CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 411:

  You need to change the number of firewall Instances used by CoreXL.

  How can you achieve this goal?

  A. edit fwaffinity.conf; reboot required
  B. cpconfig; reboot required
  C. edit fwaffinity.conf; reboot not required
  D. cpconfig; reboot not required
  B. cpconfig; reboot required

  ---

  Explanation

  To change the number of firewall instances used by CoreXL, the cpconfig command must be used, followed by a reboot. CoreXL is a technology that improves the performance of the Security Gateway by using multiple cores to handle concurrent connections. The number of firewall instances determines how many cores are dedicated to CoreXL. The cpconfig command allows the administrator to configure various settings on the Security Gateway, including the number of firewall instances. After changing this setting, a reboot is required for the changes to take effect. The other commands are either incorrect or do not require a reboot.

• Question 412:

  What is "Accelerated Policy Installation"?

  A. Starting R81, the QoS Policy installation process is accelerated thereby reducing the duration of the process significantly
  B. Starting in R81, the Threat Prevention Policy installation process is accelerated thereby reducing the duration of the process significantly
  C. Starting R81, the Desktop Security Policy installation process is accelerated thereby reducing the duration of the process significantly
  D. Starting R81, the Access Control Policy installation process is accelerated thereby reducing the duration of the process significantly
  D. Starting R81, the Access Control Policy installation process is accelerated thereby reducing the duration of the process significantly

• Question 413:

  Which of the following process pulls application monitoring status?

  A. fwd
  B. fwm
  C. cpwd
  D. cpd
  D. cpd

  ---

  Explanation

  The process that pulls application monitoring status is cpd. cpd is a daemon that runs on Check Point products and performs various tasks related to management communication, policy installation, license verification, logging, etc. cpd also monitors the status of other processes and applications on the system and reports it to the management server. cpd uses SNMP to collect information from various sources, such as blades, gateways, servers, etc. You can view the application monitoring status in SmartConsole by using the Gateways & Servers tab in the Logs & Monitor view.

  References:

  Check Point Processes and Daemons

• Question 414:

  What are the modes of SandBlast Threat Emulation deployment?

  A. Cloud, Smart-1 and Hybrid
  B. Cloud. OpenServer and Vmware
  C. Cloud, Appliance and Private
  D. Cloud, Appliance and Hybrid
  D. Cloud, Appliance and Hybrid

  ---

  Explanation

  SandBlast Threat Emulation is a technology that protects against zero-day and unknown malware by inspecting files in a secure sandbox environment and emulating their behavior. SandBlast Threat Emulation can be deployed in three modes: Cloud, Appliance and Hybrid. Cloud mode: The files are sent to the Check Point cloud service for emulation. This mode does not require any additional hardware or software installation. It is the easiest and most cost-effective way to deploy SandBlast Threat Emulation.

  Appliance mode: The files are sent to a dedicated appliance (TE1000X, TE2500X, or TE100X) for emulation. This mode provides the highest level of performance and scalability, as well as data privacy and compliance. It is suitable for large organizations with high security and throughput requirements. Hybrid mode: The files are first sent to the Check Point cloud service for emulation, and if the cloud service cannot determine the verdict, they are then sent to a dedicated appliance for further analysis. This mode combines the benefits of both cloud and appliance modes, offering fast response time and high accuracy.

  References:

  1: SandBlast Threat Emulation Deployment Modes

• Question 415:

  By default, which port does the WebUI listen on?

  A. 80
  B. 4434
  C. 443
  D. 8080
  C. 443

  ---

  Explanation

  The default port for the Gaia WebUI Portal is HTTPS 443. This is the standard port for secure web communication over SSL/TLS. Changing the port may cause inconsistency with the settings on the SmartConsole and is not recommended unless necessary. To change the port, you can use the CLISH command set web ssl-port <port number> and save the configuration.

• Question 416:

  Can multiple administrators connect to a Security Management Server at the same time?

  A. No, only one can be connected
  B. Yes, all administrators can modify a network object at the same time
  C. Yes, every administrator has their own username, and works in a session that is independent of other administrators.
  D. Yes, but only one has the right to write.
  C. Yes, every administrator has their own username, and works in a session that is independent of other administrators.

  ---

  Explanation

  Multiple administrators can connect to a Security Management Server at the same time. Each administrator has their own username and works in a session that is independent of other administrators.

  This allows for collaboration and simultaneous management tasks by different administrators.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 417:

  If a "ping"-packet is dropped by FW1 Policy -on how many inspection Points do you see this packet in "fw monitor"?

  A. "i", "l" and "o"
  B. I don't see it in fw monitor
  C. "i" only
  D. "i" and "l"
  C. "i" only

  ---

  Explanation

  If a "ping"-packet is dropped by FW1 Policy, you will see this packet in "fw monitor" on one inspection point only: "i". The "i" inspection point represents the inbound traffic before any rule processing. Since the packet is dropped by FW1 Policy, it will not pass through any other inspection points, such as "l" (after rule processing), "o" (outbound before rule processing), or "O" (outbound after rule processing).

  References:

  Check Point Software, Getting Started, fw monitor.

• Question 418:

  What should the admin do in case the Primary Management Server is temporary down?

  A. Run the `promote_util' to activate the Secondary Management server.
  B. The Secondary will take over automatically. Change the IP in SmartConsole to logon to the private IP of the Secondary Management Server.
  C. Use the VIP in SmartConsole you always reach the active Management Server.
  D. Logon with SmartConsole to the Secondary Management Server and choose `Make Active' under Actions in the HA Management Menu.
  D. Logon with SmartConsole to the Secondary Management Server and choose `Make Active' under Actions in the HA Management Menu.

• Question 419:

  How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

  A. By dropping traffic from websites identified through ThreatCloud Verification and URL Caching
  B. By dropping traffic that is not proven to be from clean websites in the URL Filtering blade
  C. By allowing traffic from websites that are known to run Antivirus Software on servers regularly
  D. By matching logs against ThreatCloud information about the reputation of the website
  D. By matching logs against ThreatCloud information about the reputation of the website

  ---

  Explanation

  The Anti-Virus feature of the Threat Prevention policy blocks traffic from infected websites by matching logs against ThreatCloud information about the reputation of the website. ThreatCloud is a collaborative network that collects and analyzes threat data from millions of sources worldwide. It assigns a reputation score to each website based on its malicious activity and behavior. If a website has a low reputation score, it is considered infected and blocked by the Anti-Virus blade.

  References:

  Training & Certification | Check Point Software, CCSE section

• Question 420:

  Which Queue in the Priority Queue has the maximum priority?

  A. High Priority
  B. Control
  C. Routing
  D. Heavy Data Queue
  C. Routing

  ---

  Explanation

  The Priority Queue is a feature that allows the firewall to prioritize certain types of traffic over others, such as control and routing traffic, when the CPU load is high. The Priority Queue has four levels of priority: Control, Routing, High Priority and Heavy Data Queue1. The Control level has the highest priority and is reserved for firewall control traffic, such as policy installation and synchronization. The Routing level has the second highest priority and is used for routing protocols, such as OSPF and BGP. The High Priority level has the third highest priority and is used for user-defined traffic that needs to be prioritized, such as VoIP or video conferencing. The Heavy Data Queue level has the lowest priority and is used for bulk data transfer, such as FTP or HTTP2. Therefore, the correct answer is C.

  References:

  1. Firewall Priority Queues

  2. Firewall Priority Queues setting