

  ---

  Explanation

  If Deyra sees the gateway status as shown in the image, it means that there is a blade reporting a problem. The red exclamation mark indicates that one or more blades on the gateway have an issue that needs attention. The issue could be related to configuration, license, policy, or other factors. Deyra can hover over the icon to see more details about the problem.

  References:

  Training & Certification | Check Point Software, New Courses and Certificates for R81.20 - Check Point

  CheckMates

• Question 405:

  In R81, where do you manage your Mobile Access Policy?

  A. Access Control Policy
  B. Through the Mobile Console
  C. Shared Gateways Policy
  D. From the Dedicated Mobility Tab
  B. Through the Mobile Console

  ---

  Explanation

  In R81, you manage your Mobile Access Policy from the Mobile Console. The Mobile Console is a separate web-based interface that allows you to configure and monitor Mobile Access features, such as VPN, portal, applications, users, devices, and certificates. The Mobile Console can be accessed from any browser by entering

  https://<Management_Server_IP>/mobileconsole.

  References:

  [Mobile Console]

• Question 406:

  What destination versions are supported for a Multi-Version Cluster Upgrade?

  A. R77.30 and later
  B. R80.10 and Later
  C. R70 and Later
  D. R76 and later
  B. R80.10 and Later

• Question 407:

  Which Identity Source(s) should be selected in Identity Awareness for when there is a requirement for a higher level of security for sensitive servers?

  A. Endpoint Identity Agent and Browser-Based Authentication
  B. AD Query
  C. Terminal Servers Endpoint Identity Agent
  D. RADIUS and Account Logon
  A. Endpoint Identity Agent and Browser-Based Authentication

• Question 408:

  What are valid authentication methods for mutual authenticating the VPN gateways?

  A. PKI Certificates and Kerberos Tickets
  B. PKI Certificates and DynamicID OTP
  C. Pre-Shared Secrets and Kerberos Ticket
  D. Pre-shared Secret and PKI Certificates
  D. Pre-shared Secret and PKI Certificates

  ---

  Explanation

  The valid authentication methods for mutual authenticating the VPN gateways are Pre-shared Secret and PKI Certificates. Pre-shared Secret is a method that uses a secret key that is known only to the two VPN gateways. PKI Certificates is a method that uses digital certificates that are issued by a trusted Certificate Authority (CA) and contain the public key of each VPN gateway. Both methods ensure that the VPN gateways can verify each other's identity before establishing a secure VPN tunnel.

• Question 409:

  What are the attributes that SecureXL will check after the connection is allowed by Security Policy?

  A. Source address, Destination address, Source port, Destination port, Protocol
  B. Source MAC address, Destination MAC address, Source port, Destination port, Protocol
  C. Source address, Destination address, Source port, Destination port
  D. Source address, Destination address, Destination port, Protocol
  A. Source address, Destination address, Source port, Destination port, Protocol

  ---

  Explanation

  The attributes that SecureXL will check after the connection is allowed by Security Policy are Source address, Destination address, Source port, Destination port, Protocol. These are the five tuple parameters that define a connection and are used by SecureXL to accelerate the traffic. The other options are either missing some of the parameters or include irrelevant ones, such as MAC addresses.

  References:

  Check Point R81 SecureXL Administration Guide

• Question 410:

  The Check Point Central Deployment Tool (CDT) communicates with the Security Gateway(s) over Check Point SIC via________ .

  A. TCP Port 19009
  B. TCP Port 18190
  C. TCP Port 18191
  D. TCP Port 18209
  D. TCP Port 18209